{ "Event": { "published": true, "date": "2022-03-17", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-03-17", "timestamp": 1647561781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "9b9113e5-d0a8-4c02-a891-1c26f8bd5211", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3be7853-a620-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647541992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541992, "uuid": "1dc3b346-ad86-45a8-bbb2-036b7582450d", "comment": "Malware payload", "value": "ba637793008fdd215bb85b665c6372dc", "object_relation": "md5", "Tag": [ { "name": "AS15169 Google LLC", "colour": "#00D242", "exportable": true, "hide_tag": false }, { "name": "drive.google.com", "colour": "#06F7F8", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false }, { "name": "US", "colour": "#5DD512", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541992, "uuid": "3c07f5e2-b8bd-4943-ad03-45c058b7a7e8", "comment": "Malware payload", "value": "000185f8e43b9fd56653c63ec6877bcf42cdb58a56736b784d9a806d16c3e46d", "object_relation": "sha256", "Tag": [ { "name": "AS15169 Google LLC", "colour": "#00D242", "exportable": true, "hide_tag": false }, { "name": "drive.google.com", "colour": "#06F7F8", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false }, { "name": "US", "colour": "#5DD512", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541992, "uuid": "6f4ec0e3-34ff-4ffe-a831-58a7b218f013", "comment": "Malware payload", "value": "178f255f7f405bbf68d9fbc591b4db452c26133c", "object_relation": "sha1", "Tag": [ { "name": "AS15169 Google LLC", "colour": "#00D242", "exportable": true, "hide_tag": false }, { "name": "drive.google.com", "colour": "#06F7F8", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false }, { "name": "US", "colour": "#5DD512", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541992, "uuid": "3318decc-5ccf-4c60-8b16-78bdbc1aa4d9", "comment": "Malware payload", "value": "2d5f4343fe6ffb5657ee9ece3134e0e753e437fc1d1920ed0d8a889e017dc433aee4fe076c69c543db1ad29bb49714cb", "object_relation": "sha3-384", "Tag": [ { "name": "AS15169 Google LLC", "colour": "#00D242", "exportable": true, "hide_tag": false }, { "name": "drive.google.com", "colour": "#06F7F8", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false }, { "name": "US", "colour": "#5DD512", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541992, "uuid": "a2f723ec-7926-45d7-9e6d-d831da9fbf56", "value": "T172F31213B6FFC922FD1E90DFED3670665BB3C98482095623E0A7E955B12180B1EDB49C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541992, "uuid": "bbd51805-05f1-417f-a4af-5f15f37f0237", "value": "3072:BdQrQrQrQrQrQrMieQN3geMBbmCygOA6QDkDEzTY/bCMQt5oaCsndwKls4Yv8PmF:VvNQeMBpJO8x0q5oa/C/18Pwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647541992, "uuid": "1c1c92f6-bdda-411b-b8d9-3bed923ceb87", "value": 171584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647541992, "uuid": "18fa0ea3-3a5c-4667-8cd0-2bb415d28915", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541992, "uuid": "53865bd8-1771-4114-836c-e65669ea2001", "value": "uc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2c0f5d-a620-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647542005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542005, "uuid": "226932d9-d46d-4a8c-bd6c-bd688c5adf36", "comment": "Malware payload", "value": "9321a4e2cd4141a43965bc0dd98fc46e", "object_relation": "md5", "Tag": [ { "name": "151.80.59.66", "colour": "#5DF77A", "exportable": true, "hide_tag": false }, { "name": "AS16276 OVH SAS", "colour": "#DAC5EE", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FR", "colour": "#514646", "exportable": true, "hide_tag": false }, { "name": "VB:Trojan.VBA.Downloader.VA", "colour": "#78D3C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542005, "uuid": "ef6d45d5-0977-4cc8-ad7e-31ba920cedfb", "comment": "Malware payload", "value": "000444a623568f34fca2d4281a5bb95c13686514625941b4c53c0db63762a872", "object_relation": "sha256", "Tag": [ { "name": "151.80.59.66", "colour": "#5DF77A", "exportable": true, "hide_tag": false }, { "name": "AS16276 OVH SAS", "colour": "#DAC5EE", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FR", "colour": "#514646", "exportable": true, "hide_tag": false }, { "name": "VB:Trojan.VBA.Downloader.VA", "colour": "#78D3C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542005, "uuid": "ca2ad237-2519-4ef4-93fd-b44c3275fa96", "comment": "Malware payload", "value": "43efb3b3e1da7b4788d27c9549264b5d2a111cc2", "object_relation": "sha1", "Tag": [ { "name": "151.80.59.66", "colour": "#5DF77A", "exportable": true, "hide_tag": false }, { "name": "AS16276 OVH SAS", "colour": "#DAC5EE", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FR", "colour": "#514646", "exportable": true, "hide_tag": false }, { "name": "VB:Trojan.VBA.Downloader.VA", "colour": "#78D3C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542005, "uuid": "14fe49bb-3781-452d-a5fb-c76893aab665", "comment": "Malware payload", "value": "7a8557b095144b61f0a0ce6185a4ee35767d10b42185065aef0263f418465cdef56602fc4d23eada19a61ba9023f7144", "object_relation": "sha3-384", "Tag": [ { "name": "151.80.59.66", "colour": "#5DF77A", "exportable": true, "hide_tag": false }, { "name": "AS16276 OVH SAS", "colour": "#DAC5EE", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FR", "colour": "#514646", "exportable": true, "hide_tag": false }, { "name": "VB:Trojan.VBA.Downloader.VA", "colour": "#78D3C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542005, "uuid": "3801d59c-57a1-4c15-aa9d-2f451181a4df", "value": "T12D347D05B2C9FFEADED289310B5FCEBCAD259C997504C906B10C777EA53462ADD82720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542005, "uuid": "0ed8808e-4ed0-4489-889f-901ab55e0366", "value": "6144:R0Rum7mdLRp1bbSBIR/EHGtCMXgTo8qoFt/etg+21pbys:R0E3dxtR/iU9mvUPGys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647542005, "uuid": "81363add-7f9a-4278-884d-8a9a535775b3", "value": 252267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647542005, "uuid": "65ed447f-b15a-408b-bcd8-92c92542664e", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542005, "uuid": "274a3a87-3e95-4a3c-8d78-3788a2afc2db", "value": "index.html.1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79fef477-a621-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647542325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542325, "uuid": "d09f60e2-f228-4243-b9b0-09f4d326c910", "comment": "Malware payload", "value": "45325a7ecb100ead34b1118820650dab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542325, "uuid": "7ffd1685-93cc-48e1-9a01-4369cb21bd2f", "comment": "Malware payload", "value": "0004cec68fdb95507c6161d84e4965db60f997a679ce20786075992f1e5b340c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542325, "uuid": "7b6433ba-cdb0-4d7f-b137-57ba1b561e4b", "comment": "Malware payload", "value": "6f294f5267c4180225899ab8801d91b982736b8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542325, "uuid": "9d29c47d-fb69-41fc-84a2-a5e03df7881e", "comment": "Malware payload", "value": "c62e898b225fe93b48f8444be5927a60c6c525dd4a2cdfb300bddfafa061b7b46a6d14cabe51eee44b884d64c6cc9cf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542325, "uuid": "434c07ea-a8ab-434c-90f3-c44de1a8135b", "value": "T19824A557ABF91098F8B3C67499725627E8723C588730D6EF9A105D1A0F32BE0F938B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542325, "uuid": "84f2ca71-a357-458c-bf61-596d90238b5b", "value": "0a1ca879f2bde6c3b1375308667c66f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542325, "uuid": "7b0a4d79-691d-4a62-9953-c0dd6902829a", "value": "3072:p8t7Y4iZ35FggqkE52acKacp34t0aORlR+KbpUgsHA2DwkWSaNY2eQ:t3nggqkEUBjqPR+BaNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647542325, "uuid": "f62b5445-930b-4290-9b51-17b6a52953e5", "value": 225994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647542325, "uuid": "61642491-d076-4b71-a230-86cd532fb797", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542325, "uuid": "d1d5bb50-226e-4ebf-8c36-df09d590458c", "value": "0004cec68fdb95507c6161d84e4965db60f997a679ce20786075992f1e5b340c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f355dbe-a621-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647542333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542333, "uuid": "8f62cb56-6fd4-4293-9696-179c76289d03", "comment": "Malware payload", "value": "0b5e7c4bc01b04817563402c6c5f17c1", "object_relation": "md5", "Tag": [ { "name": "AS7162 Universo Online S.A.", "colour": "#415F6D", "exportable": true, "hide_tag": false }, { "name": "BR", "colour": "#21F89D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "goji-actives.net", "colour": "#9FA11F", "exportable": true, "hide_tag": false }, { "name": "TR/AD.Swrort.bpkyn", "colour": "#F8AF30", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542333, "uuid": "3d2e06e7-71fd-490c-8ed7-5832479547f5", "comment": "Malware payload", "value": "0007b4ec7c22fa3c380ca09a195818398f6b7a5c0c91914994fd5df36e36af38", "object_relation": "sha256", "Tag": [ { "name": "AS7162 Universo Online S.A.", "colour": "#415F6D", "exportable": true, "hide_tag": false }, { "name": "BR", "colour": "#21F89D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "goji-actives.net", "colour": "#9FA11F", "exportable": true, "hide_tag": false }, { "name": "TR/AD.Swrort.bpkyn", "colour": "#F8AF30", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542333, "uuid": "c2c9dd05-b765-468a-a04c-6c8ae0e32376", "comment": "Malware payload", "value": "9ccaab7afe4960983d389d0375afc046e5848526", "object_relation": "sha1", "Tag": [ { "name": "AS7162 Universo Online S.A.", "colour": "#415F6D", "exportable": true, "hide_tag": false }, { "name": "BR", "colour": "#21F89D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "goji-actives.net", "colour": "#9FA11F", "exportable": true, "hide_tag": false }, { "name": "TR/AD.Swrort.bpkyn", "colour": "#F8AF30", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542333, "uuid": "b6379447-faa1-4c7c-a0a7-daabd7dbbb31", "comment": "Malware payload", "value": "adb9b1e88da68ad226140b9c44216dac5bc411b38c6901cb0bc8d25feba8d17a44fa975505a0e9d324e411d06ff1beda", "object_relation": "sha3-384", "Tag": [ { "name": "AS7162 Universo Online S.A.", "colour": "#415F6D", "exportable": true, "hide_tag": false }, { "name": "BR", "colour": "#21F89D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "goji-actives.net", "colour": "#9FA11F", "exportable": true, "hide_tag": false }, { "name": "TR/AD.Swrort.bpkyn", "colour": "#F8AF30", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542333, "uuid": "764a3fff-916c-4fb5-a377-7103c590553e", "value": "T188035BF1FE555A1ACDA5313B24CD3B8219216FF24579804EB34C4CE6FD86602F9802B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542333, "uuid": "cea05994-f441-4ce2-9f8b-e224aea8d8e1", "value": "85a6e4572e907863b7ab7c43cf7d163a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542333, "uuid": "6f6ad4f7-c5a1-446b-bb9e-643ebc07bd2a", "value": "768:st1J329qecLhyiAhnYcLmEiQygkbFYXDdq643ymWvT1yyL:c3SLmFtmzdq64CmWvT1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647542333, "uuid": "d149cadd-e177-4195-a382-79e6df4c4ef5", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647542333, "uuid": "02ca4957-fb4c-4744-bbd2-070b8485580c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542333, "uuid": "89bacf3c-df76-44ad-8787-e5dbe8fff137", "value": "artvnch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2ef7a7-a621-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647542354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542354, "uuid": "b7ed7497-db35-4c97-ae64-19275e5ab707", "comment": "Malware payload", "value": "d2074d6273f41c34e8ba370aa9af46ad", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TheZoo", "colour": "#98F4D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542354, "uuid": "593e6c8b-8e9f-4b96-88d3-a8178ae51956", "comment": "Malware payload", "value": "0008065861f5b09195e51add72dacd3c4bbce6444711320ad349c7dab5bb97fb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TheZoo", "colour": "#98F4D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542354, "uuid": "d70611ed-3ba8-4681-a1d1-cd4fd31b651b", "comment": "Malware payload", "value": "5074ec3ca672f74ea05a7b5f0f52339fbf440f9b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TheZoo", "colour": "#98F4D2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542354, "uuid": "18898939-a9e8-4e8f-af31-7c427fdacb0f", "comment": "Malware payload", "value": "6d7da3276e1f9fea8c5803fc1a5e8e154cb4039551bb1127b8575029d4721f3b0ada2ab721771e6c6fb52fa40998c0c1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TheZoo", "colour": "#98F4D2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542354, "uuid": "03c08765-95f5-4a98-92b1-5a91056f65b8", "value": "T126A37C01B1A381B5D58E497E48895B56A77FB1608FF48DC39F645B8DAE3A3C09E37302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542354, "uuid": "256b77e0-cdcd-4df2-9d95-da6a0da2d913", "value": "fc26adaf2dbb9b333a649b5cb1dbb49a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542354, "uuid": "4a64cc52-f63d-40f8-987c-d52a46c07981", "value": "1536:/NX2jX6sre6veEuyVtRoeDje92GYmeqicApjfznJevdh0u5l4kvHVOlERAhk5j:UjX6sBT9jz3qiVvnAvdl4cHVOlEyhkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647542354, "uuid": "e54a115f-8ecb-4009-884a-5b1cf6d627d0", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647542354, "uuid": "5c7c194d-5bcd-4d35-9e3f-1d842a732db9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542354, "uuid": "d29174bb-a716-4a7c-b5fc-0d6312f079ed", "value": "wnhelp2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d939b2-a621-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647542366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542366, "uuid": "63d0ea23-6949-4405-92fc-f57a2c592731", "comment": "Malware payload", "value": "1100f40e4bb90f7ca5bec8c54e638a6e", "object_relation": "md5", "Tag": [ { "name": "AS15169 Google LLC", "colour": "#00D242", "exportable": true, "hide_tag": false }, { "name": "drive.google.com", "colour": "#06F7F8", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false }, { "name": "US", "colour": "#5DD512", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542366, "uuid": "7dcc418c-86b3-401a-b161-45d645116f97", "comment": "Malware payload", "value": "0009c3cf45629021971bb7f10cb369063a3acade10791f968725d3028dacaad9", "object_relation": "sha256", "Tag": [ { "name": "AS15169 Google LLC", "colour": "#00D242", "exportable": true, "hide_tag": false }, { "name": "drive.google.com", "colour": "#06F7F8", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false }, { "name": "US", "colour": "#5DD512", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542366, "uuid": "3e9ba7b1-0dbc-46e8-8dfd-f202d803432c", "comment": "Malware payload", "value": "cd95748f4e06a672fc751219bde0d5b7925df048", "object_relation": "sha1", "Tag": [ { "name": "AS15169 Google LLC", "colour": "#00D242", "exportable": true, "hide_tag": false }, { "name": "drive.google.com", "colour": "#06F7F8", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false }, { "name": "US", "colour": "#5DD512", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542366, "uuid": "c00cb0d7-bf1b-463a-afa1-6c7f0f5acb71", "comment": "Malware payload", "value": "f8d7eff1a4a1d42b93146718ff014ff6a7bbef62834e87a88e7435167fb5023670b1a13afcad416e97b224e199d3e467", "object_relation": "sha3-384", "Tag": [ { "name": "AS15169 Google LLC", "colour": "#00D242", "exportable": true, "hide_tag": false }, { "name": "drive.google.com", "colour": "#06F7F8", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false }, { "name": "US", "colour": "#5DD512", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542366, "uuid": "365dfc0a-184e-493f-8090-0bbfec5e0f27", "value": "T1FCC3D0328CC2799AF29AA00423351D3FE6BC1DC153C62CDA5598F5A7A798D13751C377", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542366, "uuid": "89cd7802-5708-4a66-b790-10fa98130dea", "value": "1536:JvyBqBKWKfg9tEs6qOmegG/ozKeTZjfkld8Ors0aVM7gTr3CnA9q6NHZhbwJ:1dBKNcB6qAgGQzXT5fkld8k8X3c2jbwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647542366, "uuid": "091c12ee-74ad-4827-9dec-986f02eddfb8", "value": 127040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647542366, "uuid": "477004b3-0359-4397-8c2d-035db98c60c0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542366, "uuid": "8dad9264-46e7-40d5-b6e2-2af18a0a1ef0", "value": "uc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e293d71-a621-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647542385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542385, "uuid": "fa72d39e-a4bb-4b0b-a0de-ca55e3eb4d87", "comment": "Malware payload", "value": "6d2f9559799eebe1ee6f00ee25dac360", "object_relation": "md5", "Tag": [ { "name": "AS28299 IPV6 Internet Ltda", "colour": "#B058BD", "exportable": true, "hide_tag": false }, { "name": "BR", "colour": "#21F89D", "exportable": true, "hide_tag": false }, { "name": "cofama.com.br", "colour": "#FE5D7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542385, "uuid": "05b2564e-bdfe-4274-a587-4d7400e8f817", "comment": "Malware payload", "value": "000b0cf537e46c5a93de8ec4672450772d247ea5417692a35ef314679f1d4f4d", "object_relation": "sha256", "Tag": [ { "name": "AS28299 IPV6 Internet Ltda", "colour": "#B058BD", "exportable": true, "hide_tag": false }, { "name": "BR", "colour": "#21F89D", "exportable": true, "hide_tag": false }, { "name": "cofama.com.br", "colour": "#FE5D7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542385, "uuid": "d81c6a58-bad4-43cf-94f0-bdfe89c1efd3", "comment": "Malware payload", "value": "e66e64b30ba5d35e45040d8ac35a13ca8d36204d", "object_relation": "sha1", "Tag": [ { "name": "AS28299 IPV6 Internet Ltda", "colour": "#B058BD", "exportable": true, "hide_tag": false }, { "name": "BR", "colour": "#21F89D", "exportable": true, "hide_tag": false }, { "name": "cofama.com.br", "colour": "#FE5D7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542385, "uuid": "b5683924-9da3-4a6a-b28b-8dca3f0b1b39", "comment": "Malware payload", "value": "d5cbdd9292f484517c42c063ba2f474f7d490371a7cff1cbd82222ebcdb6ef868ac3906af6bd66422a64f8c51cf98dbd", "object_relation": "sha3-384", "Tag": [ { "name": "AS28299 IPV6 Internet Ltda", "colour": "#B058BD", "exportable": true, "hide_tag": false }, { "name": "BR", "colour": "#21F89D", "exportable": true, "hide_tag": false }, { "name": "cofama.com.br", "colour": "#FE5D7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542385, "uuid": "76810e06-d0b3-4514-8171-4549c914fdf6", "value": "T180441882FA011574D5F714B57836CC9142EEEF2639329E32A7857B9FCC3A4926B23319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542385, "uuid": "ee6e8bca-478f-466e-968e-c5bbaa516f51", "value": "334a9e27c412d65bcb9c11c037dda2a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542385, "uuid": "9f3c8722-4f6f-47e1-89f9-ed612b58d9b7", "value": "1536:tr2lXflxy1PMcF2i6zy1PMcF2i6zy1PMcF2i6hdmQ+Q08s0fJWMyOILXK:wlXfl1c6c6c6mQ+18s0fYMNILXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647542385, "uuid": "48daef97-07aa-4d98-8c70-3bd466d8b786", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647542385, "uuid": "04d3ba09-e64a-48c7-9b0d-3ed0e9d27f32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542385, "uuid": "b7ea56a4-03f9-4419-8876-31dd2b481703", "value": "", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa16cb2c-a621-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647542405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542405, "uuid": "10fffccc-a8e3-495e-9c42-55f9215fbd68", "comment": "Malware payload", "value": "fba34dc3814d0612a42610629dfc0a4e", "object_relation": "md5", "Tag": [ { "name": "AS26496 GoDaddy.com LLC", "colour": "#99A572", "exportable": true, "hide_tag": false }, { "name": "bryanwfields.com", "colour": "#5695D2", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false }, { "name": "US", "colour": "#5DD512", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542405, "uuid": "b62e3b0a-7ffa-4bd9-ac82-7d2563176b96", "comment": "Malware payload", "value": "000dbed93a6354240210fd3bd5de285aed7f7ff63ba380d8e2885b50488d4100", "object_relation": "sha256", "Tag": [ { "name": "AS26496 GoDaddy.com LLC", "colour": "#99A572", "exportable": true, "hide_tag": false }, { "name": "bryanwfields.com", "colour": "#5695D2", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false }, { "name": "US", "colour": "#5DD512", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542405, "uuid": "52105a20-e622-4e40-a5c6-a79c468028e5", "comment": "Malware payload", "value": "bfb92e9d4727c550de816c66b6625f1e08eeca20", "object_relation": "sha1", "Tag": [ { "name": "AS26496 GoDaddy.com LLC", "colour": "#99A572", "exportable": true, "hide_tag": false }, { "name": "bryanwfields.com", "colour": "#5695D2", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false }, { "name": "US", "colour": "#5DD512", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542405, "uuid": "f213e468-94af-4cf9-b217-5b0a3e431cc4", "comment": "Malware payload", "value": "ca65c73a9f0fd78d5c51dae04c43562bb457b13f382f24070c3dc8c069f90698d56b3a37439062290ba2e75c60d7287d", "object_relation": "sha3-384", "Tag": [ { "name": "AS26496 GoDaddy.com LLC", "colour": "#99A572", "exportable": true, "hide_tag": false }, { "name": "bryanwfields.com", "colour": "#5695D2", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false }, { "name": "US", "colour": "#5DD512", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542405, "uuid": "70e60922-e6cb-418f-a3d5-e93855251fab", "value": "T13332D083EF55019AE8DB46379FF29770CA94C717C6143DE88FAE3846B53108E30B2A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542405, "uuid": "33d9b032-9478-40ac-9b13-6f0da41bd081", "value": "192:O+Koi7Y5HcqwBG91epblwH7WIa82r/5n7SXANRfEwoZQKtiplGJPH/9nNXgqdbgD:O+tiu8btBlJRD+wzEwghtiplGJPf9NX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647542405, "uuid": "b37afe8e-dd6d-41f4-9963-cd04eac5646f", "value": 11192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647542405, "uuid": "a58ec1d6-fc4c-4872-803a-c2140419cd0a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542405, "uuid": "6c7f4ec0-c482-4868-9095-c9cab5866949", "value": "", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77f9dff-a621-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647542428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542428, "uuid": "5dee824d-4559-427c-886c-b7a5007270fb", "comment": "Malware payload", "value": "de0c54a334cb1bfd94f2b5dd0b5241ab", "object_relation": "md5", "Tag": [ { "name": "AS20473 Choopa LLC", "colour": "#88BD3F", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false }, { "name": "US", "colour": "#5DD512", "exportable": true, "hide_tag": false }, { "name": "www.bodyhealthbrasil.com", "colour": "#CC6413", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542428, "uuid": "199c61c2-9708-4ab3-9a5e-35a2da18e28e", "comment": "Malware payload", "value": "000ec21e0bfff935baa8f1383f969d2745509bc9d4882e23e0dd0f67622dbd01", "object_relation": "sha256", "Tag": [ { "name": "AS20473 Choopa LLC", "colour": "#88BD3F", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false }, { "name": "US", "colour": "#5DD512", "exportable": true, "hide_tag": false }, { "name": "www.bodyhealthbrasil.com", "colour": "#CC6413", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542428, "uuid": "7b2422ac-acbf-4f99-aba2-dba518e6bc1c", "comment": "Malware payload", "value": "e85bb22fef8188e1d15e3c4bd624d96c56169bc0", "object_relation": "sha1", "Tag": [ { "name": "AS20473 Choopa LLC", "colour": "#88BD3F", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false }, { "name": "US", "colour": "#5DD512", "exportable": true, "hide_tag": false }, { "name": "www.bodyhealthbrasil.com", "colour": "#CC6413", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542428, "uuid": "966fd2c0-a63a-43b7-b29b-42265e95e538", "comment": "Malware payload", "value": "de34ccc616ecd13b400f1e98e03b3a481037991dd6236b0500d1bf4aee5930180da74ddac330c8bbeec434175b1dc476", "object_relation": "sha3-384", "Tag": [ { "name": "AS20473 Choopa LLC", "colour": "#88BD3F", "exportable": true, "hide_tag": false }, { "name": "Malware.Generic", "colour": "#9A1E82", "exportable": true, "hide_tag": false }, { "name": "US", "colour": "#5DD512", "exportable": true, "hide_tag": false }, { "name": "www.bodyhealthbrasil.com", "colour": "#CC6413", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542428, "uuid": "8dc5bdf6-cf23-4227-b95a-3e21597d4db5", "value": "T1BA1412354BD2A4E76862DCFA1DC4BED2403AEA6E06170184D4718F52EE94EA1EB4F07C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542428, "uuid": "630ae42b-dddf-42a5-b79d-4c239b31935f", "value": "6144:vHyJhtVdcQ7wSKVf1qUCtLFXjlTjugi4ei6:vHyrtVdn7wSO6VjlTjugi5i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647542428, "uuid": "8e13575b-f204-4cdc-a042-90e15a1c1d3a", "value": 207424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647542428, "uuid": "164b0e75-f62f-4631-bf2f-5793d62e57b0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542428, "uuid": "48fa6c8f-73e0-47b0-a331-11d8d5ec7dd4", "value": "mayomo_vGfzpFr155.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272cad31-a5c1-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647500954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647500954, "uuid": "c539d6eb-f26f-469d-8890-38a86ac8d45c", "comment": "Malware payload (Loki)", "value": "043ff759bd2ab6ff220dc9f6d79162da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647500954, "uuid": "4a586ce3-2e53-424e-87cb-7ff79dac4f5f", "comment": "Malware payload (Loki)", "value": "003a722c145c0d452ef8eef364d79a50c22faf4ee46f7fcf5ff652dd29fb2502", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647500954, "uuid": "fb34b0f9-6167-4c24-b94f-9d385f0a7e7a", "comment": "Malware payload (Loki)", "value": "1aa50f91ec8417ac019fd190cd71845770f5ae30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647500954, "uuid": "1543d679-6660-4619-8433-44861fd5e59c", "comment": "Malware payload (Loki)", "value": "6807bdd59cb7a05dfc2084fdf7f445702327992ff208dc58e94b101c809e7db4ef8b99635c2d0e62fc3c1eaf5a7579ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647500954, "uuid": "bf4ffba7-bf21-411b-bc57-c4b737429195", "value": "T132F1D711E7F84B35EEBA0B726893A3408374E712686FAF5F2844534B6E122D505A3FB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647500954, "uuid": "93952935-618a-4f91-8576-59778ae44059", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647500954, "uuid": "027e9b90-317e-4b33-b21b-8a502db8581b", "value": "192:Qw8MB5cvzjNWirqWoZsJhFgXEMSwdJUC:Q3MTcvzjPrqWoZkiUMSw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647500954, "uuid": "2ff70853-0ab8-425f-b4ad-7e39a2467859", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647500954, "uuid": "7f315633-fe2d-4b96-b157-351993ec6618", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647500954, "uuid": "8d475666-72b2-40a4-9333-122c4b4bbb77", "value": "malik.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6faa6395-a5b5-11ec-9275-42010a9c0029", "comment": "Malware payload (GCleaner)", "timestamp": 1647495922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495922, "uuid": "60b2dd5a-a211-4ab8-a162-c4a1aa422ef0", "comment": "Malware payload (GCleaner)", "value": "4851c118343c2fa5c23cba514cfbd8f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495922, "uuid": "1dbbf6f0-e9c7-451b-ba4c-ed7e0e1e8071", "comment": "Malware payload (GCleaner)", "value": "003a9345eea8af5e99426106b22530b441c196f455ce7433e00c920ad5077245", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495922, "uuid": "c1fb451d-0ed1-40f8-83b8-64883fa486be", "comment": "Malware payload (GCleaner)", "value": "0f1e454a0413bed69a28bceb8053a2ce2f9b4e51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495922, "uuid": "041ac29d-5d7b-4611-a182-762f14a453f1", "comment": "Malware payload (GCleaner)", "value": "2c8fca841f7032fd7fd0a9c70e2cd1940dfbf156ab840eb7d7fb040d4833f2f6cc477d15706494c0650dd5ed5c7286b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495922, "uuid": "f4990393-a1b2-4034-bb36-89a368304ecd", "value": "T1617633243BE590FBD2F1D5B45B9C6AB6B248B3180F194073774839896B5CEAF2364CC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495922, "uuid": "e3ec6a89-540f-435a-9c72-989c30857160", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495922, "uuid": "37bd6625-640c-4ae6-a070-37c675b70023", "value": "196608:xpc8nnCh0SAX8La9aaZ7YCoXhrni+pnSPXOIcdg7d:xpc2nCh3pa9aaZ7VoXhrznSPXuUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647495922, "uuid": "4df08e52-2eb2-4098-9999-01d1b9cdae39", "value": 7466749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647495922, "uuid": "22aaa28f-d6c5-45d8-bc4c-8d512cbc9ef6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495922, "uuid": "f4397938-deae-47f3-93f6-7c3c962f219c", "value": "003a9345eea8af5e99426106b22530b441c196f455ce7433e00c920ad5077245", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d52135c-a5b5-11ec-9275-42010a9c0029", "comment": "Malware payload (GCleaner)", "timestamp": 1647495891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495891, "uuid": "0f89db24-83ce-42ea-b9ce-00f35f5339cc", "comment": "Malware payload (GCleaner)", "value": "02f3be868ce7ffe8d819d29f44f60736", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495891, "uuid": "469c4f07-f169-456d-865b-9ac75357ea34", "comment": "Malware payload (GCleaner)", "value": "00581e2fa186e5b6f044427945709e2439aad5782b8718c73cd5587d2a65359e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495891, "uuid": "89234f2b-3de6-414a-ac07-2fdbbd4e528e", "comment": "Malware payload (GCleaner)", "value": "6696b063a9fde1a455299f205a13bb7fc595ac8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495891, "uuid": "90a442ab-1f36-495f-babd-5899d24b0f14", "comment": "Malware payload (GCleaner)", "value": "dd68ab81f68f78b316f115508c85041af85a36b9fd04981eeb58f136cf8ed68e4f654bd11dfb00a32da01a4d0de4710d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495891, "uuid": "817ee0b3-0e6a-4979-965a-723dab061a23", "value": "T192763306B1559E91D7F9FD736B3586A768F76F570D302E6F03A113221413B8AEC8C8A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495891, "uuid": "85fc32ce-f2bd-4c43-894a-5fefd07b83b0", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495891, "uuid": "7e46c380-7692-4772-922f-8cfcc15c8e66", "value": "196608:J3oVycyd4EHSFMzmfrr/AvuLDMrFxaPxVr3s3:J3OycmHoMzQXAvuErF8Px23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647495891, "uuid": "ea6249e7-0e07-48d5-9524-54da651e3c41", "value": 7531834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647495891, "uuid": "425101bb-7145-4d35-8976-47ec5f5ef199", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495891, "uuid": "c4c49358-785a-4431-acad-e9e5e8439284", "value": "00581e2fa186e5b6f044427945709e2439aad5782b8718c73cd5587d2a65359e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b021e8b-a622-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647542675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542675, "uuid": "8e0da685-3882-4dda-a7fb-03ef9982cde7", "comment": "Malware payload", "value": "2d73c946f94c744605216fbd576c3a33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542675, "uuid": "b393a7eb-a6c0-4683-a335-d4a2af9604fd", "comment": "Malware payload", "value": "0059816bee7c0541c06b1bf25d3158fb58420a1f24022ec2a0d8ad5bc241b0ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542675, "uuid": "fb047a4f-b497-4480-871f-2300ff73d8cb", "comment": "Malware payload", "value": "66eac98c3c897294f0f993a6941d7fbd81b7b08d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542675, "uuid": "50684b39-b3ea-4f60-91bd-04ea56916dd3", "comment": "Malware payload", "value": "f818939f9d0f7b422b2ad2a91148b586b0a12ccce4e59793f1851e90f2a8fbc95593271410649a4af02fea36be2d05f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542675, "uuid": "1d9b5ace-ef8c-4131-9522-8a494e52308c", "value": "T1BD52BFC4BA45FBA5F9405DF23D2C05BC459FF2AF0A76307088E5B95DC64686B194E3C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542675, "uuid": "18141eb1-d989-4842-bed4-96a624388b48", "value": "384:flzEBkDOvTCZuQEkymy/Gf+3pK9pGr39KKDc:pwkyTc9pHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647542675, "uuid": "4a80e309-76ae-42e7-a175-949cf28af966", "value": 13880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647542675, "uuid": "012ff3b9-0a60-4c62-abae-bb97b1fa9b34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542675, "uuid": "89cacaf6-e8c7-471b-a7a4-1fe036c3d802", "value": "SecuriteInfo.com.Linux.Siggen.4218.21531.30388", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "655fcd79-a5b5-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1647495905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495905, "uuid": "4c9eda70-1df9-406f-ad63-5c547f8313ea", "comment": "Malware payload (Socelars)", "value": "55694841ce219e189883689911ee9291", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495905, "uuid": "b87ed948-35c1-4f1c-9816-d4a3dbee168d", "comment": "Malware payload (Socelars)", "value": "0063b80315ee40172ad671a0ffc408f27fe56d716749cc996b271601fd0a2a2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495905, "uuid": "3fb6ebaf-414d-4108-9894-c7900d6f7e1c", "comment": "Malware payload (Socelars)", "value": "4b42db8af96b19c890fb47d494983da9dbff6090", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495905, "uuid": "74214351-2073-4d5d-815a-a784c84002f7", "comment": "Malware payload (Socelars)", "value": "f8c8e8d40659048a890eb5c6fd60c5724d0ffaf5cab6b0b90910620abb5760c66f748f6cdc0e32a372b7ee0bbfeeb7e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495905, "uuid": "bc57834f-d729-4f03-b5b6-f5f51267f39d", "value": "T1505633E536F990FBE5612A74759A2BA9A5FB131C0535C53302CBBC0CBF9D94660AFC02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495905, "uuid": "8ab45536-b838-4832-9723-b4f93099efec", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495905, "uuid": "8e0f83ee-2346-4ea9-9f61-ca62b3fdbb6b", "value": "98304:xomZIRFJvSXKBCC8Yw81+b2R0fRfwG2pwMCnVIlanmf1dxreY16nz8kxWhbU96BP:xom2RzvJCC8p8MaOfRfwJcVIl59PreYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647495905, "uuid": "df0fcf1e-d625-47d6-976d-eeebb39b2c5a", "value": 6006682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647495905, "uuid": "0cc64fbd-8bf4-428d-beed-df8736db6c93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495905, "uuid": "acff37ae-bf64-4145-bf89-cead41363cfd", "value": "0063b80315ee40172ad671a0ffc408f27fe56d716749cc996b271601fd0a2a2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78e65e5-a614-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647536818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536818, "uuid": "ac10847a-b759-4676-8782-3f9ce907a2a9", "comment": "Malware payload (RedLineStealer)", "value": "b612b6dc8b28670bc1e30d4f44c14036", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536818, "uuid": "5a72fc0d-7941-4f14-8734-3c6fdfe28878", "comment": "Malware payload (RedLineStealer)", "value": "0077d422b8803a7e0a1a1a8f6001562c164f0cfd2071c18e8bdb9c7129bc7e52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536818, "uuid": "35b9933e-3ea3-48d9-ad65-696ad427db03", "comment": "Malware payload (RedLineStealer)", "value": "95985bf1705447fdfa190f723d418919d0b0fb7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536818, "uuid": "6817ad88-9aac-4f37-948b-0769179e2e4f", "comment": "Malware payload (RedLineStealer)", "value": "4b494510f030fb8fcebd5c04b66cf164a97111143365dd1770946b27fd9c7eba840b034c1df9577bf267474ea170d413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536818, "uuid": "e9551c96-eb46-45bd-86f3-be1f6524aa0d", "value": "T176A35C3077DC9F19EAFD1A7564B3011443F1E08B9092FB4A4EC4A4E61F67B82592AAF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536818, "uuid": "d33e8615-b35b-47aa-b673-89fc7675be90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536818, "uuid": "3c712d80-26cd-4e6f-bc4e-aa426c18a910", "value": "1536:R907jL8TdlbG6jejoigIyyYLB3UicrMFW08UAiqumbfcxv0ujXyyed1ptmulgS6p:U7C7YyciRWjUA57C0ujyzdsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647536818, "uuid": "4e65dfb8-0685-4026-b3db-da3f778c2d34", "value": 98816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647536818, "uuid": "ce236146-81ea-47ec-8a41-413f17b58257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536818, "uuid": "3c860d87-555f-43b9-9449-6a50026de08f", "value": "32692670.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df537cfd-a5e4-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647516295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516295, "uuid": "45ee0c8a-f542-4425-9df6-0f5bf49b668a", "comment": "Malware payload (AgentTesla)", "value": "c62c1332f5be5d99ef89b87a9ad38384", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516295, "uuid": "c22c3283-9717-49ed-a293-742ea0c04b2f", "comment": "Malware payload (AgentTesla)", "value": "007a39f74327937ad13e7370fb501801d31184eae912a914fd50dcc1b751845c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516295, "uuid": "acfd0d49-4481-44bf-8e6c-8d57918090c4", "comment": "Malware payload (AgentTesla)", "value": "ae21ba70ddccf36605f1aac214ae64388bb5bfd6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516295, "uuid": "2836e919-df63-4b5a-b75b-3c68f11ae21e", "comment": "Malware payload (AgentTesla)", "value": "bd3e697f25b34670480565c9b3feaba5263c0a9a91dca499d77bc952044fcb53d29c2e6e731672b7d66523705025706f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516295, "uuid": "ec73ea6a-ac06-4527-9a8f-47fc9d86cbee", "value": "T182816D4B841AAAC5C105B07D089C7D2733D45D5801B85AB1BCB5C486F85FA9EF76D073", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516295, "uuid": "600d3faa-1972-4392-b80e-cab422b6f223", "value": "48:9bdJvbnqpdj9W0MQn+DVa1h51S+xJAyf9E163G601f5dSdYMg0OInhuwwcUk+P0t:ZGZWQnVR8oGJfz0g0nhfwx0Xt9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647516295, "uuid": "b325abb9-71b7-4d81-a006-5df7bd25eb76", "value": 3867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647516295, "uuid": "f7564839-606f-49a0-acbe-77f2a60c84dd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516295, "uuid": "c63857f8-b055-4884-a823-d23adec06fb0", "value": "POJNJ172022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bcd110e-a5e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647518142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518142, "uuid": "05be6e4a-1118-40b0-9c80-0b51c17fb63c", "comment": "Malware payload (Heodo)", "value": "2343ca6285887e2c455bc38b79746ca4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518142, "uuid": "4a9822b1-a436-482c-b4eb-d467954cea17", "comment": "Malware payload (Heodo)", "value": "017ca45b09e17138e407994eabc0e8ec97008428ad4cae04ec37ab1c365d9c0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518142, "uuid": "4fa9c17f-2253-494b-a30c-abf3e25a254a", "comment": "Malware payload (Heodo)", "value": "96f7576b44d4e5a2b98f27d43b0cadd1d5e658a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518142, "uuid": "5741a452-3752-4d5e-8499-4494e2d34819", "comment": "Malware payload (Heodo)", "value": "8f233cb1633b971bc78a924d0d88df3430730d6fa9ab0803e46d1ef5d8bcaa203cc3224c17a88006a5d337a00292e59f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518142, "uuid": "9242ff07-677e-45e6-98bf-986c4f1be262", "value": "T13C058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518142, "uuid": "3ef37347-ce52-4fd8-9b99-7ff1901172e8", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518142, "uuid": "74e11d4f-2387-4341-aab7-35f83459ffe1", "value": "12288:Wvz1CLJyyvmMLSrBgB4ruGbPlVpqb+DlYzv:WJCLJyybLqBo4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518142, "uuid": "63cf7bda-aedc-4fdf-8205-20541792da4e", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518142, "uuid": "ef948630-19e8-4995-9e86-01ad462fb534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518142, "uuid": "488fb6fe-e188-44f9-819c-78af1053e7dc", "value": "2343ca6285887e2c455bc38b79746ca4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518037d6-a5b5-11ec-9275-42010a9c0029", "comment": "Malware payload (GCleaner)", "timestamp": 1647495871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495871, "uuid": "25061a26-741c-437a-ac74-8df84d63eb5f", "comment": "Malware payload (GCleaner)", "value": "6c0a00bf0745accd27441b4c0ac56876", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495871, "uuid": "fd1a17f6-4fb5-43d5-b4e2-e2d176a3e8b9", "comment": "Malware payload (GCleaner)", "value": "022e85b0301517e90423006b4ea98ace33f914820228f0e5f2fab9d66219ac98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495871, "uuid": "d6f81a99-b280-46e6-bc47-6b1704ef97cc", "comment": "Malware payload (GCleaner)", "value": "b7ee5551b39dd9d00fc330fce68993fd84ee5d64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495871, "uuid": "b497b5b5-26df-4ecd-8905-bc4b6fa13a53", "comment": "Malware payload (GCleaner)", "value": "2952c97db6779f38b50b5e7ba0c38ecf10e727a7683d644520cea52d4a75a577ee02373ea159df90a0fb0e7feb3cbb05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495871, "uuid": "25ce36f8-69be-4804-b01a-0f99747872d5", "value": "T156563361BFF885F7E3511A36E58C7FB868FA97049A3508E367015A1C1FED861731B08A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495871, "uuid": "23a33840-092a-460c-a631-0bfe1c2cc81d", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495871, "uuid": "41247c72-c91c-48c5-a769-4903f548c541", "value": "98304:xW/P8ErvgTY8kTksnxRoIFgw1UScseq0Hr4OBsmZ1hp6zbH4nqJkzOtM6B7CgsiV:xWn8dTTkQoDOwCSgq05Z1PsgOtM6rsiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647495871, "uuid": "020a9098-b6a9-4b79-82b1-936e8e696ab1", "value": 6005432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647495871, "uuid": "8bec4272-07ee-4838-93e9-6b614c68dfd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495871, "uuid": "7f7de05f-7b94-4d92-a1f4-4347f399dc14", "value": "022e85b0301517e90423006b4ea98ace33f914820228f0e5f2fab9d66219ac98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a31364-a5b5-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1647495858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495858, "uuid": "9c121198-f8bb-4024-9c0d-c4e2ed5495a2", "comment": "Malware payload (Socelars)", "value": "32dbf4b4aac2311a064861deddd6a0f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495858, "uuid": "86278f88-0b5a-4810-92f3-9f337971c844", "comment": "Malware payload (Socelars)", "value": "029f53d119346132e70fc03c166de496850e0fcf619bd4bb15d822b862709855", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495858, "uuid": "cc2a0b99-363f-4d73-b626-b1955f1aac86", "comment": "Malware payload (Socelars)", "value": "d8b634aadab1bc9264f38e8ad8231bb5fb56f356", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495858, "uuid": "e8a6fc75-015d-449a-8adf-b36a66bdefb6", "comment": "Malware payload (Socelars)", "value": "eb1cfecab328e9bce7b6923cf767f11cbfb893b7c11e466430402acfe9dfeff85c9866f4e7d77aa287a0d6fca60bb17f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495858, "uuid": "1d09c4f4-7beb-4978-88d1-0c7e251ba9f5", "value": "T1B85633EFECF88842E98101B6655A068A0ADE4E514C7D1F035F89139972FB7A72F0DBD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495858, "uuid": "21e0b011-ffd6-4123-9b4d-476cecadf7b3", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495858, "uuid": "eb0f2c22-8fb6-4877-b653-994f8c5ecf9d", "value": "98304:JWAm8mmkH3bW7iZIR11IzMeNXqPY6T7bQT6C+iAw1NN7Pf1trSgzPy:JWoG3bgiM11sp5qVT7kT6C+oDN7Pf1RG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647495858, "uuid": "f8614236-0cc6-4254-82fc-3b55765c835f", "value": 6096733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647495858, "uuid": "998577ca-a25a-4f38-bb46-edcd381fb133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495858, "uuid": "45751b3d-b219-42aa-ba2d-4fe6005a2a83", "value": "029f53d119346132e70fc03c166de496850e0fcf619bd4bb15d822b862709855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ddd4ba-a5f6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647524061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524061, "uuid": "a5fa1309-8539-4737-a35e-2d7937479057", "comment": "Malware payload (Heodo)", "value": "81893f6d5e3dcf9ea2907ec1b9dc6090", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524061, "uuid": "af649823-acdd-41eb-9475-963638f54e02", "comment": "Malware payload (Heodo)", "value": "02f98b32c4a188af5fa1a1b0adbe352f189b3fdf31ffe6272b61b0f9a4786569", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524061, "uuid": "909c81e1-89ac-41b1-ac1c-bfb2091fcbd6", "comment": "Malware payload (Heodo)", "value": "9909d104ae97b3ac55867894966b872130df71ed", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524061, "uuid": "41134212-8a72-412c-ab24-9b442e8ba648", "comment": "Malware payload (Heodo)", "value": "75bdef9c58694757bc7bdb8eee3c32f9750044c86112796795d4e4d37a7bd09e799e92ced5e1d3329ac42323a92b3325", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524061, "uuid": "2e23c938-efec-44eb-9392-b663df531e90", "value": "T1EFA2BF3FD132981CE67F987C430440F6E70A1D86600765EE2C45F26E66726B6038FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524061, "uuid": "a0c205b4-5cb1-4ded-8208-97061d0d4828", "value": "384:0HTyVb1GNjyo4CGzPd6ZIwGdKb5CzgObff9kC+xbX7zUSA:guIN+o4FLYCBn9kC+xbLzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647524061, "uuid": "b28737b2-a90a-4399-be2c-1350107be32e", "value": 21444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647524061, "uuid": "ccf46e33-f6cf-439e-8c09-210d3070b961", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524061, "uuid": "1e806925-13eb-4bdb-b252-ec516bb9dfbf", "value": "Documento.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c6ee92-a5b5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647495845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495845, "uuid": "63b82e2c-4110-4c2a-b530-f9899dc0c12e", "comment": "Malware payload", "value": "dd3c57e2520a47d634e5faac52782fda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495845, "uuid": "521346cc-1704-4131-a8af-dea9188aac0f", "comment": "Malware payload", "value": "03b887397102e717de5ef8a0d4d0374bdf5347a85dddc8c829714770142b8fdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495845, "uuid": "3b66c2dc-3141-485f-9588-cc88f1336f1f", "comment": "Malware payload", "value": "73af831aa23f72d82fe80e84b0c4411e6a9dccb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495845, "uuid": "741d97b9-a4b8-400c-9bd4-64b6ca237c8d", "comment": "Malware payload", "value": "a485f446deae24b226d78942bd4a2f812778a7fa8436b7cbbaf8913dcf59815b57013abc3f74bd4577c77d57d83cbeae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495845, "uuid": "ad394000-68d3-4bf5-8130-1384bee479de", "value": "T1DDA5AE06A39581F5E0AB91B48AAA465BDBB17C020331D6DF57E41E8A1F737F06E3E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495845, "uuid": "663dea4e-dc5a-41d7-a5fb-9d84609b92eb", "value": "23e911f9a82ac0d345fa6cc9104b6bf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495845, "uuid": "02e6d698-9048-4305-8a1b-4f401eae4b74", "value": "49152:7rEOLD0xW+aJVXfxu3Eosp/qw7RV+uY/:023Jtosp/qw7yb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647495845, "uuid": "f43182dc-6614-41d9-8944-1f71bb150223", "value": 2139648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647495845, "uuid": "d4a88ded-edd6-4a0d-abc2-dba24466df3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495845, "uuid": "ed60c630-d307-4c7e-9ed0-5509efb49552", "value": "03b887397102e717de5ef8a0d4d0374bdf5347a85dddc8c829714770142b8fdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "322401ba-a5b5-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1647495819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495819, "uuid": "6090b668-4cf8-42ea-8ef6-e0feb1c39eef", "comment": "Malware payload (Socelars)", "value": "23b1dea3fb30581dcd3cf8e22e534317", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495819, "uuid": "718e099b-c1ac-43a1-b220-c1a344066b90", "comment": "Malware payload (Socelars)", "value": "043e7bff520889305ca41b4f0185350f0b3cbfb1313db7fe207517616d331601", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495819, "uuid": "5e4f534d-5db5-4774-8b43-0f691f54659a", "comment": "Malware payload (Socelars)", "value": "c7bd426151a6acb39d16805b348a1c304ea1d5d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495819, "uuid": "643b6339-d1b6-48d1-8c3c-00e428dbcb1b", "comment": "Malware payload (Socelars)", "value": "c9e2af93748d82367b203d957eb0f1033854c5f4561d6b189afc318b0caf79002fec844d9ae5928f92deb4447fd10859", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495819, "uuid": "248e1e6b-249a-4135-99cd-970542767ffe", "value": "T1AC5633B436F8E0F3F9421D764D053F763AB993180577E87762A89408BE6D8A0B45E1B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495819, "uuid": "71493a94-1ffc-40f5-bff3-f05a53d08b7c", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495819, "uuid": "1f5ea8df-0510-4d55-89af-33d5be8bf2d6", "value": "98304:xiSdGM62nTDKDAtkhU1Yv8Ut4PAehGYQ0AVdtYWJjufEAZ1ODd8cloEB/IO4XB9T:xDdB68TDP1G8yWlhMSWJqMAZ8dloEdk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647495819, "uuid": "bf12a0fa-91b6-4dcf-b8ba-1a20d0be3ae4", "value": 6074168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647495819, "uuid": "f423922d-4dd7-4cc7-a6eb-74d7f8540dc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495819, "uuid": "91ad4307-8c64-4009-b8be-6a7fbdb368a7", "value": "043e7bff520889305ca41b4f0185350f0b3cbfb1313db7fe207517616d331601", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9074a659-a5df-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647514016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647514016, "uuid": "bc5704c6-3c0e-4dad-ae7b-0b110004c04a", "comment": "Malware payload", "value": "c19cfec5f96e7a4b914ab89e063d9302", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647514016, "uuid": "56e2df84-87b7-4349-88ca-351aeb5fc526", "comment": "Malware payload", "value": "046efcd3e110a59c47f5a71dec0ca54fe2b41a2d8fef92cd46d241ab5f438c2c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647514016, "uuid": "3801fa09-bbbc-4d36-b506-1a96e67b4401", "comment": "Malware payload", "value": "4414071153f4da7964ea96b152755cc8f0d195cb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647514016, "uuid": "c1b78e72-6280-4177-a016-38d538c1f52e", "comment": "Malware payload", "value": "c72fde354f459375b86fa7c0fa00ec424ccd5af7b02f153185a4d4c7869c0ae17bc0c9fd2a30695cc7ff1c8dc6e743c3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647514016, "uuid": "e8738e55-5cfb-4825-8b03-4f37a27a850d", "value": "T10114125DBA287FBEF140D574843C485B59C2FC70CA8ECB2BCBA87B9D9971E4008491B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647514016, "uuid": "1d3af406-b664-40b6-b699-9f25ed5f9904", "value": "3072:qhTFmTOGg8Zd5FEwVtgQcyrfzn7rJinbPHZ+jaHEoXif/MgZ4Nz:eFUOGjZdXEumnyr7PwnbPHZ+AE+++z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647514016, "uuid": "d3e11137-e2e4-4606-afca-5af7ef4d1c1e", "value": 190712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647514016, "uuid": "d816845c-beaf-45de-9eb9-30061cda63bc", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647514016, "uuid": "6207c366-1bf9-494f-bf0c-ef079983a62e", "value": "Honliao170322.xlsxX", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95e0a6a-a5d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647510702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510702, "uuid": "5cf43d58-f732-40fc-bb85-d9ff691f9394", "comment": "Malware payload (Mirai)", "value": "5b50ad92d13d9968de5ab28b2c33b882", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510702, "uuid": "accbec49-29fe-41f0-ab65-947156f3dabc", "comment": "Malware payload (Mirai)", "value": "0519f412cb9932cb961d9707d19a8cdeb61955a4587bd98d3de9b8be1059f7f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510702, "uuid": "374a3250-3b9e-4859-a73e-c7f736693e28", "comment": "Malware payload (Mirai)", "value": "79147f9514bc2bccb9c8fc22c1febdc065f97d6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510702, "uuid": "6051577e-a2a6-4263-a091-57824833804b", "comment": "Malware payload (Mirai)", "value": "7cc6be75d764c155319fd8e75e44e9aebd8ea160ea48fcfc5deecc7a9ca9a9f5b2bb23be13f6ba71e57a6cdd0f39a159", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510702, "uuid": "c4586a02-c858-478d-9b20-db18954fc444", "value": "T1E2835B95F8014E7DF987DAB981228E0AA93173805FA30F27A277FDA36D730559E06CC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510702, "uuid": "f56a5a8a-47d4-446c-878d-639a5ce05765", "value": "1536:HhY3QZuiY2/YGOUKq9SNo8TcQjZ0d6Fc3uw1Jbf949lfzEO8e8OCA/W:BYEO0SNRpFUTPzAzEx+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647510702, "uuid": "efa9fc54-db75-4dee-beff-888eeda6c7b3", "value": 83564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647510702, "uuid": "07703d14-76f8-4759-b322-186fd82a363e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510702, "uuid": "89170c01-31ae-4cc5-9797-cbdd72ed3db2", "value": "5b50ad92d13d9968de5ab28b2c33b882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce8bbf4-a5b5-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1647495837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495837, "uuid": "b993b36f-1bcf-4565-a711-9811828e04ad", "comment": "Malware payload (Socelars)", "value": "b9024869048ad6451601198b9e7d8373", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495837, "uuid": "60c2a3eb-f61a-4d99-adaa-b85db18fc782", "comment": "Malware payload (Socelars)", "value": "055b62412ad14f3b7a6d015737d8993df6013480b58d58274de35a3d5f2ea117", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495837, "uuid": "716aff93-49fb-4141-b097-ad20d73b337c", "comment": "Malware payload (Socelars)", "value": "2e2d51666c44b6b0a7b30272f6c726967a5d9be0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495837, "uuid": "cee60cd5-2410-49f1-b1ab-d8f3ca1ac8da", "comment": "Malware payload (Socelars)", "value": "25b866d7ca0b3884e43e24b163ea7b07c09566dcec4949a5d65b9f1f003580fcd7816662a886a375d8052fea5aa9713e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hhiuew33-com", "colour": "#F1B073", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495837, "uuid": "9e71da90-7fae-442d-8754-bceb427b04f2", "value": "T13A76334426510213EB5AE673D63892FEABD2E6C721EC61A383FC57D163C624A44FDBD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495837, "uuid": "a28c0726-5121-4504-9c22-65b51adfca14", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495837, "uuid": "646cbde0-b2b8-498f-b21d-9d0ff5be09cd", "value": "196608:JtKOUDTKwoi06FD2o//6O2a6Apk8wPNIyeU3/H:JIOUcifooqO2aSNId6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647495837, "uuid": "3e7c9e01-fb22-410a-a562-cc85e620f620", "value": 7640658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647495837, "uuid": "95762b90-696e-453a-bb1a-e1255d9135ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495837, "uuid": "5de95011-5568-4f0a-911e-358d85b7eaaf", "value": "055b62412ad14f3b7a6d015737d8993df6013480b58d58274de35a3d5f2ea117", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19aff41e-a5c1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647500931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647500931, "uuid": "54ed54a9-2f83-45f2-b0b1-5ded9c194b57", "comment": "Malware payload (Heodo)", "value": "3529158916b39c9d604bbab99bbe792e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647500931, "uuid": "6d38668f-f8f1-4b7e-b739-3a9ff8f651ff", "comment": "Malware payload (Heodo)", "value": "055fa663ae962550435f9010df7f4bfb3929b37499f437f57e053dec76258d07", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647500931, "uuid": "4f5b19be-7cec-4ccd-a12f-8d044e7a39dd", "comment": "Malware payload (Heodo)", "value": "920ed26aad86a4111cd1942037039a323adb7d3f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647500931, "uuid": "f5a18854-fba1-423b-a648-2e894a6a39da", "comment": "Malware payload (Heodo)", "value": "7b1dd157d658e1895e3d65d115416701aeccc16c78b70bc43bf65874c5ab1ffc46b97d919b891c4a1b3c6b71b467148f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647500931, "uuid": "e984d564-64d1-46fd-a85b-67a1cdffeb8c", "value": "T1B1A29E2CE921744DE3BB683C420650FA924A1C022147B5ED3991F77D6B73697068FEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647500931, "uuid": "1e3b59aa-4035-4798-9d4f-b6cbd59192f8", "value": "384:z3uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:XsNs/zXtFCBn9kC+xbL42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647500931, "uuid": "6e5c3d78-4944-4ff6-b0c5-53aa948515b4", "value": 21657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647500931, "uuid": "3231c99d-02d6-40ee-8f02-93556f95abf0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647500931, "uuid": "028814ee-e9d7-467a-9cd3-1060628b9130", "value": "Money transfer details.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da046be-a614-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647536801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536801, "uuid": "56826ba6-619b-40f5-af9f-681f2fc0de4d", "comment": "Malware payload (RedLineStealer)", "value": "87d0c14186a75e8238aa2b7c76881760", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536801, "uuid": "1222cd13-e36b-4cfc-bc8c-e6fb4390d1d0", "comment": "Malware payload (RedLineStealer)", "value": "05f7d273472d6ab738afb5c895673d9f0bea8da756b3940972e835a9dd0e7612", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536801, "uuid": "1d71f19d-8dcc-40b7-bc51-be18b36ea4ce", "comment": "Malware payload (RedLineStealer)", "value": "8431de4c3527997ee364cd60305abb26f3a0c01e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536801, "uuid": "2e2a8e3a-1306-46d0-aad3-74ae88ca8116", "comment": "Malware payload (RedLineStealer)", "value": "fb36949fa901591ddd8c8fced651b6256c4eb81b46aa49af9fe1f5ce0d7de919f3ad5ba6307f7fe31b509f2bd5ac1707", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536801, "uuid": "cfc5c8ab-b054-4aae-a065-0bd9b87eb545", "value": "T16DA35C3077DC9F19EAFD1A7564B3011443F1E08B9092FB4A4EC4A4EA1F67B42592AEF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536801, "uuid": "e79d131f-7618-44e3-9944-d0a1c4990d9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536801, "uuid": "099e8452-f861-4fbc-9796-df1cb14942d7", "value": "1536:V907dc8LdlbG6jejoigI2yYLB3UicrMFW08UAiqumbfcxv0ujXyyed1UteulgS6F:o+e7Y2ciRWjUA57C0ujyzd9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647536801, "uuid": "b9283cf2-016a-4721-89f2-82aafaa1f4c4", "value": 98816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647536801, "uuid": "ad6f6075-6b8b-4dfb-a452-19ad1022c41d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536801, "uuid": "4efd32d4-bdfd-4fcb-9dd9-b507ac851a4c", "value": "12788659.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16696a4-a600-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647528325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528325, "uuid": "11adc1fa-f44b-42f0-a754-f582dff14428", "comment": "Malware payload", "value": "f00fd10ab057b6b1fb24c5f5d4981d6d", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528325, "uuid": "e325ffeb-6c4a-4375-a168-c96edd80275f", "comment": "Malware payload", "value": "0645911e5fbc73bd5b2e0bdee447704ef8130294bf90ad37e459f7db515a5d08", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528325, "uuid": "d4188f64-17f6-4e64-b1d4-ca6ddbbbddbf", "comment": "Malware payload", "value": "6beb6d3ffac6eb4bba186ebcc1dfc424538ef108", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528325, "uuid": "feadbf24-a951-49aa-bfb0-d775dbc3f2d7", "comment": "Malware payload", "value": "56464016671d96eb8b01a7f067faec6252affe70f0b0b19c0d2131812ee6cf0119d4bf84f72591299eb4ad8c6cb3c1c0", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528325, "uuid": "a8bccd58-4c91-4cec-8273-33fd1a6f720a", "value": "T14651961AF847D14CAB7A232BED978522FF1B401B9DE2104C71ECC2451F30809A6ACB8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528325, "uuid": "0fff036f-ec55-481b-a828-d7146cfdc07a", "value": "48:AxG4+iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozlp:FGhrffvIypvK0elkEYZ85zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647528325, "uuid": "dc2a59e2-867d-49b6-890e-cb31122991f1", "value": 3128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647528325, "uuid": "d3a680dc-cbe3-44cb-8205-22300304b989", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528325, "uuid": "3ba8978c-5461-47c5-b535-30357a0ee23d", "value": "FpfF2tXd.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a347bde4-a60a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647532516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532516, "uuid": "aeb6f52d-e434-4ce7-ada5-1c18403e2f7c", "comment": "Malware payload (Heodo)", "value": "ce807a76e5ef76c2dc98305e41466f53", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532516, "uuid": "9948b128-7eee-4532-b1e6-eccb17065c39", "comment": "Malware payload (Heodo)", "value": "0699b2b3a11127f0e98ea37495a8e0d91c9b815aaf4ac4f840f10a81ff975872", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532516, "uuid": "0343083f-c5d1-49ad-8ec5-43f0e1546b48", "comment": "Malware payload (Heodo)", "value": "19a20267399b12da665949ce8f79e658e63d12fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532516, "uuid": "dd94e2bf-38d7-4e7e-abc7-86abcbecb621", "comment": "Malware payload (Heodo)", "value": "cd3d9bba8ccbb1b6212bce8eafb80b39c509ebd696d51688be7eb038506851282ed077d0eb312138c455985ec0811043", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532516, "uuid": "25c5a81a-a830-48d9-b7ba-a1e511de2c33", "value": "T147059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532516, "uuid": "395fa0c8-80cb-4381-9f47-75a0b2b0ef29", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532516, "uuid": "0d27aa04-279e-470d-8994-b65cce8059d7", "value": "12288:KVHML2QJe6XxhqCWxQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqZQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647532516, "uuid": "cb8bdf26-054c-48d6-8945-b9fcb7aac508", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647532516, "uuid": "35e4dc10-a20c-41fb-bc13-74b13c2cec3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532516, "uuid": "b84c4529-f961-46c9-b4c5-f351b80183bf", "value": "ce807a76e5ef76c2dc98305e41466f53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01bbd79-a5ad-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647492674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492674, "uuid": "adca75c3-b86c-492c-86f4-b29ed49cf98f", "comment": "Malware payload (Mirai)", "value": "77642b079d44d34215a13db44ec6b856", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492674, "uuid": "c5e63f81-3df5-4b8b-bbdb-26730b10badb", "comment": "Malware payload (Mirai)", "value": "06e3d1eaaacf8bd63daedb8f112a9ec9f6bd3cd637808c4f564001869cad0f40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492674, "uuid": "0dd50d44-5135-4c3a-8720-0f08c16b78c3", "comment": "Malware payload (Mirai)", "value": "aa4f6a554109c0851cab674fc4ef0aa489ff84da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492674, "uuid": "3f582be3-7f7d-4f8d-9bff-a5f8268fa8de", "comment": "Malware payload (Mirai)", "value": "ef90b25746d981fd52c0dfcd45605dc52167f01cffb94529c5d3eeff557273caa6e7f22dd34f21d288c9cbe01936727b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492674, "uuid": "08a5dbeb-ea98-4465-9811-7250b01efa4d", "value": "T165A2C0A0F00A1D66D7FBE5305EC6CE8133A55AB777628DD1714CCB312B698315A48ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492674, "uuid": "d1c4f96c-d4a1-4606-bf74-19e1e3a7d585", "value": "384:TPYFtxXRxONhqnqgO43TTMLNK9D2coCTTbMKY1QGXxGM4uVcqgw05VxJD:cxhghqrJDT4o9ZoCTTb90xV4uVcqgw0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647492674, "uuid": "87995b67-7fbe-47fb-83d6-577ff5d0907b", "value": 22760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647492674, "uuid": "51b35d6e-3486-4bb2-b54e-0d6d9796d8e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492674, "uuid": "ee2ed47f-3c66-42ee-86a2-98700ef84d59", "value": "77642b079d44d34215a13db44ec6b856", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98822e6c-a5fc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647526485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526485, "uuid": "1efb1078-fc6b-4215-8dd2-31f729d6a211", "comment": "Malware payload (AgentTesla)", "value": "b33ca4ec8ffe255bd0d7a6e7cee35894", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526485, "uuid": "bc7886f2-0042-46b2-a643-461332ded7eb", "comment": "Malware payload (AgentTesla)", "value": "06ecd2df12548b571397303a1f38dd2244359935f74aa84aca4883dac612189c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526485, "uuid": "ccd36903-8046-45a7-a833-8dd69956d624", "comment": "Malware payload (AgentTesla)", "value": "a58dc0aeaeb78c558e4544e1b8983920a5f9e7b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526485, "uuid": "0ee8e9e8-5103-425b-b1a5-eee148420713", "comment": "Malware payload (AgentTesla)", "value": "00ee15dfc56b9d6d75ea47c453b72fb7dcdd886bad4de77b3c20befa58be8041db0a4ea5215e086aa22cfa5f36e5688a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526485, "uuid": "e55c0e9d-1916-473e-a903-86937b1fe560", "value": "T10D9423D926B47E32A93D5E520FD19250B4226C168EA13FC786663CBE03307A4D15BFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526485, "uuid": "84c160f6-963f-4ca2-b74b-5f780026f53c", "value": "12288:j9aiWkgQJUiZ2DH7wxUq9teaxsCjSRcghoS2:j9r/gQJraHC9teaxsCyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647526485, "uuid": "ea374bab-f2a1-40d1-8c4d-d0c38d50de56", "value": 431176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647526485, "uuid": "a573967d-4f34-4ac3-b63e-43f14560141b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526485, "uuid": "ea647d6c-eca6-42d6-a055-03544789b01d", "value": "Swift.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfcb548e-a611-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647535570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535570, "uuid": "896b4813-4654-4b33-bb75-85d0fccb4a6b", "comment": "Malware payload (Heodo)", "value": "d15bf20ba0ea809a198234eb64a78eb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535570, "uuid": "1046c956-c0ed-4c48-8e7b-a9eeb1515142", "comment": "Malware payload (Heodo)", "value": "07326ca943d00ad379eecb1edde2e12aed80be333c5f2957de305f9c0e492af7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535570, "uuid": "8cddd118-ad1a-4f90-ab0a-60ca6ea74e3f", "comment": "Malware payload (Heodo)", "value": "f45dc44cc38d4a8769896f8499242bdd9dfa24ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535570, "uuid": "bfc92669-c6f9-478c-b8fc-b8463ce807f4", "comment": "Malware payload (Heodo)", "value": "ebdb7f670590ce6eaeb2702f55834d56ecb0285606b5c1d4a470dd1c24adbbde9c368c94f7956eb12961db16742d77a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535570, "uuid": "f4b844fe-cfb5-4aa5-b2e2-b41b304a2e14", "value": "T1FE059F7A2B43F27AC7E50DFC186002981A75BAB2C7F764272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535570, "uuid": "73f5d512-be63-474f-a8ff-4505b122323e", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535570, "uuid": "d62a4658-82c9-4fe1-a810-a3c0b8fb2967", "value": "12288:KVHML2QJe6XxhqCWtQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqlQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647535570, "uuid": "91a9e54b-01a0-4b3b-ba67-875532485301", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647535570, "uuid": "f70ec509-b54f-45b9-a9c9-ce232c059675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535570, "uuid": "75848818-f66d-4928-827e-ef6996dc19f5", "value": "d15bf20ba0ea809a198234eb64a78eb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f273f96-a5f6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647523785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523785, "uuid": "3967673f-5cf1-4424-99c2-eff231543875", "comment": "Malware payload (Mirai)", "value": "cd0d811fa33afe3ce16fba99e4255124", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523785, "uuid": "12395b15-3569-47ce-8685-9fd7a98418fe", "comment": "Malware payload (Mirai)", "value": "076e87c238d07821243660feb692c96dee92569be3e2867e6b46e7cb5a6593ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523785, "uuid": "87fd2bcf-ab1f-4cbf-80ca-64075321b348", "comment": "Malware payload (Mirai)", "value": "3b40279a460b0072a0cd627bb6f66522771c879c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523785, "uuid": "00eafc9d-ebce-4e7e-b0cb-48a6e27aef26", "comment": "Malware payload (Mirai)", "value": "b17cb9e1470ba89c04eb746cf2675f13513c247b2747a09a749949e4a180290cd4bae949befa0e74dad69c3949cce85a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523785, "uuid": "cd7a27fd-c9e6-416f-8a61-01b43b7d5c02", "value": "T133C3F731E8044B1BC2C223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523785, "uuid": "14a35a2c-6aae-493b-9a25-861530451a2c", "value": "3072:6jVlyaL5JCrIpv04sdbttiEiTmP46aQyfPlfKsNb:yoCJCN4sdbHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647523785, "uuid": "1373b8e1-d156-44c5-aee2-6dd92c653774", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647523785, "uuid": "83091b26-35b0-49e9-8a6d-2fb0392f88e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523785, "uuid": "bfdd937a-dff3-4b57-b267-4123795a3dee", "value": "cd0d811fa33afe3ce16fba99e4255124", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f5d231-a62c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647546903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647546903, "uuid": "ebdebd1f-7d18-423b-914e-6da06280336d", "comment": "Malware payload", "value": "9651a44fd19b551d7b28a4b29c6d155b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647546903, "uuid": "e7fea66a-f3ad-4783-b3ec-aee2862c3f47", "comment": "Malware payload", "value": "07b106729cacad00a905d11e1e6d2d1192c1e9fe1b74ad09a85a26c811334624", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647546903, "uuid": "32958aff-4b20-467c-93be-628c790a8d95", "comment": "Malware payload", "value": "00ce3ea889d331856363083a9925c75023fb93c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647546903, "uuid": "8e765a6f-5a90-426b-b715-b8c6ba4925ea", "comment": "Malware payload", "value": "620a0b270d7b09c6e04ac37d6d86db54ea294c123f645433ca9581c1b4d0aeac37a517a151d43f96dffb5dc4c5110269", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647546903, "uuid": "cb013eab-4068-4f71-8890-d508661d8ca0", "value": "T191C42B017896603CDFDA363601F7EB2531E75CB0677CB52E6EC168EC9B2628A051D63E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647546903, "uuid": "720349d7-55df-4c13-b546-23e4c5dc4f1c", "value": "fe91b35dbbcef6d3f3836ad3e8b836df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647546903, "uuid": "b31a30cf-d34b-4b60-a65d-0d4308753856", "value": "6144:xe4HnxyzcUzcUin5jBd4hp3CBj6O7O7OOuw/RRRI7E7E7E7Z94kx8888rLCkxEZ7:56Kv+tEgq1dov6eimJEeTN+sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647546903, "uuid": "f36d9da9-a931-4f1d-aedd-cff89df14bee", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647546903, "uuid": "62f2e90c-920e-4fcc-9e2b-4a40496a7c9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647546903, "uuid": "e4073633-4421-49ca-8545-de9ca0784144", "value": "9651a44fd19b551d7b28a4b29c6d155b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203939b2-a5f1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647521558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521558, "uuid": "af25ea0a-a60c-4479-a2b9-a65240266775", "comment": "Malware payload (Heodo)", "value": "c50af6f233f314fbe3ce47ebb332ab62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521558, "uuid": "29c3a07e-3bff-4c71-a93d-a8c68a2ce45d", "comment": "Malware payload (Heodo)", "value": "07b5e8dd03d7c3e5f991e90caaae3442dd59d968b1c736986b3b438015f94316", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521558, "uuid": "0dfd8ac7-0f48-45f6-ad93-de104d0e40e3", "comment": "Malware payload (Heodo)", "value": "5eae7acce4da2e049148edb0df291114a181fea1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521558, "uuid": "58bfaa75-3ad6-4c64-b010-24ebf5bc0637", "comment": "Malware payload (Heodo)", "value": "82e0c4754ad8089c23f9aaed69ff2e6426490188827dd0a40a51ec694a961af3081a09f5f4281e7fd084e67d0a26661a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521558, "uuid": "13890d06-b6a2-48cc-9bb5-b8ac36884cfd", "value": "T100058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521558, "uuid": "7b4c5243-c8f4-4b97-aa49-7a3e0627a1a8", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521558, "uuid": "21573ca3-f54d-4a21-bfa3-bb1a50c03dc6", "value": "12288:Wvz1CLJyyvmMLSrBgU4ruGbPlVpqb+DlYzv:WJCLJyybLqBN4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647521558, "uuid": "1500337c-0df7-4c67-9618-900a196a53a4", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647521558, "uuid": "76a5664f-7030-4462-a231-df996cafbaca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521558, "uuid": "2ef58149-eb27-4546-9cfd-6b9e0f0797b0", "value": "c50af6f233f314fbe3ce47ebb332ab62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf4a85a-a5ad-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647492667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492667, "uuid": "bed70da4-6ebe-4473-83b1-01a6712bf441", "comment": "Malware payload (Mirai)", "value": "ad871c885bca886e75eda16b499282f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492667, "uuid": "78739948-4ddb-4c8f-87e7-3058e9396e96", "comment": "Malware payload (Mirai)", "value": "0848aa167cbe0ff63bb66e147ea55c7faa368477c4540b32f2ba4c4b3314ec50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492667, "uuid": "d0a0a150-10bd-4534-b592-fc32272b0372", "comment": "Malware payload (Mirai)", "value": "a95bf1e52051d31be7cccfeef4a461f6ad761479", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492667, "uuid": "1a6cbdda-c87c-40f3-aec0-71fe5a97aa34", "comment": "Malware payload (Mirai)", "value": "e70b2d7f76598b62a95122e438caad737d039b32c4cace659e261a2c23f22940ddb4059eb975c8e46c93afab67722198", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492667, "uuid": "528f6630-a11f-47bd-9e35-13ae9c199ec4", "value": "T1B7B2E1FDD16E20D1CDAD50FD352CA8679840E691332E97CD7B006CD8AB3A92BB85D1B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492667, "uuid": "a84e58c7-8d02-4813-a1fc-0c166561631e", "value": "384:N9iGw5CSG9r1i+gqJOv5y2yV8jsbCd1DoDCFHWmDHczNmFOipCRWGVCz0Nv0:DiGw0SWr1M0qX7jmCdkmYYOSuW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647492667, "uuid": "8ad05c86-f7f8-42c6-868d-90ff82ee1875", "value": 25424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647492667, "uuid": "ec60607b-b409-4e7f-9a03-79d8157e81ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492667, "uuid": "c0a95a3d-ec73-4116-bde6-a98db61be1f9", "value": "ad871c885bca886e75eda16b499282f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bc74d9-a5e3-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647515820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515820, "uuid": "54983545-3261-4f39-a794-f3760562e534", "comment": "Malware payload (AgentTesla)", "value": "7e2f5dd5d90306f544d7e813f5ee4818", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515820, "uuid": "5e07bc6f-4482-4f96-975d-ff4bf5f73e9c", "comment": "Malware payload (AgentTesla)", "value": "08b6f0a396ab5159529c712ee0ed26ab72a456145d991a2d596eb6c65e382178", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515820, "uuid": "fb59da9b-7246-4279-9ec8-e10c38cef9eb", "comment": "Malware payload (AgentTesla)", "value": "b3f788de799ab88f9832d201d376324bcfed5057", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515820, "uuid": "08f4f4a4-da3b-424f-bfaf-fba01b115565", "comment": "Malware payload (AgentTesla)", "value": "1fef17ef1ae50296c486ac7a64e7c6dc813f6ad46082b01ac44a9fe78948d34a333a0ddbbfd5fdbf05879ed2a1fecca5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515820, "uuid": "d6cecb43-0f4f-4f89-9e76-dba0199bf79d", "value": "T10345011BBB6C5B5EE19E07B1B07605704B64AF472016E74DFAC1EDAC0D2278C4A1B2E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515820, "uuid": "048a2364-a8e4-409a-aa7a-d93431b288f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515820, "uuid": "d355fa34-0c25-40ad-a87c-0cbdee70c1fb", "value": "24576:YC3n97wBel1U8uvyrFJWRBySMP1vYgW7Xr94oB:p39/fuvyrFJWRsD1AV7XruoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515820, "uuid": "b5daf7e6-75b3-4ad3-9609-5c909102815f", "value": 1266176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515820, "uuid": "7be6accd-3710-4abe-bdab-c11062c946d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515820, "uuid": "3c3660bf-c308-4e2b-a69b-b55076081a21", "value": "WIRE_TRA.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5cd615-a5e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647515782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515782, "uuid": "f3a4d943-afd9-4d88-9b5a-92837000cb90", "comment": "Malware payload (Heodo)", "value": "8285d4a6e40ffd7303a0ed7b0d6a96a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515782, "uuid": "13f1ea56-b58a-497c-8321-ea16d165efed", "comment": "Malware payload (Heodo)", "value": "09efaaa52d465ec5e90c9d11716f3a6f133a2bde820b03fdd96624dc3a7bb7f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515782, "uuid": "7256a1d3-bbb8-467e-8692-0b3bd368ed02", "comment": "Malware payload (Heodo)", "value": "3e5f699e9c993f1fba662817cd35c429602b735b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515782, "uuid": "06482959-91f2-409c-9a1c-4ff68b7d3571", "comment": "Malware payload (Heodo)", "value": "13445a0cef2baf30e4f09109bd33b9347198e7695645c7855b0df026b145554210be7e8918b5eba29d45ef88bef499d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515782, "uuid": "83103941-a230-4110-88e7-c171a963f09a", "value": "T10C058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515782, "uuid": "ec9d5ede-1a11-4c6e-93d9-6833ab258248", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515782, "uuid": "b09ad353-4857-4544-a27b-3f6f40b881d9", "value": "12288:Wvz1CLJyyvmMLSrBgh4ruGbPlVpqb+DlYzv:WJCLJyybLqB84ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515782, "uuid": "b05802b5-7b97-411b-859f-8647d2174c4a", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515782, "uuid": "cba13db3-b9db-41aa-8ae5-5b900acf1bc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515782, "uuid": "f91871ed-b57c-4e0d-95f9-b776a11dfd96", "value": "8285d4a6e40ffd7303a0ed7b0d6a96a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c156d0-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "3e985737-64de-4306-8fa2-b71f80c68b78", "comment": "Malware payload", "value": "4303888466f550227244b4a88e81360f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "59881338-c7b5-41dd-a3f4-e17eb02414b9", "comment": "Malware payload", "value": "0b39437b1f092d8653f6be60dfd3cd869b15a19ca476caa76aab33420784b1b2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "01505d48-87bf-4a9e-98ef-105ce25df3de", "comment": "Malware payload", "value": "974a611f7d3938041d53ee4321e7c7a414613252", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "fca71afd-a741-440f-8e91-0dbd02e5ccae", "comment": "Malware payload", "value": "8ff47ab5e31673687f1a54a8d91fa27240cdcfd2e499db11eca665b9eca873da367fa9bd99fc74c3778a69d855931329", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "74275de4-6362-4af5-93cc-b9a341bf9b38", "value": "T109059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "c5e89704-c6df-4938-866a-abbd864f4cde", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "ed3ca73f-3546-4772-b98e-619368416c5e", "value": "12288:V20BXOMcVzpWfmmnDDUX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDAX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553505, "uuid": "426e2e05-7476-4f5c-a63e-7c52277105a6", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553505, "uuid": "55663381-f84c-4c95-9469-9a5dd9073f75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "308549d9-fd3c-400e-9102-f968d5b04f45", "value": "emotet_exe_e5_0b39437b1f092d8653f6be60dfd3cd869b15a19ca476caa76aab33420784b1b2_2022-03-17__214456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d56eb643-a5ad-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647492657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492657, "uuid": "b1b77ebc-f797-4c49-8b34-641c06c20f22", "comment": "Malware payload (RedLineStealer)", "value": "db92e2bacacc2eaa13e2d06a8c6c2fdd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492657, "uuid": "992eaf10-952e-44eb-a152-5af27bfbdc80", "comment": "Malware payload (RedLineStealer)", "value": "0b7d58ece81cbbc7babb1ba3fbfc5fb672c6c2e2dcd272659e33681e6a36d187", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492657, "uuid": "d0d4f44a-dced-4826-8cfc-70f0862fe895", "comment": "Malware payload (RedLineStealer)", "value": "6c6d51f807db7ce4a36f3b9b88e84549ca0291fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492657, "uuid": "a1829a24-8955-4312-bb65-f4817875440c", "comment": "Malware payload (RedLineStealer)", "value": "4226998c0760cfb2931103d2ed28d78a0e8ce039eee836f00510643d3383ca97142a2bbdb2b1b223e32acb4a86c93451", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492657, "uuid": "8d06b6cb-177f-4f01-b6e3-1728f94411ce", "value": "T13384BF00BBA0D03CF1B751F87D79D7A9A92E7DA19B2550CB22D52ADA16306E0DCF530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492657, "uuid": "9dc8f2ba-4e66-4c71-81d8-68f93a0e1253", "value": "909e4097670a3851d6a882270ed674ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492657, "uuid": "52b3e749-8139-40b1-bc5b-ec3425416067", "value": "6144:F6EVTO1/aixFHyKFwRAvEqmh5jVEWovpE4dYA1gKzauT:F6j1/aixNTFzsT5jVEW0pOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647492657, "uuid": "6865295d-37bc-4adf-9f8d-28c38b5f57e3", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647492657, "uuid": "d87bb98e-15ac-4149-85ef-0326e9a81c8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492657, "uuid": "b7358540-3aae-42d9-8304-f9c4a00ff137", "value": "db92e2bacacc2eaa13e2d06a8c6c2fdd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66aea36a-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518670, "uuid": "b36d7ded-7932-4c72-bd56-0ecde516d23f", "comment": "Malware payload (Quakbot)", "value": "412af7b412d0b758a78c788e48d480bd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518670, "uuid": "7f1531e1-8d63-49d6-b07a-1b4145b26dd6", "comment": "Malware payload (Quakbot)", "value": "0b860e8a40437dabe41c89076fc54d472ef7841efef12464788a6cbd4c7739cf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518670, "uuid": "8d82461b-03ba-49ce-a9fc-211a4cb17a00", "comment": "Malware payload (Quakbot)", "value": "3a56e1c6e3935dbfb9cddd0db66a98c739cb3112", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518670, "uuid": "c062d490-3e05-48dd-98d8-5f356268e6f4", "comment": "Malware payload (Quakbot)", "value": "973c3ebb2c324b85fb4f0138662c91ac9f47d06d5ba09f5d4ca5dd868bf7ba0da75ecb4234d5434be057cc6445a8ec03", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518670, "uuid": "1f92c7c6-7164-48bb-a543-c25577ff9153", "value": "T1C415BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518670, "uuid": "454fdf2e-e07c-4996-901c-6d3d684e626c", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518670, "uuid": "32b0d2cc-a2fd-408f-bae4-2019ba38fef1", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518670, "uuid": "b42ea8c2-bc69-4288-9c47-f311e8ac75b2", "value": 938426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518670, "uuid": "fd16a434-a177-4b30-a135-abbd94b4814b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518670, "uuid": "5f432634-7424-4737-a5bc-4c3810b58463", "value": "0b860e8a40437dabe41c89076fc54d472ef7841efef12464788a6cbd4c7739cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13381bea-a5df-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513806, "uuid": "1fcdf5fb-a11d-4e4e-9680-0af1134b437b", "comment": "Malware payload (Heodo)", "value": "336afa003aa031dd3fabcd417e4578de", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513806, "uuid": "8f8081ca-5054-4253-bb98-10704f8382c9", "comment": "Malware payload (Heodo)", "value": "0b9fc3bd7f85e95d5467e6ba7b7338624fc629ad5c65a8882b09be881d7beff4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513806, "uuid": "78aeb909-d409-4f21-8592-d1f67d91be1a", "comment": "Malware payload (Heodo)", "value": "f808213a424e8f99f4d6cd184b49021b1edeb925", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513806, "uuid": "f46f1950-fd7b-45a2-8b05-ce6ed1906d13", "comment": "Malware payload (Heodo)", "value": "dd7025295840445cd76e9fb53a3e75ee06e1cbb6dd2d65bd44065969930a14ca9b4dbd8c863ce5bffb18801f32b6ce82", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513806, "uuid": "6b94e1ce-7e04-4109-8cff-25f8059eae81", "value": "T1E2A29E2CE921744DE3BB683C420650FA924A1C022147B5ED3991F77D6B73697068FEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513806, "uuid": "0b562b0f-4634-40c8-945e-0e9fb2b2e95a", "value": "384:z3uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:XsNs/zXtFCBn9kC+xbL42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513806, "uuid": "e1c90fde-4f8b-41a0-856c-53a969748b9e", "value": 21657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513806, "uuid": "1ee21cf6-9c9b-47a3-891a-c948f72919b6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513806, "uuid": "f3f15ad5-d55d-4b53-9d8b-226c76b7cf17", "value": "523166200-630333-Neuer-RV.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c819bab9-a5eb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647519263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519263, "uuid": "9b468523-0a96-429a-922b-c04f909e8cb3", "comment": "Malware payload (Heodo)", "value": "850f79fe498234213df702c3e64aad5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519263, "uuid": "a1526816-9251-4b17-bf60-998a453ca138", "comment": "Malware payload (Heodo)", "value": "0be944526f8d04a30c4e833b8aa4c1beba68bcdc4a1b5b40ec28e8b985191246", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519263, "uuid": "c865a69e-74f9-487b-be61-041e3112dc17", "comment": "Malware payload (Heodo)", "value": "a52b00019bfc1ea771e754adc1134cd34db36959", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519263, "uuid": "b37013cb-8f4b-4277-b76d-e060c22de460", "comment": "Malware payload (Heodo)", "value": "6f9473d3ff4f0a7a2c1ad8f4508fe6df23229961410b63bdd847f2de2c46e82cc6e6e2dda21db4dc96f00b73c07e0744", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519263, "uuid": "1a14440c-c21e-423b-8a44-c0bf0d7db4eb", "value": "T142058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519263, "uuid": "66d44f82-45b2-416e-9904-07ea25002f14", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519263, "uuid": "5dc629bd-949d-4bae-910d-f67d2659ef1e", "value": "12288:Wvz1CLJyyvmMLSrBgp4ruGbPlVpqb+DlYzv:WJCLJyybLqB84ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647519263, "uuid": "3f39a183-b879-4ef9-b90f-d50271ec1e7f", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647519263, "uuid": "1c404bd5-0026-4fa5-b067-94461f84803b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519263, "uuid": "307d9d09-2871-43e0-8938-3015dd5f8622", "value": "850f79fe498234213df702c3e64aad5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd04ed9-a5f3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647522547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647522547, "uuid": "2e7cc4dc-b18c-4041-8abf-c7a2e79b1c7d", "comment": "Malware payload", "value": "e8261df84b40be928cdc6ad288de94a8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647522547, "uuid": "f9f56c50-d9c3-498d-92ae-9f90c662055b", "comment": "Malware payload", "value": "0cbe934c0a9527e07899b0d13f9cf4f4f03f12c7a6bf223f83ed2054dbab9a93", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647522547, "uuid": "21a05c4b-1fbb-45e8-8f3f-3b57ae35191f", "comment": "Malware payload", "value": "62ad115ecfcf30168b39eb6ab39778c3074c3887", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647522547, "uuid": "718a9b4b-e58c-472b-b0c4-9475de8918dd", "comment": "Malware payload", "value": "6aa367f7cb996b5fbd3f9ff41dd93928ac5f170cb714eb6e916e9adc71c5a88d6bf8fdc0c2d995cea65b5b411f19a01d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647522547, "uuid": "2175c135-7a6d-47af-8ab3-1596c91817de", "value": "T1E32633C8A9298120F6B972722AC007EA29C4C9DD58D7A58E03D351E7EC71B97D33778D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647522547, "uuid": "22835149-9988-4039-a53f-278292efec3b", "value": "98304:IAzTlt3t1tyJwSVUp/ZNq6mOVjMwrESDC8/XEwSG1yODd82S4q+AoVJAC/:5tXswdpxYZOmwr/ez6+2SjUWC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647522547, "uuid": "50c79402-9983-43b0-a7dd-127f4908ee0c", "value": 4498607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647522547, "uuid": "e0d5fd00-f5f0-4bb8-a500-0952f0a8c197", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647522547, "uuid": "d5b79e67-418f-45ae-befe-60d2c3841e7d", "value": "7f8c1241-de25-4430-6580-7017df38352a.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45bd2ee-a5e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647518451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518451, "uuid": "61975293-50a2-4566-bb03-5d0f9c3b936f", "comment": "Malware payload (Heodo)", "value": "5d76332af4a3caefdefc696342d41d0c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518451, "uuid": "c6d9fe04-5032-47aa-9239-210ff8f5b514", "comment": "Malware payload (Heodo)", "value": "0d66a9fb60368fe3671f2219bcf80c40574b061f3b1268b807d93fcecbd7a3af", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518451, "uuid": "56411237-3992-45cd-a4e0-0872b55c2a3c", "comment": "Malware payload (Heodo)", "value": "2f8339681dd8e1f085ce2751bd5ca1262d9c30c2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518451, "uuid": "4a28b2c0-875a-48a8-ac36-d13c04457824", "comment": "Malware payload (Heodo)", "value": "f240d22d0b2cf2fe89f356dece02ededfe527d1201006adf398208634eeb6bff22e63fe1569b258e19b0fc7e7a9d9760", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518451, "uuid": "451419e8-ec16-4fa8-bcd7-4363d9416619", "value": "T1C7A2BF3FD131DC29EB7B9C7C820980F5E60A1D46200769DD2C51F75D6AB26BB038B9AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518451, "uuid": "8879294b-2d11-47c6-b856-e279fb71eedb", "value": "384:eHM0Vb1GNjDo4CGzPd6ZIwA1hKb5CzgObff9kC+xbX7qE7h:j0INfo4FLH2CBn9kC+xbLq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518451, "uuid": "d1bb3086-ccb8-4fbc-bede-f33f19974c3f", "value": 21440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518451, "uuid": "52cc807e-5af8-4055-a0ea-9f25d7d2d9bb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518451, "uuid": "0c3833ff-e7b9-4021-9b94-feaea8438372", "value": "Dokument_4.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83efcae5-a614-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1647536758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536758, "uuid": "de053e29-5593-4b1f-a157-e01d91a70a2c", "comment": "Malware payload (CoinMiner)", "value": "9c1d85ace2f90dc59548e8a6afa2bc42", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536758, "uuid": "11115329-6016-4600-9971-c66401d93c23", "comment": "Malware payload (CoinMiner)", "value": "0e09d67e6e17813041a1001155a68c6e3edd7d045ed2d28dd217c4df57b7e2f5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536758, "uuid": "a68f56d4-09cd-4c9b-8d1b-ff55f53222b8", "comment": "Malware payload (CoinMiner)", "value": "4f6b4d2fefa5c0e04abcea34d624404686150e3b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536758, "uuid": "8145de1a-f045-47bb-b7cc-78009418f0d7", "comment": "Malware payload (CoinMiner)", "value": "58ab0d493d9d55a60e2e46e1b50f48a1c47d42f2e8b59e294e54fa13d0e3a904ba36b26d0c3bb30bc36e19244e9bd85b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536758, "uuid": "30f1c281-5ea3-48df-a225-983b7d6a1de0", "value": "T198565BF224C766DCC816D53B8323FD7F898F71364B26A8E3A054E2225D26CC53676E19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536758, "uuid": "ae08da3d-b8ed-4604-8c2c-98de3890609e", "value": "dc12932426806b6b47a373d7ae42c21d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536758, "uuid": "27910664-749b-4df4-98df-a8d16d2b6b72", "value": "98304:OzgEywKybm81KQ7F9caSPi69893Oj81qDQQ47D3jJqgj9:OtyEZ1KQEaSPH9C5MDVuD3F9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647536758, "uuid": "b7a80241-dd9d-4a49-8db3-1f4b857387e1", "value": 5909504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647536758, "uuid": "d93604bc-cd1e-4df2-a4bb-bb806ef2232f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536758, "uuid": "779416cc-418c-46dc-8c9c-8277629f825e", "value": "58667292.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b615beef-a591-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647480578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647480578, "uuid": "7bfa7750-3d71-4f87-96b2-b91d89bf0bd7", "comment": "Malware payload (Loki)", "value": "28387e20f3096993381407c3aab27977", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647480578, "uuid": "cc94d307-72ff-4c0c-bf31-a9b2d6b45d42", "comment": "Malware payload (Loki)", "value": "0e2d5e5585665b3d47fd7c4a014cb35ab9cb436c3f4e78304c6fe5ab32f50bbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647480578, "uuid": "088e9651-a132-4c6f-b859-3c1e10192fd0", "comment": "Malware payload (Loki)", "value": "5bc3e9343030ad40f73ddbad80fd165b19823cfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647480578, "uuid": "6a72f63b-01e8-4cee-9408-f803025368f1", "comment": "Malware payload (Loki)", "value": "ea85a77c064bdcb4bceed79e83e1974c5b816bc6cd3ffa95d5aac814d16444d85dbe2db11805773156a5a51e39ea95cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647480578, "uuid": "1a0b85db-52e1-407c-8247-6accd0235440", "value": "T145041C80DD1CC51CEE6AFAB10833D1B1CE2AFF8ABA4C2995D484FBD63A7116146CD934", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647480578, "uuid": "a211e04a-ca35-4086-8208-bbfa3770ad4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647480578, "uuid": "ec98c18a-b936-4d08-925d-f8ca7455050d", "value": "192:3Ltz9uIRIQauYPdFhk+7Y/K6GDDDDDDDD/b3bnbhbhbh3333VbWbUrSXVVVVj77c:bN9hRIQauYXhko6dMBfm7omN5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647480578, "uuid": "c54fa465-790a-47f2-abae-9ef1c572ca26", "value": 175616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647480578, "uuid": "470f6953-0749-474d-8eb3-da6a0c8fabb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647480578, "uuid": "fa8c8d50-309b-49d8-b94c-439923d86140", "value": "IMG-107110003023.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca6d7d2-a58c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647478173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647478173, "uuid": "b4d87ba1-cc0c-46d8-ad15-eb8cb80cbc37", "comment": "Malware payload (Heodo)", "value": "277b12df3a18a40513cbe09b6a187a87", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647478173, "uuid": "732aea19-4cb3-48db-9043-ca360a579c0f", "comment": "Malware payload (Heodo)", "value": "0e90ec8207794598c90991e8009fe1d7bfecf0d465357ea17867fe02741d1820", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647478173, "uuid": "75ec89df-e3f4-47e4-b523-2d0c417d323a", "comment": "Malware payload (Heodo)", "value": "552c04c14eef91b0db15370f52fdf9f4d0a41e27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647478173, "uuid": "dac5e6ac-5e06-440c-876a-e39a62c8493e", "comment": "Malware payload (Heodo)", "value": "708d2c3263949987af123d2250361da1dcc73aed0560d00cf2bef9ece411e9442b79791d6fa7cb9b4c219ad332007133", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647478173, "uuid": "6b2d0ec0-6219-432c-aa2a-5937ad554224", "value": "T1A2F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647478173, "uuid": "d41748ca-60c4-40bf-a2f8-b8b0b714a1bc", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647478173, "uuid": "ec658ccf-62bb-4143-8ac6-c3bf4237e3b3", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPJXvkgKtuBdfMAofD:WCBAdKV9Xf0ke3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647478173, "uuid": "54327075-1733-4092-a907-ba8439d02860", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647478173, "uuid": "682dc831-0b55-4aa5-992b-3adcece82da6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647478173, "uuid": "8d984343-620e-4602-8897-1768e701d6a3", "value": "277b12df3a18a40513cbe09b6a187a87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056bd70d-a62e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647547713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547713, "uuid": "0fe372ec-c8be-478e-8537-4191c29f7914", "comment": "Malware payload (Heodo)", "value": "41937027cbea22d44668f52881673d3a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547713, "uuid": "ae73bead-e054-4016-a6b1-1eb95ff537c8", "comment": "Malware payload (Heodo)", "value": "0e9ac5a1a72bd7aa95efa1c00cf4466eb41f702818ae0a3dada4375eee8a0d29", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547713, "uuid": "6ad223e4-8a5c-4b2c-b203-18682a2f90b0", "comment": "Malware payload (Heodo)", "value": "b775cebb585e9709f93f5c9a77b0d5709e071a19", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547713, "uuid": "ca1c9737-1db0-4dd2-951b-4d06fccfe77c", "comment": "Malware payload (Heodo)", "value": "2f6667df04fe97c2156aeac6778e068dfc54e617dea1ca5874a59138ad580f32e6b57fa39463e33b080d0a8d4d43c2f3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547713, "uuid": "a0333868-3381-4e96-9903-977e36d12fad", "value": "T175A2BF3FD131DC29EB7B9C7C820980F5E60A1D46200769DD2C51F75D6AB26BB038B9AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547713, "uuid": "2390b76f-4fe4-42a1-ae7d-d9c1b10d1d2d", "value": "384:OHM0Vb1GNjDo4CGzPd6ZIwA1hKb5CzgObff9kC+xbX7qE7h:z0INfo4FLH2CBn9kC+xbLq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647547713, "uuid": "6da161bc-9a13-4aa2-9050-71488582348d", "value": 21440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647547713, "uuid": "5c76a375-367b-4816-9649-123d56827bea", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547713, "uuid": "6bb0c668-1c72-44c1-babc-9c12e38d7e15", "value": "ESCANEAR-1703.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80fa77ac-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553503, "uuid": "91d9f19e-a6d9-48a1-bba3-41e119325e64", "comment": "Malware payload", "value": "8f95313bb6acac26837097d10470dc63", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553503, "uuid": "dfc6ac27-a281-47bc-953b-7287b791dc9a", "comment": "Malware payload", "value": "0ee12dc8818b25679703bb440731e8e642ccf5ad178cb6fbe48735e7955c7fdf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553503, "uuid": "54f685d5-3b05-4182-97d5-70ca9c82727c", "comment": "Malware payload", "value": "98adefb0372b28730b1e170e6a4f2a5588018a39", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553503, "uuid": "3b02f964-6b33-4bd8-a96a-a852bb8a01bd", "comment": "Malware payload", "value": "026bdb5df5764fb1a4c2d035f7d8cacaab7f308b2828609d81256178b080666c78f013ff5d8a0d1bac922819935091a8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553503, "uuid": "ecf34f96-5ddf-47f0-9cc6-fbd33a5adaca", "value": "T161059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553503, "uuid": "9c2ad86b-8e06-41a1-9124-18b36f107a9a", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553503, "uuid": "ac089376-294e-4e80-b411-d984b9e4a145", "value": "12288:V20BXOMcVzpWfmmnDDvX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDDX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553503, "uuid": "42e8277e-b365-4be0-a297-3538f4d320cd", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553503, "uuid": "b83a5e7b-81c2-4b72-8121-55153948b930", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553503, "uuid": "baaeb4a9-191a-4780-9733-7f2cf061b761", "value": "emotet_exe_e5_0ee12dc8818b25679703bb440731e8e642ccf5ad178cb6fbe48735e7955c7fdf_2022-03-17__214455.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327db4e4-a5fe-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1647527172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647527172, "uuid": "8489d499-40e8-4d3a-a377-259c0a893dd6", "comment": "Malware payload (STRRAT)", "value": "ac4685a855955fe35c27c3c978d53f39", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647527172, "uuid": "34c0f899-955e-4c55-8adb-a4ff5524d56e", "comment": "Malware payload (STRRAT)", "value": "0ee9e390d6cf9f9f51a89bb961e6a2df30f188b88baa5a8046e76f7b31965134", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647527172, "uuid": "a807f296-7ff4-4eda-b03e-d22b61b97cf4", "comment": "Malware payload (STRRAT)", "value": "c880835e444d57c132088045fed17167a5756540", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647527172, "uuid": "4b2c3bb4-5865-4270-9212-9c3d613815d3", "comment": "Malware payload (STRRAT)", "value": "39e544538eac240e199c02c31412556cf29896b810fc8a6207ceae7510bf27ff7ece858dac32ddb608cf440792874ea8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647527172, "uuid": "df68480d-5780-43f3-b375-ed204ad79b5d", "value": "T12A04F14ABD9BDAE6E01BB036215B4563EB0CA5CDC549953F21FC8C7D4EB5DA8020398F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647527172, "uuid": "f55d63d7-2aab-445d-a8fe-c4f84e8ed4e9", "value": "3072:ErcJ+S+u3W2gtp9sEuu1kSZ6Sg3IqEIxLQeUTAeJ8aBwAq:EraB/gja92ZfgGIxUeWJ8aSAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647527172, "uuid": "cbf6f8e4-efa6-438a-be5d-ccb8b038ff11", "value": 173751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647527172, "uuid": "f14ddf63-6903-47f3-8657-a3d3b7d2d6ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647527172, "uuid": "9a37d506-f00c-40f6-96e2-7b0ed12d0d9d", "value": "aFAX020003007420220313103707131121.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa63cc82-a5bc-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1647499027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647499027, "uuid": "497d2c24-c85b-4727-b40a-e40e1623399a", "comment": "Malware payload (CoinMiner)", "value": "ef4db798ba5b262fa8d856ff6dd25655", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647499027, "uuid": "97b80735-ce73-4b55-b226-253d36124f31", "comment": "Malware payload (CoinMiner)", "value": "0eee631a34fb292af883955fe0bb7953dc7f74b507d74a533ccae025c7eaf7ad", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647499027, "uuid": "1cc36889-1f81-4926-aad3-3da234785b89", "comment": "Malware payload (CoinMiner)", "value": "2275f2478abfeecc96303c57779a19b8c21e0af4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647499027, "uuid": "6ab89b5d-603c-4ca8-97a5-2ba8454a8532", "comment": "Malware payload (CoinMiner)", "value": "6934d35450d0cf6f567d921095edb39f0ad2a1e416676f626a58264d96edb291ca69f6fdd6b618b3b20ae7b8815f324f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647499027, "uuid": "a50463fc-4bcb-4a6f-a0cf-c4bf9ecc1d0c", "value": "T1DF86331EBF621106DE19CD34361EC2F2E7A57D0A8F92365533CABD4F39718328419A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647499027, "uuid": "175f2928-bf83-4d54-9228-3c98c3e4b63e", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647499027, "uuid": "61178d00-05c3-430a-a5d2-1013d3823566", "value": "98304:3csK081rUIiYFZTULay4gwpqu1gp4sdqdNbBnW6uJLz//hJrKWGv/UwZ:XLLafL1wd8NbBxSbrK3vcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647499027, "uuid": "5ddacb76-a164-4b74-b009-850421b6d621", "value": 7843840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647499027, "uuid": "812876bc-26a6-4dab-b9ee-b5812e214165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647499027, "uuid": "91ef3398-4315-4787-aa6a-69da6aa728ca", "value": "80587361.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05be5bc2-a64d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647561028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561028, "uuid": "2a72ab7c-0091-473f-93ec-4456fb2dccbe", "comment": "Malware payload", "value": "719e4a8d1ee8cc87c78ee0aa0f68f6c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561028, "uuid": "954a6997-47b1-4cfb-832c-901c6b926170", "comment": "Malware payload", "value": "0f7d00cac792483d7df438b197c090e80ed9d473fdaabbbd182873a0245124f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561028, "uuid": "f998e904-16fc-42f4-a1ec-a8049b125e40", "comment": "Malware payload", "value": "e11aaea10c7837e6d3fc4e1298190fbc906f2b77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561028, "uuid": "0e54a7f2-6b2e-4176-b99d-3db60c42a4ab", "comment": "Malware payload", "value": "8742594891411c5e98d89aa6d9201d3ee53a5503d23709f426d141ccffbc8d9dd1245a931b418b46f68b3541499c6b38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561028, "uuid": "e23a9837-2c85-4534-94b2-5a5b3cc59740", "value": "T1B023F13275D19E0E57C242F8444E945AF6908EEA83F0CF8CC99D46C44E363E5C9AADE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561028, "uuid": "1b510eb3-c6de-4f00-a5b3-530dd328bdc9", "value": "768:xVLQzEbSTcdz/pvVs+E11DMid0yhEQcTw3jeTrlptXkwzUHen7sJ9r4LQffCcdSd:xVL5+iTpvVsbz0yh5cTyjCfOwza2Y7rm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647561028, "uuid": "f3b775e7-9ed9-44d2-82d0-e018b73bcaee", "value": 48060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647561028, "uuid": "0be1d9b6-17e6-4506-92c0-f146ccabd559", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561028, "uuid": "362f5009-d57a-4ff8-b10b-b4c9cd563260", "value": "719e4a8d1ee8cc87c78ee0aa0f68f6c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394841f6-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518594, "uuid": "41c908f8-e470-434b-942a-e8212f92897a", "comment": "Malware payload (Quakbot)", "value": "9f45de469dd7fec59078d0fd0a76b033", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518594, "uuid": "c27617ba-54cf-4be5-8b76-35305e3715d2", "comment": "Malware payload (Quakbot)", "value": "0f8928f41391b40a1c440275689a59c9711d33bb29f8e333ebf02608a19f733c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518594, "uuid": "610780f1-aa95-4f30-abfa-110516602b97", "comment": "Malware payload (Quakbot)", "value": "ef3ef42f2eac8666c22bc3cc92004a82a42337f5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518594, "uuid": "07de3ae6-70fd-4b39-9f53-a7d41ff00b6b", "comment": "Malware payload (Quakbot)", "value": "77f3ab03d5c3e715b693c4c651197e991fdf0cd45cf16740223e4d47f3c398e0483924204aeaf015fc823a711fc916c4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518594, "uuid": "97b82f6c-fdfc-46a5-8f7c-2d6844b4a039", "value": "T1F415BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518594, "uuid": "d3ef2577-9ad5-43a1-b11c-73aaceb2c48d", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518594, "uuid": "4dd27f49-6b15-4b35-8ceb-82d2b4e9df0a", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518594, "uuid": "3afb5dcf-a7f1-4c17-8a24-4a8036845c6a", "value": 946274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518594, "uuid": "a00eba29-2633-4c56-8029-b67f622bcea7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518594, "uuid": "cfb50dce-b757-42b7-af2d-af396ec831af", "value": "0f8928f41391b40a1c440275689a59c9711d33bb29f8e333ebf02608a19f733c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa871ab-a58f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647479834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647479834, "uuid": "8588686e-3cd7-4028-a938-077be417738e", "comment": "Malware payload (Heodo)", "value": "b9895f4ae40152d6081eaf5eca6b9473", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647479834, "uuid": "1775cb20-8300-4d5b-b34d-f07c3df9c2c2", "comment": "Malware payload (Heodo)", "value": "0f99c7fb15bc7f06935c70d721a43351ae9812c49644ce26d08dfebcdb3db366", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647479834, "uuid": "638f55ce-4f0e-4b6f-b3f4-14cbb56cec16", "comment": "Malware payload (Heodo)", "value": "55b75970cb2aba272c07a64beedc009b25b50918", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647479834, "uuid": "89ac0201-6b70-4854-9dcc-7dec65b87b71", "comment": "Malware payload (Heodo)", "value": "01c71ec3278293f0629120b15a9d569dbce4218fbe53deca4a2a8035016de061873428452fe81ecb8bc8eae63e852566", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647479834, "uuid": "f70115b7-ecff-4947-962c-94949b8155a0", "value": "T190E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647479834, "uuid": "08c056e7-cd72-45ab-b474-fb40ff3a90b6", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647479834, "uuid": "5e6497ea-e56b-4f1b-a1f9-6003a3348f58", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eNxS332d7t5hT/hexLx:Kanana8qGBGuoNxE/xCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647479834, "uuid": "73301111-60f5-462f-a633-3f2ae238ac91", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647479834, "uuid": "74e6b143-ec1d-40cb-b3a5-a2740fd48383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647479834, "uuid": "4578333c-c5c1-45ff-80ee-d2dbe0ea83e6", "value": "emotet_exe_e5_0f99c7fb15bc7f06935c70d721a43351ae9812c49644ce26d08dfebcdb3db366_2022-03-17__011708.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482acd6a-a5cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647507022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507022, "uuid": "b3975ed9-831a-4428-abda-960b57e6416e", "comment": "Malware payload (Heodo)", "value": "819974ba0c0be17128310cd2c461ab87", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507022, "uuid": "52f67d57-c0b6-444b-8dcb-cc9568afb0af", "comment": "Malware payload (Heodo)", "value": "10a4761d0a8486a91578347ca0c1f32117f83531e37c2548e2fa1c9403f12bb2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507022, "uuid": "2d9256f4-72fe-4c8c-b4fe-b77e226c51b5", "comment": "Malware payload (Heodo)", "value": "cf79c6a5cb15d56e5510a484fe3becdc7a63d8cb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507022, "uuid": "85e5be1f-c5ff-4cde-89cf-ebc5f7312697", "comment": "Malware payload (Heodo)", "value": "1248c95b795d765ca5575f1a508e40c87c80195374fdce44c598d99a5c747c711baa20dd6f8874bee3be1e4c5943efc4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507022, "uuid": "ef35ded6-593f-4e12-84e2-769239d2c441", "value": "T17AA29E2CE921744DE3BB683C420650FA924A1C022147B5ED3991F77D6B73697068FEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507022, "uuid": "092a0be0-4c24-4a65-9f2d-db25bd15848d", "value": "384:n3uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:7sNs/zXtFCBn9kC+xbL42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647507022, "uuid": "3aacc296-1f3b-4844-8ba3-f3e49391aeb4", "value": 21657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647507022, "uuid": "3ea4c014-27cb-45bf-a32f-8fe99d223a89", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507022, "uuid": "f6da6796-af84-4e8d-8b15-52373b818750", "value": "ACH Payment info.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb2b60cd-a617-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647538220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538220, "uuid": "9d503716-d28b-4ea1-a47f-47b25e7dc1bf", "comment": "Malware payload", "value": "088a8f3a238ae77ae3472e67dd6a3dc7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538220, "uuid": "fbe4b470-3d50-4f9a-9fdd-1f8b286daab6", "comment": "Malware payload", "value": "10dfa4008dbd0845cbaea54b99fc635019ccea0fb61fef24074865605c63aa04", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538220, "uuid": "62b72a44-8fd0-4090-94d0-485739ab9f29", "comment": "Malware payload", "value": "753d7400c95ddc30f838aa880e4a243fc01525cd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538220, "uuid": "6e06bae8-6bb9-4fa4-a964-3e256c64c6ae", "comment": "Malware payload", "value": "029bad0a310c8a1ad57d99d91a300b3694ca54a14a4b73731587c395e1b54216d564d2ae38735ae605bb9ca39c15978e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538220, "uuid": "6872ee5e-5001-4213-a0f3-149e219f972c", "value": "T1F033A52576FAA4DAD1299F700FDFF5EAB264FC574C0A917731007B2CEB396608E11628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538220, "uuid": "f3b0f424-aab8-441d-a90c-6a28ef170521", "value": "768:P/qpElKC6b7ddZ4viDupYckox1cLgkHapcvcwZcZgVmYwW:3qSlKC6HddaIMigkHaPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647538220, "uuid": "da446293-c22f-46b7-b6a7-184551b0fe4e", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647538220, "uuid": "ba87ca54-2f1c-4eb4-b797-bde26d7731c6", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538220, "uuid": "6c8d5631-58c6-4c6a-8175-54b1a0b20772", "value": "088a8f3a238ae77ae3472e67dd6a3dc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8354d64f-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "82a52a5b-9323-4139-890c-d976409ea4aa", "comment": "Malware payload", "value": "f3eec6ac742e1c1755b0e9ceb646c6fd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "aa775adc-0aff-4120-8bf1-71f003b4ecf1", "comment": "Malware payload", "value": "1135687dca9a3ca1b8284c30d0dfba2964024a13752413fac935bcfdb3c3bc18", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "00a35c57-81ae-4d8b-9f2f-f2c3cb385718", "comment": "Malware payload", "value": "114536df3e701eb6ede52e235fa9c039c3060432", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "c3891537-91b7-4fbc-9e02-2b7f699bb509", "comment": "Malware payload", "value": "9b3c549b02084e9ced29be614059f20ccae3836750515f29c48ad03e3b00fdcff43ac7e3cf88fb94810745c3da9aaffe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "5a723030-4008-49db-ac4e-104e780d7de5", "value": "T173059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "00240acb-ed9a-45ef-984a-8db985da7f55", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "edc8bf9c-851a-4d65-ac3d-8914d3db236f", "value": "12288:V20BXOMcVzpWfmmnDDIX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDMX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553507, "uuid": "903a36fa-b075-4dd8-ad65-c437fb29be33", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553507, "uuid": "7c1eb04d-a5d6-4147-b8a2-f3f618f0163f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "ac2c44c4-8e90-4e4e-8f6f-ffe24143edcd", "value": "emotet_exe_e5_1135687dca9a3ca1b8284c30d0dfba2964024a13752413fac935bcfdb3c3bc18_2022-03-17__214500.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49701ad2-a5cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647507025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507025, "uuid": "ed391124-ea78-4ffb-bb73-e45bce2058ac", "comment": "Malware payload (Heodo)", "value": "a9b252ea5086701560cf4bf8bd07df89", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507025, "uuid": "9e60c2d6-aa6e-47c3-a302-4ea058fcadc6", "comment": "Malware payload (Heodo)", "value": "11bb01a402bf7c75f443262e8f458d03386ff007e7c46c60c63db15744f63d6a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507025, "uuid": "46ded29b-ce03-4e32-a88c-085c1ef92277", "comment": "Malware payload (Heodo)", "value": "d7be4a471bb1bbe423a07fc5c8749fbadc308fac", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507025, "uuid": "5ea91629-18fd-46be-a811-eb0e4bad0348", "comment": "Malware payload (Heodo)", "value": "e38820a381b7f3e2740be60cd109395f66077b3d27671339c23baf4d944d41e753465bd851bf38b05e3f8e37b7d8be65", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507025, "uuid": "eedb85d9-84d9-4b87-a7fd-707ee7de35cd", "value": "T16CA29E2CE921744DE3BB683C420650FA924A1C022147B5ED3991F77D6B73697068FEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507025, "uuid": "8b3958a1-7aa1-4103-bbd0-53340528fe5c", "value": "384:j3uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:HsNs/zXtFCBn9kC+xbL42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647507025, "uuid": "742cc476-f353-40d8-93e0-5e8314b1e8a7", "value": 21657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647507025, "uuid": "470de500-5aa9-44a9-865e-c7f119fb9d42", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507025, "uuid": "991aeb3a-f060-41f6-9d8f-7fa17f3429b1", "value": "BANK TRANSFER COPY ACH.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef920274-a5dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513316, "uuid": "0b3fb676-4a20-42c3-8a18-623420513fa8", "comment": "Malware payload (Heodo)", "value": "67ef9c48d29d0266b19dcf264cb2191b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513316, "uuid": "6b0c0e28-c265-4327-b664-0308933e08a7", "comment": "Malware payload (Heodo)", "value": "12074deef5d9d90e34e0bb168a9f9c1be9fb16a578576854e8dc1091775d03dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513316, "uuid": "5e2e249b-d8ed-4b63-a41c-325fc9287639", "comment": "Malware payload (Heodo)", "value": "0e5a218037bc4fd0f6432040005be6848b6f5abe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513316, "uuid": "9509b1fd-876b-4996-8b66-ed18c3517985", "comment": "Malware payload (Heodo)", "value": "40e8986a42d885e5c3b60c0b23812c32d80e1c8ae8b61d95ddbe7062fc88ae0d57448eae15c2c8fb0121d29b06cd7198", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513316, "uuid": "1aa296c2-c3fe-467a-901d-4c6eb570d23e", "value": "T174F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513316, "uuid": "cd2503a2-9d81-4dfa-8e0f-1816054436ca", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513316, "uuid": "ed552601-d833-4a1d-82f0-1cbcf5f1e044", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hQ8rLneTfABCJoWRWwfpW:BeCCF88j+X18OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513316, "uuid": "65e97499-9077-443e-91e8-a1b895dbf362", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513316, "uuid": "1899a91c-fe92-4fcb-97e4-c484d783a075", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513316, "uuid": "e8437208-78c8-42d5-8cf8-72c6068dcaa1", "value": "67ef9c48d29d0266b19dcf264cb2191b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8dd08e6-a5ad-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647492662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492662, "uuid": "c40e6b76-f92b-456e-9f78-cb8dd231c6f7", "comment": "Malware payload (Mirai)", "value": "9a7e4a1ff470cd2bdb9fc7b558be3e3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492662, "uuid": "e4e4c848-8bd1-4c5b-9450-48b854b1b875", "comment": "Malware payload (Mirai)", "value": "1248166e4b60680c22294794343efb681e4af60b72c6b865baecda2d85426c50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492662, "uuid": "c410419b-fdb5-42e9-90d9-2fa09cf25980", "comment": "Malware payload (Mirai)", "value": "fbf6d64d65a0857a9cfffbbc5b697454e14b13b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492662, "uuid": "6be8abf8-df0b-493d-a81c-41da7e96c0a1", "comment": "Malware payload (Mirai)", "value": "3849f8d1baa41487c5b30b0ce0c4c4537e415ab9a8f5cf1c6500665496f955c516d6e52453b68aa8820487512b80fa3a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492662, "uuid": "40026326-ca24-43cb-80d8-7a1eefe912e4", "value": "T113A2D0A1255CA435DEF60D3DF57D01547393BAF8A0FAB26B9470428969CBC2B2374387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492662, "uuid": "d4faeea2-3f37-4a3f-94c5-2576c10e07dd", "value": "384:UyIos0HnhTNaaam2LkfmimhCKaFTZxrz66hT2ghymdGUop5hY:Cos0HntNak2Lk+imkKaFvrz663s3Uozm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647492662, "uuid": "42f99a92-8816-44c1-9e4c-d12b8efda4e0", "value": 23288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647492662, "uuid": "5503ce65-0cd7-4285-a63d-8db69fb6e555", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492662, "uuid": "eea44069-399b-40d6-b022-266f84985de9", "value": "9a7e4a1ff470cd2bdb9fc7b558be3e3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633ea08e-a608-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647531549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647531549, "uuid": "7cfb1b9b-56c1-4c9d-a810-abccba87ff4a", "comment": "Malware payload (AgentTesla)", "value": "761edc9853c47807d2c04d7c21f082aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647531549, "uuid": "d4384dac-7154-44e0-8428-88c09f055c42", "comment": "Malware payload (AgentTesla)", "value": "12676d318b2f80a486063e628eafd53a397aa725bf685722aad39f4c1e9dfb3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647531549, "uuid": "c01b7cf2-26a4-41da-b93c-c4f441b60b00", "comment": "Malware payload (AgentTesla)", "value": "3d46c83a890c81d75f7822d23237b11e0dba03bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647531549, "uuid": "81900be5-9356-4f67-a2eb-ea2293c7bb2d", "comment": "Malware payload (AgentTesla)", "value": "ed25815fa6cafb6460fc293e7f2674e9c9e4df41c2593d8ae88ea8b86243a39a4ed850f454efdd9a5701667caa948834", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647531549, "uuid": "e1bb9706-4cfb-4df2-ba43-1d1e95f0feef", "value": "T11F451203774A8A03C66E0136D0EB590047F1EF55B933E7573EC977AA09733936A1A29E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647531549, "uuid": "70e6eba7-f8f8-4f8f-a3d1-1eaebe2f9dbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647531549, "uuid": "fde568e5-ee81-4992-b6a7-388b517364d5", "value": "24576:+35TwOmoqTzMKhgZY2wLRtLUzkJsIzOZTdeZ:+3NfWTzMKqZYBRtAzkJsIzkTde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647531549, "uuid": "e3b8da22-45c3-4bde-a8d8-a6c61cee57e9", "value": 1243136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647531549, "uuid": "f928b85e-63e3-40df-8e12-e4a3af75c00b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647531549, "uuid": "ee3f13ba-c93c-4b3b-b014-3c65c2cfce74", "value": "pCEMy0pMWb3jOmh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2df73e6-a5dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513322, "uuid": "b9859e83-6931-4013-8d0f-a3855bab5aa1", "comment": "Malware payload (Heodo)", "value": "bd07904238f4db01281b1020f0c925e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513322, "uuid": "43d1d719-f5aa-4a35-b4c9-adb15a27a412", "comment": "Malware payload (Heodo)", "value": "13ef5ec646d0950de2f3e7f7a0dcd149d9630f26430ead90d6f189b6367fb5f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513322, "uuid": "065bfc5d-642b-4a2e-ab95-2f0cbe9f6f6d", "comment": "Malware payload (Heodo)", "value": "fa72faacccee7bc233643e1903c488aececf8728", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513322, "uuid": "a57f0ea6-8b5e-4075-9e73-fc0e2c0956a8", "comment": "Malware payload (Heodo)", "value": "c3c484d9a1171ea69c0615be7e7c1e8f3b4bb487208771d4c1a045fdab49b13905e635c8c86ee66577ea5dbf3a008727", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513322, "uuid": "e4b0b64b-f762-4a1f-89b5-d1b87d31238b", "value": "T179059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513322, "uuid": "ea7a7a4a-0d0d-47f1-aa28-a03b8378d726", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513322, "uuid": "4820c465-bf31-49c6-8c87-bac11402ccbe", "value": "12288:KVHML2QJe6XxhqCW0QHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqMQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513322, "uuid": "deb12e05-1d95-4591-8e55-562b8e9bbd78", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513322, "uuid": "5dee56af-a9d7-4d99-88a3-ee566fd288f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513322, "uuid": "746ca555-8cd9-4a69-aee4-500301fd0602", "value": "bd07904238f4db01281b1020f0c925e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e117ae4-a5e5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647516454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516454, "uuid": "19e9e54f-ffa0-47d9-90c3-39581a3f217d", "comment": "Malware payload", "value": "639cf83302cc03df7f450bc524e4041e", "object_relation": "md5", "Tag": [ { "name": "B1txor20", "colour": "#9798FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516454, "uuid": "4ce34dd8-47c1-48a1-bc05-2452a5e36e43", "comment": "Malware payload", "value": "143d33134a40ffa82069f1a0b39d35e33606b8bbdbe60f2c4ba2b15502ae7cb9", "object_relation": "sha256", "Tag": [ { "name": "B1txor20", "colour": "#9798FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516454, "uuid": "bc0987cc-87a9-49a4-9640-f94ac85bef49", "comment": "Malware payload", "value": "21cf18e693b25c886c866e5ab6dc04f9c3923a80", "object_relation": "sha1", "Tag": [ { "name": "B1txor20", "colour": "#9798FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516454, "uuid": "bd3d29f6-a51f-4aab-a500-06ac49340bff", "comment": "Malware payload", "value": "e5ff08186ed824cef9c5fcb25d919ddf3c3806bdd0f0a77afba7680e64ae8be7f6adeedf1140398157dde5a84135b26f", "object_relation": "sha3-384", "Tag": [ { "name": "B1txor20", "colour": "#9798FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516454, "uuid": "0790b0e7-0d3d-42bc-af95-146f682177bd", "value": "T1C703F111B919CBCED400730606E6AFA3C165C9DD0C037E50EBE8E468AF5F929ADFD149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516454, "uuid": "7c6343a3-5dd0-48f8-ac19-393d99402b8a", "value": "768:6viyTLZRe3Xs0PL3Rj6w7QrGoI2z+mcZxsksQ0IQJ9m+LaJt:6vv/6M0z7y36fxsLQ0IQJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647516454, "uuid": "cccdb683-e064-4ba7-a74b-03b706f0a85e", "value": 39319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647516454, "uuid": "50dbaf35-2b88-45b8-b2ed-96c79854a53e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516454, "uuid": "bf72c93a-95cd-4793-8ef3-559349a77489", "value": "7a9981c972ca335b90a13cce275d0d08328ea64c5369287f1bb0c0a0f996b223.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb48d439-a5e3-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647515805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515805, "uuid": "2c5dc32c-35d3-4b17-bb71-24957a4e2b67", "comment": "Malware payload (AgentTesla)", "value": "c9e359aed4d435b91d60c9705f17c4d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515805, "uuid": "d226b4bb-fb66-458a-b856-eedf0d5cc394", "comment": "Malware payload (AgentTesla)", "value": "14a99561038d905d26b43e16fdb887bc93f917b33169541729ab82036d524c68", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515805, "uuid": "82ab17f5-a939-4cf3-a808-f7c6af7cb1b0", "comment": "Malware payload (AgentTesla)", "value": "67473140cd77f6aa213d27be994d96e53c90cab0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515805, "uuid": "16007955-b475-4236-bf17-9342383ac7bc", "comment": "Malware payload (AgentTesla)", "value": "a4025957a7411065dbb5f5bd8abc8c778428e4abfbebfec956d2207363f3d8ad58070e2051deab715001e1779bbf3c5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515805, "uuid": "6e28dfc1-4118-45a6-a440-98615fbc26ae", "value": "T1F585011BBB2C5B5EE59E07B1707601704B64AF472016E74DFAC5EDAC0E2278C4A1B2E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515805, "uuid": "e4f620e5-065e-4e1a-9e73-361d223d5007", "value": "24576:5C3n97wBel1U8uvyrFJWRBySMP1vYgW7Xr94oB:c39/fuvyrFJWRsD1AV7XruoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515805, "uuid": "6eb79b9b-a5a5-4764-bc90-43e99e276fd3", "value": 1835008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515805, "uuid": "da2ebfca-cc23-4aff-8150-51b3e73e2675", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515805, "uuid": "3b01967c-d2d9-449d-9f80-2cacbbb96673", "value": "WIRE-Transfer INV#SABH0076.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96fa7e69-a614-11ec-9275-42010a9c0029", "comment": "Malware payload (Hive)", "timestamp": 1647536790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536790, "uuid": "bb4d0973-5445-494f-b9d2-63ad1c1ef44a", "comment": "Malware payload (Hive)", "value": "7d4220c9e78fdf518621c113a8649176", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536790, "uuid": "76596740-7a3a-4610-b1b0-39bc1b5369ad", "comment": "Malware payload (Hive)", "value": "1509f264e1e97198ec674fe8ee464a6c05e216e5f29553b8e03289a8d7da6de3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536790, "uuid": "506e0a43-d51c-4d2b-bd92-06f0225bf70e", "comment": "Malware payload (Hive)", "value": "44b191a24ed1ed4d18c5ab97ff8ed618f06daed5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536790, "uuid": "51bec8dd-a624-493d-8e41-531bf0c85e5b", "comment": "Malware payload (Hive)", "value": "9a39f77d1562b7752f9798191b0a8e5cab3625bc4aa52da08a925ac0bcf20cd91b4128383922cba9daa2439ae58982f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536790, "uuid": "b96e2d79-47aa-4e67-9674-a7595663aa0d", "value": "T16F46335A405361E4B2C27D61A729FAE1684635231FA27D704C07CEFA8A72DDBF2D2347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536790, "uuid": "029b6ee0-266c-4048-beb1-133f23eec3de", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536790, "uuid": "e4448a02-7d85-4858-a7a1-d70a69389b1d", "value": "98304:f+oASUsqDE/YDjNT0ndGwfGxpATU7airMs8x6PsNwGUky7YNsETtYt82a6OT0fcy:f9Rt44gxSTu49UkYpJcbvYppHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647536790, "uuid": "b5123616-da00-4f03-92f6-b508fd63c1d4", "value": 5636608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647536790, "uuid": "d42acf2c-13bd-4c03-83a2-e1a31c47fc2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536790, "uuid": "3bd1ae04-7af2-49d1-ae6f-9680f3f94934", "value": "49495799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bacea33d-a5a6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647489605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647489605, "uuid": "b6183d53-d629-493a-bc98-aee8e6427e04", "comment": "Malware payload (Mirai)", "value": "e0e237ffefe85705050d03c45c770833", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647489605, "uuid": "417c2ece-aba0-4192-8ac8-ad1e904a6854", "comment": "Malware payload (Mirai)", "value": "1583118a21304690eb1d113d87f25840dc8140a12988436dd300476fa1151884", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647489605, "uuid": "8fabeabb-4585-4c39-9f58-561dcd51d06c", "comment": "Malware payload (Mirai)", "value": "1b8d68487a4515f51d22d022289673977e2c093f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647489605, "uuid": "dc65f1a3-7d38-41a0-b6a4-5d5018467c48", "comment": "Malware payload (Mirai)", "value": "ff85e8c5d67635b0d17a9d3dd300cc7899072c09968b7ded4db061521259227118205d3da8e6834044722bf6ff1392ca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647489605, "uuid": "4cf8cc4f-70e4-493e-af05-c7fec70f1074", "value": "T196A2D0A73C55CC67C62A7236E3A3BD0BDB07C6D815E05B925E5F2923136B60DED04CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647489605, "uuid": "dbb49578-05cb-4e69-ad9e-d4e9dcb5b6b0", "value": "384:MXleI/ST42f0/vBc5SGFKD6H5VGWPHgfFILnZeSBJo0Yp9W6EAXaGuxF/664zp4Y:zp0/5sSG75kwHgdmISBJLY7Lqn/664zF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647489605, "uuid": "62ed11c1-8982-4365-9040-0f9aef5ff297", "value": 22688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647489605, "uuid": "ee00aa7f-fe9e-46c6-bb7a-36b8801e278b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647489605, "uuid": "5790367c-3a66-40a3-8ca2-60823a88d745", "value": "Rakitin.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce27e636-a5eb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647519273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519273, "uuid": "7cb45025-7a2f-466a-9750-ab1119451b1c", "comment": "Malware payload (Heodo)", "value": "1211b69093f4816a6da7ef9ef9b49ef9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519273, "uuid": "292cd16e-9301-4ed0-bd6a-73e34df2d727", "comment": "Malware payload (Heodo)", "value": "161d70d2333afa751ffcc70a9b9e63e5eb56a249fb4cedddcfb979d29c2c9b80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519273, "uuid": "e73fba2f-9c3f-4e1c-9b0a-574bfe9992a6", "comment": "Malware payload (Heodo)", "value": "71a6474ef48b0f7d7c5fae89eec4444462fbb390", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519273, "uuid": "68eadc4a-9c27-4da6-a675-bf2d1254ec49", "comment": "Malware payload (Heodo)", "value": "6d94640a7890e44584af279aa6eb3e65ce4f027a257a127768fad8c2c69fa8347f1357ebc28712d2ea9470fed1d644fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519273, "uuid": "bd012877-777b-410f-8557-2c18b528e145", "value": "T1DC058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90117EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519273, "uuid": "b50de3cd-9c3a-4cea-83b0-3beaacfb582e", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519273, "uuid": "c2b7e241-7d8d-4e5f-a5bd-036eea91c4c5", "value": "12288:Wvz1CLJyyvmMLSrBg64ruGbPlVpqb+DlYzv:WJCLJyybLqBj4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647519273, "uuid": "9c81da6a-f570-4b63-854f-ffdb3a4fe840", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647519273, "uuid": "9fb453af-cf94-4acf-ab67-68a3b5933799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519273, "uuid": "a139e86e-fb33-4ffb-a7e3-333d59016d6a", "value": "1211b69093f4816a6da7ef9ef9b49ef9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21333281-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518553, "uuid": "87270bac-0749-467c-aac6-f7a3791c1b97", "comment": "Malware payload (Quakbot)", "value": "21745986c938cf7ce19211df7bc2217d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518553, "uuid": "7fcba183-d776-44ad-82da-1aa748921fc2", "comment": "Malware payload (Quakbot)", "value": "168cb2f24c40ceaca3dd15347e2658f3e4aa69e0beb2759145204bcfb2e4b89b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518553, "uuid": "68514847-7ba7-463a-aa3f-c3d1a9ed12c9", "comment": "Malware payload (Quakbot)", "value": "37320b814097db775e42983a800a3b6746dfdce3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518553, "uuid": "15945149-9476-4a19-916a-351fa2d4aab6", "comment": "Malware payload (Quakbot)", "value": "f71ddd4e4252acbd2fea4ef34741a7984f4eea58aa580dc599dad09026d8fbf461f3a7952715d708532c56feafbccbd5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518553, "uuid": "e257278d-a5d3-4529-a85a-09493804db5b", "value": "T1B715BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518553, "uuid": "00230bd1-047a-40f7-ae86-e95df7dbf53b", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518553, "uuid": "efb07fd1-f6e3-4a08-93b6-e4fa3942d000", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518553, "uuid": "e2c2407e-04d0-4805-91b3-82e171ac3088", "value": 949820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518553, "uuid": "ca7474a0-7009-4718-835b-9fcc566e59b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518553, "uuid": "fcfb903c-c3b6-4538-a54b-e1a114ec7eef", "value": "168cb2f24c40ceaca3dd15347e2658f3e4aa69e0beb2759145204bcfb2e4b89b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc14129-a5e6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647517152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517152, "uuid": "0c1f4404-473c-4f3a-86d3-569c2c9cc9b9", "comment": "Malware payload", "value": "4b7ab04e73da239495e33189ce2d41a0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517152, "uuid": "c4ddc1dd-7a0c-4e46-a4a7-4d927714f827", "comment": "Malware payload", "value": "16bf6608b6ac1f26e339d2415a1e104d26faf94c1575dc88d2d8a73727454614", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517152, "uuid": "b7970b5a-3a5e-48d7-a5f3-82d439464590", "comment": "Malware payload", "value": "6022c811432a5bc235043a869ca1d491ceca2991", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517152, "uuid": "542d8016-a26d-4eed-8334-7311d2de4938", "comment": "Malware payload", "value": "78a6afd119c5a19266114d9e526e6b2271021d510b62803ca3b5e3c573a04b888a6ecaf842916c90b8eb7f36b3ea7fe8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517152, "uuid": "7900bf58-1e2e-4953-9a0b-d239bbc0e779", "value": "T1F8034086B6C3DA15C62B84B1C6B543746B267CFF5FA2A907B88CBB3A5BF04711785304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517152, "uuid": "d3d1a951-515e-4efd-907b-889e4bd1cfce", "value": "384:PZWOsuYv+1hwzpyGcS2r1ZU1r+rDX3xz99:PZWhk7r81r+rDX3xz99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647517152, "uuid": "124ce634-241c-4221-ad79-f3d1d5cbce32", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647517152, "uuid": "ed6b6ad9-e178-4d99-8ff3-100348db5fee", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517152, "uuid": "701afd1f-21fe-438a-a6fd-aeaf2cc6b966", "value": "UNCLAIMED FUND.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8344fc01-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "41b599ce-21a0-42a5-ade4-bf3ce89aa10c", "comment": "Malware payload", "value": "00b91f05aed17e2dce0b07a69ef52f43", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "3ca9711b-f5b7-4d6a-a754-f7fb11686619", "comment": "Malware payload", "value": "1769c88c37d8f4b692eb2726b7cc9e2e1503ef90c1eff39994a7c7f262a3426f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "50f98e46-4cc0-437f-b531-d6da76c0e84e", "comment": "Malware payload", "value": "1571c7b759e038796d800368b4d64e4669de75fc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "938cd17a-4720-47bd-8a46-92f2e18c6d98", "comment": "Malware payload", "value": "79a531c956d3b01f20b172421cbfcfdf7d4da467e095740b1364a5aee4f62717de4036c80c768c1019e0ebb956baedfc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "7dafb8b0-5b70-4339-9eb9-6c4342e2b57d", "value": "T1D9059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "8306b0c5-bc57-432d-bec7-fc5325856439", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "ea187707-6f53-4076-8b47-4b18e2260e8a", "value": "12288:V20BXOMcVzpWfmmnDDQX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDEX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553507, "uuid": "f4913d0b-2a6c-4f7e-a57a-01b327f60073", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553507, "uuid": "ef844e76-1412-46e6-b601-9c122596a039", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "87dc1f70-2812-4b50-81bc-39e4931b71af", "value": "emotet_exe_e5_1769c88c37d8f4b692eb2726b7cc9e2e1503ef90c1eff39994a7c7f262a3426f_2022-03-17__214500.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aeb44d0-a5de-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513362, "uuid": "7aaec799-cd8f-428d-b995-9d5a11bcc4fc", "comment": "Malware payload (Heodo)", "value": "ee156aede41ea1ac1d978433b3576019", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513362, "uuid": "b7d0c86e-53a9-43c4-824d-7cbc95b76f00", "comment": "Malware payload (Heodo)", "value": "17afc31b48337b289349095f3c31d8d9c0596d39bd767c22d1dd17b042a2b516", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513362, "uuid": "ce63dd61-25b7-41a0-8836-f78877359725", "comment": "Malware payload (Heodo)", "value": "b93cbc13a5e3fee2d8e3dac3606ea9d7419ac974", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513362, "uuid": "7e0bad1b-809a-4787-995f-505e07fdc5d6", "comment": "Malware payload (Heodo)", "value": "6c2a1afed9eb771d368ceacb850e431efa034373118109a8da93935a42374b3ec853529941f4cc573ba75c0d8c14238f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513362, "uuid": "8ccbed83-a81e-4514-a511-31947f38e434", "value": "T1FBF4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513362, "uuid": "4fb97b9a-ecd4-45a4-b42b-cd259e9ea168", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513362, "uuid": "aaec4b99-8127-4457-a23e-0fe5841ee54f", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hh8rLneTfABCJoWRWwfpW:BeCCF88j+XM8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513362, "uuid": "f749d983-65db-40e5-b891-8346b68cf18e", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513362, "uuid": "794c7232-4f28-4f59-8319-0b05ffbaed53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513362, "uuid": "6e9a86c8-b610-477e-9a37-3b6b48a0589f", "value": "ee156aede41ea1ac1d978433b3576019", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40addcd4-a5f2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647522042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647522042, "uuid": "c59b4296-e6af-4091-9719-eb904af1e110", "comment": "Malware payload", "value": "c36a4394672e1ec3fe2afb8964db1fe4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647522042, "uuid": "a39ab4fc-0478-49ee-9000-41b7ec2239ad", "comment": "Malware payload", "value": "18405c533a691009433f7e58822ffbde93efa28a519c99662d0ba861280de3bb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647522042, "uuid": "d84d976c-71dd-4f2f-a20b-9f99c7417765", "comment": "Malware payload", "value": "c1fd3150efc8ff2896e878bd286dd3e47347f8f2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647522042, "uuid": "700310b8-9a87-42b7-98d7-317a1f19a372", "comment": "Malware payload", "value": "0c7ba28c1f07d3c8136bdae26d001e93cebf0e5872d702f4992066ca9f00a70532f277c7b1a92ef4a49db34c3bbd19a3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647522042, "uuid": "7dac5264-f48b-4143-9913-f05f53595468", "value": "T13F3318897AA88741CC7461B3C0F3245103E5F9D707F3EA4A7F9906594E032E6ADA9F8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647522042, "uuid": "97aa9a26-3465-4e87-b3d8-f0080e0caa40", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647522042, "uuid": "2225ec0d-4f93-43f4-9d9e-9aa70068ee8f", "value": "1536:THuJBL1Wityy/wIpJIjR80vxnOv3ptQpAt:e2igGwIpJIja0vA/p9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647522042, "uuid": "ea44e7cc-947e-4c2d-9e2c-bd57d3430ab5", "value": 54272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647522042, "uuid": "48d7b669-34cc-42b1-9727-724e20574fe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647522042, "uuid": "2cf66a18-cc7d-4f07-a1c9-585cd790d48d", "value": "SEFGRDHTFYGJJFTDHFJ.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a894af-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1647518826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518826, "uuid": "6b7821aa-68b3-492a-86e7-ce8c34ef99e8", "comment": "Malware payload (Gozi)", "value": "034a0ada972701c9e6241243c82798a5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518826, "uuid": "74fbd5dc-f2ad-4a47-9cde-5c2f719781f0", "comment": "Malware payload (Gozi)", "value": "193c641aa9ed7092639694239d0f477f02ab493d3c525917613a13490533b9fd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518826, "uuid": "15b6f1f9-c746-4a93-9bc1-03a160e42ec9", "comment": "Malware payload (Gozi)", "value": "200ee4388830bbc4640f7f8c2b9eea07b84adc7c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518826, "uuid": "6993def4-0bda-4320-82bb-ff21ca0a80db", "comment": "Malware payload (Gozi)", "value": "fa8b56bdb87cc7a973689f5b3f9cce8979d1f05b504699e2fa38cd8a671f532da0101687f62c566c23082855d208a2ac", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518826, "uuid": "37b70a6a-091c-45c0-80ac-8eb7e06fb7c2", "value": "T13F356C22BE9E4837C17A2A389D2F576868397E103928586F27F41D4CDF397417C252AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518826, "uuid": "4bf917ca-5da4-486e-b72b-04fda074aea3", "value": "29b0a68551a99728af2da380e4cc5074", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518826, "uuid": "6e031cbb-5f94-418b-8352-b3e90f2ddeb1", "value": "12288:qP8LPFKkgEUAa+Mp1YEZdFyHkvs0ky268wdiWTNLxJO3vp7WnUaF5prq+etXrslj:4EPFGiatMEvsIfdi0Svp7WUwrzetXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518826, "uuid": "e9e0ad8a-ac18-48ee-9e12-1d78097e4676", "value": 1078784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518826, "uuid": "ede3732c-fbf5-4c55-8219-200bd35d4f1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518826, "uuid": "3b3f35c0-4e36-4652-b19c-2b1f1af16c3b", "value": "status.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad73404-a63f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647555345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555345, "uuid": "a1791eef-c22d-4da6-911e-a5c08487a74e", "comment": "Malware payload", "value": "240379c0873b5ee6f15af6126ac000ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555345, "uuid": "47d7ed83-21f3-4424-81ad-621bcc93febc", "comment": "Malware payload", "value": "1967c25b6eff693828a24b0af11b46aa81f201e9dadd5087ecdee7caab65e269", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555345, "uuid": "eeb1765f-070a-483c-b7dc-16be6bdcd3ed", "comment": "Malware payload", "value": "558c7f7dba518d50c21993a6fc794c49695de810", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555345, "uuid": "df02e6f3-cc39-433c-af95-aa9dcca111a0", "comment": "Malware payload", "value": "1cddc9d719183aacb1ae3777d4bb010467276cb0136d0397f3828aa732f78ec3f9cdbad82f2112fcd8980c9b921bc8ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555345, "uuid": "8c2fffc0-2e64-407a-8f26-05425fadfca1", "value": "T1E5059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555345, "uuid": "4dcfa4c9-5c28-4009-84b4-d63d55b9a987", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555345, "uuid": "7e5a2c4d-2f6b-4282-9812-c56cc1c230af", "value": "12288:V20BXOMcVzpWfmmnDD2X5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDqX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647555345, "uuid": "c13ea26e-1dcf-4455-8702-194758d34868", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647555345, "uuid": "fbda10d1-e599-451f-84c5-e20a45692070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555345, "uuid": "2b507a0b-1b9c-46ea-9bc5-47f452d710ac", "value": "240379c0873b5ee6f15af6126ac000ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff53b96-a600-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647528000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528000, "uuid": "4c1531ba-3935-4ca1-8d06-2fb96c2f8b27", "comment": "Malware payload (Formbook)", "value": "971e226a77bf2c9d0e0341bf9e3829af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528000, "uuid": "b81512bc-1431-449c-a328-00829601abd3", "comment": "Malware payload (Formbook)", "value": "19e0cc8be99faf620eb57f77048df43eedf382eb313ac579a63079cd534b6367", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528000, "uuid": "d3d32eba-9c41-4834-ba5f-dfa7a356127e", "comment": "Malware payload (Formbook)", "value": "d9e14e48ffb0a6b9b14d6e5bb45ab7bb06b54c35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528000, "uuid": "09ef8c2d-a059-488a-8757-8a02bd976125", "comment": "Malware payload (Formbook)", "value": "c185af088b7aa68423c632c84d8ab555458659586c8140192dd539fba225493228e5ad10a949d0ed7643f13a1426b4ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528000, "uuid": "ee53cbbc-6b01-4f7e-9619-cd06b23291c1", "value": "T1154522A93FB09932F56F13F1E05345988BE1B21A2046C75ED981B8F81E677C9462F363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528000, "uuid": "aa5b23dc-1038-4be4-8bbc-0ba128f2582d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528000, "uuid": "7a5db13d-035f-4e3b-841d-deb01f021282", "value": "24576:eK3x9mNp9+yVZ80NWune3HgsZFAeoplXaNYyzP1ukn:Z3jmNp9+cnNWue3vgpzyRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647528000, "uuid": "84b3c496-a695-48ea-a972-7b02beba761f", "value": 1181184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647528000, "uuid": "6e66941e-a067-43ff-b1e3-cf3df9d96ed0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528000, "uuid": "43c00815-cb00-4450-9b26-7b5e91378191", "value": "Payment Receipt_EURO_38474.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc2ae92-a600-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647528342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528342, "uuid": "423809da-c7de-4e71-bfa8-273ca14c1a02", "comment": "Malware payload (RedLineStealer)", "value": "4e6f6670c495a2d49e4e511358d755ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528342, "uuid": "fa3b4f2d-e70d-488f-8f56-62f936e78929", "comment": "Malware payload (RedLineStealer)", "value": "19f8940366e23d15e7f7e3d0c7d7457d73c100dc4e46b4eaa33dfae5559d3e2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528342, "uuid": "17f09754-4ce1-4f2b-8e67-fa1b7383bf3a", "comment": "Malware payload (RedLineStealer)", "value": "b3aa125ea7aef2568eae9200858057144376e69b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528342, "uuid": "4d81cf9e-4d91-4d9c-ac49-4288ca49bf58", "comment": "Malware payload (RedLineStealer)", "value": "11ff0572aef5fc9186774ddbf0ec381c09a2357a0bb25d2b8f5e7e2d30af6f53b394c78c78f6383fc5b8b726cf935edd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528342, "uuid": "f2da845c-42b5-4101-bece-ce260d3f0f31", "value": "T12684C040BBA0C03DE1B701F87D7993A8B53E7DA05B2454CB22DA6BDA16356E1ECB5307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528342, "uuid": "2761ad48-ed4e-4401-ab47-71b6deb3b235", "value": "f1731ed7afe55cfc124203197b72d3ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528342, "uuid": "033eeea5-284f-4379-b053-bb39889f8c38", "value": "6144:aQZqiz1Jh1+oa/s1QEvzCYO28Me6lLnFiyCRMpH7klNsanMZSdu9QCw:aQlz1Jh1+F/sZ7CY98MeUJCRMu+3ZSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647528342, "uuid": "85b99224-e9ec-4b3e-9c9a-4332f3d60ef7", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647528342, "uuid": "5837f9de-ca51-4807-bac1-a7d59c809e23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528342, "uuid": "9fee7534-2197-4de1-9804-64c93854f25f", "value": "4e6f6670c495a2d49e4e511358d755ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58dfc5ec-a585-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647475268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475268, "uuid": "a034bfff-8c47-4268-9bc6-18846a37c56b", "comment": "Malware payload (Heodo)", "value": "7e6a088b1ab4f2c6cd65ad5797e526de", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475268, "uuid": "0c5e093d-8696-4864-b4b9-b1f8cb6157c8", "comment": "Malware payload (Heodo)", "value": "1a31d713ea599a2e5cc1bc12a6437278122058e575a35da4ceb29a33e93ecfef", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475268, "uuid": "e0db2d2f-24d0-4c79-8e67-c9c3862e00e6", "comment": "Malware payload (Heodo)", "value": "9c5a998167d6b77efeb55caf3202a49b32d50e1c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475268, "uuid": "f05c7322-e810-4850-ac93-89f0be39d38c", "comment": "Malware payload (Heodo)", "value": "d654b2187a33bd3c6d4594c809adc7ebb02c54fd73d52685e3510ff0e66b03d3c23911159ea24077ce886e0d91f08e54", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475268, "uuid": "ad889fe7-1c9f-4eee-986e-49befdc552cc", "value": "T112F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475268, "uuid": "a760a9c1-639c-4fcf-bbed-256f12dd0185", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475268, "uuid": "3d966133-eab2-4426-9797-b4ead604989b", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hL8rLneTfABCJoWRWwfpW:BeCCF88j+Xa8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647475268, "uuid": "368a4871-b933-4f12-bef1-420d8314e0d5", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647475268, "uuid": "6d536b11-c65a-428e-8b12-ef6eb0bcac2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475268, "uuid": "dc70b6c1-1b60-4764-bb14-c95d90743c68", "value": "emotet_exe_e5_1a31d713ea599a2e5cc1bc12a6437278122058e575a35da4ceb29a33e93ecfef_2022-03-17__000055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adcaec65-a614-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647536828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536828, "uuid": "f7178c49-d06b-4936-ae5b-7f1d718cd9f4", "comment": "Malware payload (RedLineStealer)", "value": "c1963e34f46302f0ccb23d6db7739321", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536828, "uuid": "df591a3c-0bd1-41f7-9f8b-3ed6dcbc0fcf", "comment": "Malware payload (RedLineStealer)", "value": "1aa65b44ffb9d30b5ffdc247ed2f65b55fc73a39c9ab98e63ca0340d4774af6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536828, "uuid": "20521e41-4d40-49a2-aee9-7d917e284f32", "comment": "Malware payload (RedLineStealer)", "value": "53830da7408a09307a15abf8bda155f5085b77a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536828, "uuid": "e25b2dda-bf37-4967-ad5c-3bd77972f0ad", "comment": "Malware payload (RedLineStealer)", "value": "febc62d76ef21bffb639d625b01678f46f3e5fdd8cf04bce5efae5ac797879e00fc892ff70053dd762ca98c1aab34d9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536828, "uuid": "b3a6409d-fd90-4f48-8872-c65e91ea6f21", "value": "T177A35C3077DC9F19EAFD1A7564B3011443F1E08B9092FB4A4EC4A4EA1F67B42592BAF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536828, "uuid": "2cb08cbb-9695-4e23-a503-68a0cf9dc2ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536828, "uuid": "5abb715e-6664-425f-8f4b-b58fbf34c5ef", "value": "1536:h907XL8Te7lbG6jejoigICyYLB3UicrMFW08UAiqumbfcxv0ujXyyed1K3teulgj:knmeRYCciRWjUA57C0ujyzdNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647536828, "uuid": "3911cef1-c255-4604-84a9-028be9f13db5", "value": 98816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647536828, "uuid": "5c381a7e-3d2a-40d0-b548-507b2316b40e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536828, "uuid": "0cd55d55-90cb-459e-9999-2e512b234128", "value": "91076155.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f18d7c-a5e6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647517092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517092, "uuid": "416a8e03-5302-4189-9053-c3e4a460c0e8", "comment": "Malware payload", "value": "badde409ed0da8f539c400432153e55e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517092, "uuid": "5945f5f4-e35c-4d01-9c56-0dbb15d9debd", "comment": "Malware payload", "value": "1acbf046327127102d1dc6ead02cdf58af115ba1bf877b370a8c14ab69676bf0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517092, "uuid": "b8e44218-9b2b-4917-8bee-ae074eacc841", "comment": "Malware payload", "value": "150ef3a6a56d5773769d4eb6c000f3a6f993d08b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517092, "uuid": "7e469828-e3d3-42e9-b4a5-44a862e44098", "comment": "Malware payload", "value": "ddcf1f6b12f000903e31cbfc59a4049d96cedcea227d3df8106dfa55017dcd42eef1d5ed5351ac692aba27be086a4438", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517092, "uuid": "2bc0c9b6-d0e7-4e7b-8476-a6adde33d01e", "value": "T1C405160D7F918F79FC1D017498DC9B79AA99EC3B4AA04F062ED2EA7ED5B71424C08D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517092, "uuid": "3db978b6-0b1d-42b1-bb64-8964e89b19d3", "value": "e140b4188c69c3bb4852b94813f9ec7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517092, "uuid": "2f88846f-69f4-4e5d-95ea-7052735bf2c3", "value": "12288:aA9e3OrvpgqjtQFect6dddifiHxoB3rNd9CDZv:blrvpgqj2FeCQc3rLoDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647517092, "uuid": "787a8f9b-2ec8-44e6-ab9c-ca9154e160bf", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647517092, "uuid": "d1d206f0-a616-434e-820d-32f68d20e558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517092, "uuid": "b8ecbfa9-e8b4-4392-a764-3fc9886219e0", "value": "emotet_exe_e5_157109a7bcf72f8d42f6ba85394aff464754677816554951f04012a3fb034f38_2022-03-17__113805.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffce7d0-a64c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647561018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561018, "uuid": "4bd290a6-1942-47da-ab42-75bd5030104e", "comment": "Malware payload", "value": "b11cbeb5f4f4205b2ab13a633fa33964", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561018, "uuid": "d5313761-108f-4e87-b728-91257c8d9398", "comment": "Malware payload", "value": "1b4667bace48a2c01876269b182f0e4877b9f3d9c50aecedc8c11deb62903ebe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561018, "uuid": "c5238694-5a82-4f21-9292-15804caa8860", "comment": "Malware payload", "value": "c5e1deb2d40aaf78192582dcea4f1f480a3edd31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561018, "uuid": "46eb97cb-01d8-4fd0-9ee8-ea90de455127", "comment": "Malware payload", "value": "1ea456b001ba4287f59ff4c6b189302b113d5291e3ce32c231b7574467038c34357f6518cb4ea8e87072149ed09a8786", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561018, "uuid": "85adaedf-c82a-4030-8289-a2cd9e225aa0", "value": "T1112301CB86844B09FF41767B40288044730B9242D74A35D49366F98EBBD91ADEDBA7CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561018, "uuid": "dbb37ea1-de45-4567-aeec-f62b87ea8f43", "value": "1536:IsaL1ipt4HxgWQfIWYlP6rzV9g6zMlwpy:FeipGQwhErzVrglB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647561018, "uuid": "959676a9-d82d-4035-af60-f7161f5c4cb8", "value": 49336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647561018, "uuid": "a897eb8c-06ee-4abc-a6e9-035466c8aec9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561018, "uuid": "61dc8591-bcda-4bba-95fd-e8b1dc860396", "value": "b11cbeb5f4f4205b2ab13a633fa33964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda84fea-a611-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647535566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535566, "uuid": "b472ad4f-ee63-4c06-bc68-893391fd4ab2", "comment": "Malware payload (Heodo)", "value": "0c19da3bf6ecdfb5a2353526e0e3e2cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535566, "uuid": "0456d133-b841-4f90-af03-09907fd253b8", "comment": "Malware payload (Heodo)", "value": "1ba8eec96ee72adb2a59d4f569da159e791fbddf24d7f9b39ca7d78673e2e7fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535566, "uuid": "c8a601cf-4715-4766-ae60-8da6b09a1fe4", "comment": "Malware payload (Heodo)", "value": "afc66f3a2a0e804da5b977adfdd11baabf040a39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535566, "uuid": "53c0143d-86f3-4ff4-b38f-d27750c06916", "comment": "Malware payload (Heodo)", "value": "57b2388378280e17ce44f8a891e163baf2ebf2907c52395d7d0259bd2e2ce8b0b0cd416f8adc98ddaef2058efd9ec496", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535566, "uuid": "a3fff1e6-e6af-4db1-8e83-64a14f60125b", "value": "T11F059F7A2B43F27AC7E50DFC186002981A75BAB2C7F764272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535566, "uuid": "c13aa190-b74a-4183-8a7a-44cc43cc9d2a", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535566, "uuid": "ada598d3-b7b8-408a-88a5-8f919ab7b594", "value": "12288:KVHML2QJe6XxhqCW2QHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqOQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647535566, "uuid": "2290fff3-83e1-40ea-8c3b-2ca75722340b", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647535566, "uuid": "92897c21-6bd0-456c-90ca-50984292caa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535566, "uuid": "26dd1249-245d-45b6-83aa-ec6f64eb1ed1", "value": "0c19da3bf6ecdfb5a2353526e0e3e2cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006da4eb-a600-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647527947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647527947, "uuid": "c271be33-c872-4929-b2d8-3dc0313a4114", "comment": "Malware payload", "value": "bd8464e7e8133ec4845ebec0ebda94bc", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647527947, "uuid": "d9e03653-e44a-454f-9764-ac3e9e866a94", "comment": "Malware payload", "value": "1c0c6bf72192c4629c8ec36943e495fd8807003f6f09c6038bd368129ff05ad0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647527947, "uuid": "bace59e4-6d92-426f-a4f3-1fd39f1ced2b", "comment": "Malware payload", "value": "cfdff169f841b2a66da3477cea65331f46ad4d65", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647527947, "uuid": "77d5d969-b6a8-4f64-a31b-e6976bf3da6d", "comment": "Malware payload", "value": "b0e294b63066109fb648ad56504d299f711e4a703331c528e64019d98202831d67b2915c27881145223b320111ed2979", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647527947, "uuid": "65e1fc1c-5be7-4402-9e32-57ed8188fbda", "value": "T10465BE87E785A96FC6F392364637466A16068C2A8B93D7874B54F23C0CB75D04F86FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647527947, "uuid": "ce010a90-fbb5-482e-acf0-75acb94f25a2", "value": "24576:XWIs1w/AOfG0BRYQ8ors2EYJwjFVN7lrghRQl4dgImVzAO:fs1w5G07hrEYJwpVVedgImVMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647527947, "uuid": "9f67cbd2-968b-47d7-bff3-ab4d55accc33", "value": 1506522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647527947, "uuid": "d1555b15-6a36-4bb9-b60b-d2908475f431", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647527947, "uuid": "e597b763-e4bb-455b-8e5e-b6d11bf24443", "value": "BancaSicura.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bc540c-a647-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647558551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558551, "uuid": "1d82abf0-4a91-468c-9862-dc0051616dbb", "comment": "Malware payload", "value": "3f68ace720ce451caa49cb166dfc9904", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558551, "uuid": "f16a5e6c-2103-4a3e-98fd-9fb83a3ca2aa", "comment": "Malware payload", "value": "1c1a4858bfece99167cfea395d94073ab7494d57ab8454a1c278f06eb1742d7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558551, "uuid": "e63afea8-6ed4-4e78-a3c1-59a9ecc39279", "comment": "Malware payload", "value": "bf07934f5e7487df3d9067b0acf5816c2e83f809", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558551, "uuid": "85d2eebf-9a82-4ce5-8795-2cda4172c12f", "comment": "Malware payload", "value": "32033d355f80ec5b607db632bd14019b9e15be6f6e12c333ee01c013df0c52347ad4571f889f61bf959c143d0dfcc437", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558551, "uuid": "2a5c503b-aec3-4e3e-a9b1-41928946a43d", "value": "T1F5059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558551, "uuid": "337a2374-6283-4ea7-b995-a47debd2f25c", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558551, "uuid": "9f742fc4-f28a-402e-b3dc-f91edaeb1d58", "value": "12288:V20BXOMcVzpWfmmnDDdX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDpX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647558551, "uuid": "b8c33b0b-2a99-4328-a5ff-27d0386014d0", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647558551, "uuid": "3c5d6e7a-90e6-44fd-8736-d4ff29f6c10f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558551, "uuid": "ab3f4dc2-d9c3-4dd4-aad9-744ed210ae71", "value": "3f68ace720ce451caa49cb166dfc9904", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4c41767-a5e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647515821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515821, "uuid": "54263e54-bb6b-4f18-9055-e29758cff35b", "comment": "Malware payload (Heodo)", "value": "9bf5a035cf1e3b77a2eb2ac8fc0539c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515821, "uuid": "2c79cf0c-9205-46db-b84a-49771d816748", "comment": "Malware payload (Heodo)", "value": "1cbc4cc748b9cf507974bfe8aa349d23b2176efe5c0a01792a68f06b60692694", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515821, "uuid": "7e3fc91d-d37b-4709-b037-1e76a94fe81b", "comment": "Malware payload (Heodo)", "value": "3dc17f7db83c3730ed356a4976659cebadf90d28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515821, "uuid": "da06b5b8-cde3-4406-9d21-36cce9aabf62", "comment": "Malware payload (Heodo)", "value": "549ab89aafd327b793d6aaa72444e5e04ab4fa9bcad4cb91e38fe71edaab3b618866465c8819d01722f4027a6c6790ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515821, "uuid": "4e810ccf-985b-4892-88a6-04056f9b1df9", "value": "T1C2058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515821, "uuid": "ec1526b4-57b6-45de-8437-c87debc52332", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515821, "uuid": "cda32eb7-380f-44db-9737-ff17af5219ac", "value": "12288:Wvz1CLJyyvmMLSrBg74ruGbPlVpqb+DlYzv:WJCLJyybLqBO4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515821, "uuid": "5f055190-2c93-4844-97ed-829cd22bf2bd", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515821, "uuid": "3edce841-3fb7-4440-8e25-16b8d0b606a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515821, "uuid": "a0146c9a-ef94-4e26-aa08-e9175239ea16", "value": "9bf5a035cf1e3b77a2eb2ac8fc0539c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ac1025-a632-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647549698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549698, "uuid": "40ab8ef2-c6bf-467f-92bc-84e85f587744", "comment": "Malware payload", "value": "e209664bcf1b207e5fab28372a4ffbde", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549698, "uuid": "5b1e19aa-4648-46c5-a9fc-824d34c5e298", "comment": "Malware payload", "value": "1de43abb093e971324145f002957b418967d76c3e4aa1e9a779c51562091db06", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549698, "uuid": "d2670b50-82ae-4802-a51e-5a65feadbd2e", "comment": "Malware payload", "value": "bfe652fb5df944804f6d1cfe0f2e87293eb8cfc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549698, "uuid": "fc2239ac-0bfd-453d-b38e-bf51b7a6a824", "comment": "Malware payload", "value": "7e0cd76b14c950cc15de9a1f7472ca0425f4191cc9a527e2b31054646194e5c4f56b7c05a0b24f555f77d3373129fc16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549698, "uuid": "d86eb55f-25fa-4efe-8701-18ab3f159198", "value": "T1F1C43B017896603CDFDA363601F7EB2531E75CB0677CB52E6EC168EC9B2628A051D63E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549698, "uuid": "f5e9d305-434d-446e-b67b-08ec4fb483c3", "value": "fe91b35dbbcef6d3f3836ad3e8b836df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549698, "uuid": "bb1ef52a-c08e-4188-944a-549765e85f21", "value": "6144:xe4HnxyzcUzcUin5jBd4hp3CBj6O7O7OOuw/RRRI7E7E7E7Z94kx8888rLCkxEZq:56Kv+tEgqsdov6eimJEeTN+sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647549698, "uuid": "9889c002-a530-4346-935e-6c8c752f51b6", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647549698, "uuid": "08162d3e-b975-410f-9ffc-51d65bcf5d00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549698, "uuid": "0ce8a799-fda1-4d81-bbb3-3a3ca3f18e7d", "value": "e209664bcf1b207e5fab28372a4ffbde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc25fcb8-a5c5-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647502949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647502949, "uuid": "be12e56b-231e-432e-95b9-8ba069aa0407", "comment": "Malware payload (AgentTesla)", "value": "a5bd116c7e0c6a86435cf75a23680620", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647502949, "uuid": "ff0ff824-969f-4f51-8179-7c2d3fdfeffb", "comment": "Malware payload (AgentTesla)", "value": "1dfdfd9a9f3a939ba57dd6da3d0806470985fa63b8592093fea5bc9bffe535fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647502949, "uuid": "0b959f15-66df-45bf-b9ce-91fd95a58ef5", "comment": "Malware payload (AgentTesla)", "value": "55dca5eba5924daab550194ae2358298e22a72a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647502949, "uuid": "3fe79a20-40c6-4be9-918c-402115d548e1", "comment": "Malware payload (AgentTesla)", "value": "d5e79211e458e3c609601c37ab2783b059b7f52faa81679ba7a3f23591aaea564b5355a568cd646232f055ba6ae4d263", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647502949, "uuid": "325e7652-82f0-4432-8ac3-9bb1d582dd6b", "value": "T14BF45B89F11065EDCC1ACB309932CC38DEA27DB9973AD11E14DB3D6B3BBE6874914462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647502949, "uuid": "b16379a9-a2b3-41f8-be28-2ef6c0dacdb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647502949, "uuid": "5d1fad84-493c-48b1-9a29-42c74e9f157d", "value": "12288:URxN7d8EDJOBG4MlQA2R4MiljJGhuYbH2pxnUSF6MJMyRUcZ64cQlRpKO+7GsP7Q:YBVOBTAhM6AhuYbOUx1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647502949, "uuid": "c8232dd5-5eb2-4ce8-b80c-e1314630ba3e", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647502949, "uuid": "4bd32bae-5a93-45a5-9115-aadffdc43482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647502949, "uuid": "312c8088-27f9-4692-9d29-065696115ed1", "value": "INVOICE n. 1712.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b886fb41-a5ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647498191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498191, "uuid": "bfa202ac-63f4-4a20-a5d0-3dcb61e2c95d", "comment": "Malware payload", "value": "b10bfe37387f2436a74e32aeef9d57c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498191, "uuid": "952414a5-fb78-400c-912d-75142a8f9b2d", "comment": "Malware payload", "value": "1e9616c5c55cf1304d8e18e39af5c7e0505db83edcee175daa0f0ab22c0abda2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498191, "uuid": "c0e6e193-5361-402c-a921-84b795e37eab", "comment": "Malware payload", "value": "ffffbb2dbe59f6a07d2e40f030206fe741c27e69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498191, "uuid": "d46075fe-b921-441b-9326-6eae3b9b1e51", "comment": "Malware payload", "value": "85140c357161a0536d0eb84749b7eb6ff2aa0bb083e018c3a83f27508edf5aff6da76cdb46489ab5cc66764e18832a18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498191, "uuid": "835b1855-c458-4981-86ac-ad771ebd5342", "value": "T166A63314A3401CE8F1E2103275A44925D57678324760EDCF6B64A22A9FB7FE1BDBEF90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498191, "uuid": "4fd84f1e-d4b6-4d12-a66f-02cae4258202", "value": "c5640c7a22008f949f9bc94a27623f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498191, "uuid": "a7b4bb0e-7c7a-42af-bb64-a24dc5edaca8", "value": "196608:+0l4XkYUGx7/ICteEroXxWVfEqlbkkwR7VTEiwYgFr1v8kmXmVDXTjeWZo:V0XUU/InEroXgfEqirRRozYgB1v8kJVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647498191, "uuid": "c5235deb-9618-4ee2-b273-36289df8a1a8", "value": 9706117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647498191, "uuid": "07097e9e-2d2c-492b-bdf6-dfe37e5e69aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498191, "uuid": "023f3f2b-fcc5-4afb-b77a-a789d5f2f038", "value": "95229395.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7972be15-a621-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647542324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542324, "uuid": "1aeda024-6490-4e10-a28a-781c795df70c", "comment": "Malware payload", "value": "c3063cf5a122f535f5621334b7226992", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542324, "uuid": "cba87025-2a74-4fa6-876c-078f739044ef", "comment": "Malware payload", "value": "1e99e54d1791a745f622e3207e25ed3468e81552e5a6b3d1576d0f3e7cd1aab0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542324, "uuid": "ab3cddbf-464f-4c26-9522-e7701d28cc07", "comment": "Malware payload", "value": "1c21b88d95e9079500498dcb0134b41c28d4fe3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542324, "uuid": "2c32ae51-1d03-4c12-b566-824b7ee3a7fb", "comment": "Malware payload", "value": "948c9c9e630534b2c79273daed42b4ac23a80e0c5f5fcad7d67e7e985041a5583b1edd8ec7c4e349008d56c03a771f97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542324, "uuid": "23743dc9-7a53-45af-93c5-7f14c2cfeb7e", "value": "T178058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90117EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542324, "uuid": "e9436333-1802-4d68-9173-1a49e57a0c1a", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542324, "uuid": "da0d2065-fd4e-4d02-a4d0-1b8d5cb1a07b", "value": "12288:Wvz1CLJyyvmMLSrBgX4ruGbPlVpqb+DlYzv:WJCLJyybLqBm4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647542324, "uuid": "c7c4ccc4-0faa-4dca-8c7b-ae663d06da35", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647542324, "uuid": "9e6e8d0e-87bb-481d-90f0-79f8a3e662ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542324, "uuid": "a8eabdbd-527f-4cab-aea0-6ee887e5ff86", "value": "c3063cf5a122f535f5621334b7226992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006aacfe-a5fd-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647526659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526659, "uuid": "9a6c9f7f-147d-4b50-ba3c-809aced2c9d2", "comment": "Malware payload (AgentTesla)", "value": "146a054e7e18dab39873496ca444b782", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526659, "uuid": "968f4ace-94a7-42f8-8779-b32146596d38", "comment": "Malware payload (AgentTesla)", "value": "1eb4d690d116a9129704cc98c4cb900a399ae26c601bf9e8764aa713c01250b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526659, "uuid": "be63a61c-d03e-4d7d-960d-a57242affd40", "comment": "Malware payload (AgentTesla)", "value": "77373d24a1d5577afc8dbee881e92e0cc5140a8c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526659, "uuid": "6533ee9d-ae61-45b3-8b25-c90b478046ef", "comment": "Malware payload (AgentTesla)", "value": "064e72c97870af9f64b86ca375a5b28f42f0ca7332a850d359642b4614078c4f20be0463d359c2fb46f0de69ef80845d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526659, "uuid": "0b46a32e-6782-4f64-8397-9660d91c6610", "value": "T1A3C49C7E59696373CA7BD7768650102AF690C1EF7902AD08EED31B800D171CA7FC5A2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526659, "uuid": "9a7643dd-271f-41d8-9ed6-444d6b6a357e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526659, "uuid": "9bc14c84-d9ae-4a53-b7b0-b6470e0449bb", "value": "12288:wky28F7n3mcYtJyU2JsKZsB1LQu1aJ1K:wQ87AJyVhs8KaJ1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647526659, "uuid": "45cf126a-e8da-4448-9d24-b001dc409e2c", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647526659, "uuid": "f7f434f8-d295-47fd-a735-7fe0c19e0825", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526659, "uuid": "e9eca1e0-7344-4b79-ab18-bba3512e3e9a", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fb3a67-a5ca-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647504977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647504977, "uuid": "6c525b51-11e8-485b-9ef4-8eb899e0e80c", "comment": "Malware payload (RemcosRAT)", "value": "b84ffd21f06c979629dc0fc025187b3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647504977, "uuid": "9001dd2f-8f4a-4b93-91ca-68940c278fb1", "comment": "Malware payload (RemcosRAT)", "value": "1fc33c19e24de2eeba58617b70f2a383907fe334ecfbf21f3c5b423a31d66170", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647504977, "uuid": "d5872bdc-53d9-4d8c-96b1-965834e76260", "comment": "Malware payload (RemcosRAT)", "value": "b32933c8c66b44e30994e89671b38f8943b85755", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647504977, "uuid": "12ff443e-cd4c-4c73-85ed-2832c9160ec7", "comment": "Malware payload (RemcosRAT)", "value": "904a53d3374a3bc2ce4676f29ef402102242417c75cf7a29a7640ecadf63315f36a6084958b35a5d0a48e2f492f5c6f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647504977, "uuid": "8a0e7bb9-a2cd-4414-8480-4cd04a64a604", "value": "T10D3401613720C86BD9B24735CCBC89F79AEAAE21D8E62E0743517F0C7C357A15C0DA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647504977, "uuid": "f20a49f3-1fd5-42e6-9de6-362b2e0e7add", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647504977, "uuid": "bc5ec75a-e931-4025-a2c8-ebba8be0cc82", "value": "3072:bbG7N2kDTHUpouY1rtp6MXXvTxIYOe1qRdPKa9cW1JvBq/NaQb1PqDhRBGh4WhWF:bbE/HUA1rt3dOcaa+U1ylG6WhW+BbfOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647504977, "uuid": "b28787be-f3b6-485c-b3b9-bb51f4da93f5", "value": 241328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647504977, "uuid": "a6f6c339-e690-4746-8a42-bf71b17d7e2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647504977, "uuid": "949cd01c-ded1-443a-ab15-175e0887779d", "value": "Shipment Document (BL,INV and PL)...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776d14f9-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518698, "uuid": "9b12728a-03d4-465f-bc91-58e8e85ffd66", "comment": "Malware payload (Quakbot)", "value": "5f4288328492c707e1d6398224417a27", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518698, "uuid": "3d39f640-7ebf-487a-bf08-d5f18e74abc0", "comment": "Malware payload (Quakbot)", "value": "20839bc89ca241bcd77ea69a2e36e40d7c1bd0dd91952502de8cd1db6fe771e1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518698, "uuid": "1cbb5732-1e37-48a7-ad97-3e12977126ed", "comment": "Malware payload (Quakbot)", "value": "1af7047a115c1d098d3d5e1ea82580d7ea79b606", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518698, "uuid": "5a679169-0c4f-4610-98db-98d1a54b2ac6", "comment": "Malware payload (Quakbot)", "value": "456b2dfeb956b7756444fd7a7158681c0aa689f1dea6ab177e4aff0d8f115cca96c62fc4939514dc34bf04781243c08d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518698, "uuid": "39487e6c-50db-4f6a-a632-2e6917f2f851", "value": "T15715BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518698, "uuid": "a539192b-39df-49aa-a665-a44ddd822eaa", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518698, "uuid": "e883e992-0e18-439d-bf61-dda512679a36", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5HM:h6toeQJ+rAdDa7alpiGM5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518698, "uuid": "acf4d88e-c937-4437-aafd-758ab30f1ec9", "value": 930200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518698, "uuid": "2e3f6fdc-721b-4f99-9bca-a7aa2a587b99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518698, "uuid": "0649f119-3e74-4aac-9a3b-a6690351ab16", "value": "20839bc89ca241bcd77ea69a2e36e40d7c1bd0dd91952502de8cd1db6fe771e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81d8e23-a5e8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647518001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518001, "uuid": "a5432a88-99b1-41c6-bc92-1ea6ceb16a1d", "comment": "Malware payload", "value": "805874eb17894224cb0b4dbc9bd6521d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518001, "uuid": "8b2a6cf2-f67f-4c23-979e-bd6b89785974", "comment": "Malware payload", "value": "20a8843be4c743750ee184a3d9a8e1f60aacdeb57be1fe41a9b7a800eb8bbda9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518001, "uuid": "de8a3de5-2226-40b2-8338-82ab866e85e2", "comment": "Malware payload", "value": "50158e5d9ffd5bec597bfcbf2cfd7ace2820a0fa", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518001, "uuid": "65639b10-eb99-4b47-8b73-368df79e4306", "comment": "Malware payload", "value": "49a04cd9b8573be678e2cb9d5648e52138dfd72546641f401ca25029d7e9a21abb27120b602b031fa9ffdf7e7c4b83eb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518001, "uuid": "b7f958e5-a0db-4ee8-bff3-c8aee772071b", "value": "T1DB462386FB85E85EE9F3C7380B36866B91068C97C753D3474955717C09BBAD08E82EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518001, "uuid": "b7200a2c-3ed5-47c6-973b-f866cad9c645", "value": "98304:V4mTNQ1zrDBwMMFaouayKfixMQvdGZfaIDbk1bWXxVeC8pV/G8bNHahR4TeMf0KI:VfTiNwrsouaFAvAtdvk1MzMHvpahR2xM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518001, "uuid": "04c6461d-d942-43b9-883c-ff58be7a55f4", "value": 5478222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518001, "uuid": "aaa07974-9903-4a53-a80d-b6c7ebd6fb54", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518001, "uuid": "86310e9a-624a-4ca9-a1cc-333422a6e86e", "value": "postbank.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a306071b-a628-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647545400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545400, "uuid": "bfa587c8-f089-4a29-a5ad-f5cacd516b02", "comment": "Malware payload", "value": "2abaaf649c7c6ef1275a4d949f73af4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545400, "uuid": "16ff1a00-9cc9-478a-9d33-79cf863dd337", "comment": "Malware payload", "value": "213d8b0ab8536a69c31ff9ed88d3b10b7829d39a114a25e1fb1e502dd19eab4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545400, "uuid": "149a2c3c-d4e5-4c3e-9b48-5d067f8a8a0e", "comment": "Malware payload", "value": "7dbeca4496115b4a1579d67df4cb912c163b9f6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545400, "uuid": "bb12bfba-8356-42a8-ad70-200d64067651", "comment": "Malware payload", "value": "5b1607b84bc1c28cb111d1f38c8d6599766240f06934b9a823033189ee5bf393370949f027b888ca44ce92340bb762f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545400, "uuid": "294f2c4f-1232-4125-b4ca-fc196adcf165", "value": "T1BE8533E7D4261400CBEBD3B86201258AB0A65C13766EDB1CC1651FB68582FB0BF5E7DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545400, "uuid": "3ed01b6b-95e5-4756-9716-0c3ddccf2f6b", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545400, "uuid": "3ec468dc-1ab4-449c-94c7-0224389b681f", "value": "49152:GHKtDsWxv3YSCkf4DZTG9aO3r5lzSjKidNaWet/c:GqtYW93YD+4DZqkO7XSdFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647545400, "uuid": "5dc719e3-89ca-4358-8053-9b13a2a112cb", "value": 1716224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647545400, "uuid": "5b5546c3-6f0d-4026-8b71-095e8b96deb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545400, "uuid": "0017c921-c0a5-402d-9626-984396a86d99", "value": "13111105.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a80a34-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "d91db547-eace-4d96-87b8-e6d0eb0ff9c8", "comment": "Malware payload", "value": "fea3f0e57ff20d079a2c031711ae6da9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "776c34b0-8368-4038-8853-16c558f07a7e", "comment": "Malware payload", "value": "2150c8f8dd5d9b5fe1cabb2458dfdb38a69ad3d6ad95a93ab552ff178a03c156", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "ff6c2d35-8478-4f29-9542-f90715909428", "comment": "Malware payload", "value": "8a12584e81398fad89c150f48ca7d2dbf3c30c0b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "49ed97f3-f8a5-475c-96f8-d135101566de", "comment": "Malware payload", "value": "09799f41e1f48ace433c8447925dfdab7e0aa1bbe9ae9231d84e068ff8e8031fc3662f5673495d9533ac3db11b999a5b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "a0c9f301-995f-4ed8-a999-5a5fdd5be17a", "value": "T1CC059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "3cd72da3-61b1-46d2-9e67-77a70f7a989a", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "7c116dc1-bc50-4368-bd14-1fb44d5e853d", "value": "12288:V20BXOMcVzpWfmmnDDHX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDjX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553505, "uuid": "bce271e5-b1ae-49ad-afec-fb32113ff00b", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553505, "uuid": "c897b839-c1bf-447a-a6af-7f6020b3a2f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "5cf99693-6abb-4340-8c8b-2d8dd95c7164", "value": "emotet_exe_e5_2150c8f8dd5d9b5fe1cabb2458dfdb38a69ad3d6ad95a93ab552ff178a03c156_2022-03-17__214456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6dc1d0b-a60a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647532522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532522, "uuid": "1c307e05-f5a2-42ae-94e7-a0a6c42fe5a1", "comment": "Malware payload (Heodo)", "value": "c9df4ba263903e26187b76f8a1680a95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532522, "uuid": "9b74df9d-592c-4d09-b302-a0d72174685a", "comment": "Malware payload (Heodo)", "value": "215e18958378d559db90a6b9e171ea423bd08e17a75ac67f1337e21dadd845be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532522, "uuid": "287f78a5-eb74-4d63-a40a-98e50b09c0db", "comment": "Malware payload (Heodo)", "value": "8f50e1f36cbc1b3f78dd816907b9d9f646063a9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532522, "uuid": "28ac295f-0424-4b90-bf55-001e05cd901e", "comment": "Malware payload (Heodo)", "value": "aa3ab4787c4faef38929bedae4c9a20011f6182df712bac550c6de45a922f44e054c9e352f0f49b5d6553b20449c8aa6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532522, "uuid": "44d3f77d-5f75-49be-b9ab-dd35fb8a8c8a", "value": "T1E6059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532522, "uuid": "ea3ce84f-c8ff-47dc-9c42-3856de5a1d96", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532522, "uuid": "46b66250-5319-44bc-bf42-d62211946601", "value": "12288:KVHML2QJe6XxhqCWcQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqkQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647532522, "uuid": "5f712420-0d99-4e26-8f2f-7b5cc0ae0289", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647532522, "uuid": "7cedd40c-d5d5-442d-b751-fba2d5649563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532522, "uuid": "652dac1d-676b-46f7-8503-d0108cbb79ac", "value": "c9df4ba263903e26187b76f8a1680a95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd4f5a4-a617-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647538224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538224, "uuid": "09284f68-d6ba-4d1d-841a-643ad8efbe25", "comment": "Malware payload (Mirai)", "value": "44e93a9e86f3716695fba8b80229a9e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538224, "uuid": "2159459a-6ba6-4f59-ab20-afffd1bc50fd", "comment": "Malware payload (Mirai)", "value": "21e07e112bc70d4d5b90041f6ea7fad23c7cf6e9203a4e725cd0e8de54bb53d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538224, "uuid": "0ff8e66a-9075-4986-973d-f89e63bb035d", "comment": "Malware payload (Mirai)", "value": "64b73bec91012d66f9ec5324b76610bea4176ca6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538224, "uuid": "69889802-0540-4244-a6ed-0578273b03a0", "comment": "Malware payload (Mirai)", "value": "e7031ce93cec1ddca42befd2a0275b3a106df92408fbd9ce3c3f8366143c8b1b29c8420396dfb570d71d6674dff8d581", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538224, "uuid": "03d47a41-f269-4139-9224-565fdd233e2a", "value": "T1AFB2D1C8C82E9811DD7D533F629923FE187C1544671EF361694D3E93B16A92B0B3E892", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538224, "uuid": "d3a222f5-1e95-4e7b-ac45-25a581598ebd", "value": "384:MB7WPrUn+AvvVBfwiCZnVFVdZErRH40CP0iQQvJBkM+w2s7idK5dQWMqTEgYLHhX:2SjjsfwXtVPnEx4KCt+w2IiMp4jT1Kw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647538224, "uuid": "fb0c14c2-5414-46d1-a0ae-76c4fad46aed", "value": 24596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647538224, "uuid": "9ebe7ab9-c113-4ef0-a642-c727919e17ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538224, "uuid": "d413b364-e974-4019-923f-443a71f8ffbf", "value": "44e93a9e86f3716695fba8b80229a9e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2003d840-a58c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647478179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647478179, "uuid": "67c88956-ab76-43e9-8773-d85fc7ccba7d", "comment": "Malware payload (Mirai)", "value": "0641a0cb93e1d089e20170387534c150", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647478179, "uuid": "e9c58740-14db-42a5-b2bc-28df8f8611e5", "comment": "Malware payload (Mirai)", "value": "220935a9c5f6de63ef0d7c63e6f9ba3033e962854ca1911e770de2578d3d7e35", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647478179, "uuid": "102203e6-8820-4630-8d14-f103a3b84942", "comment": "Malware payload (Mirai)", "value": "ff06201f1c32ede80bcdd222ccae4afa36fb8af2", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647478179, "uuid": "cd212e6b-bee6-448c-9856-82b0a0350e39", "comment": "Malware payload (Mirai)", "value": "c89b03faa35482b59284dfc8714574a11314c65379842b9894714b6ae6652ecbe251c3710962e0df7ecce0cb625f1b9b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647478179, "uuid": "fc7df7cf-2558-432b-b9a6-431f4c9fa59f", "value": "T10A836D23B491C67BC0C786FA1BDF99215823B8B91B32320A73E47DE92F179C52E59705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647478179, "uuid": "6e83f683-6f38-45e9-95bf-8aef21b64cf3", "value": "1536:U78nEACcGS1l345pdSuGS36lDGvtYGZNmA+JWOVjhHZ4xX:a8CcGS1ZqYuGO6l4tlPm/JWOVtHZ4xX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647478179, "uuid": "e3bbee10-7c5b-4a62-85c5-00a629ae15c7", "value": 82753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647478179, "uuid": "03d27623-2bb1-45e5-bf07-4e0f7a8ba7c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647478179, "uuid": "588b9b17-1712-4d54-8c1e-db119224f803", "value": "0641a0cb93e1d089e20170387534c150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e2a906-a587-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647476066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647476066, "uuid": "a8b3da90-48bc-4019-a2b3-795767033a70", "comment": "Malware payload", "value": "d08ef583b21c408cab079de16fdec08c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647476066, "uuid": "a31c9199-fca4-43c9-9daa-4b89452176b6", "comment": "Malware payload", "value": "220bfdd678aa71980b70335ef2e938223542263c53417d6c4c452ae0d0810642", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647476066, "uuid": "bfd4cf67-09ed-4492-b8a0-ce523cfdb165", "comment": "Malware payload", "value": "e707f5813a59075cdcf6bb75dcc2a5aa9ce470d6", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647476066, "uuid": "6143d849-5e65-476f-9519-094faa34d2bd", "comment": "Malware payload", "value": "783f884a5b868d02fbe098f6232f9d0c0971cf04126dfdb40c59522961127b1c00bd646a1507f568f9287a0df5bd45f6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647476066, "uuid": "75fab502-b09b-4042-acbe-476858291024", "value": "T1528523C3F2A1C963DAD782739C67664592BB0C374D43819B7A22B73C65B3FCA6351884", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647476066, "uuid": "954925f7-879c-42ae-9c72-a8fb2e58559f", "value": "24576:rk73VXGvCeAdizYM2q6v4E5Tt8W79FMtLc2zcQf0VjN6YwkWRBX1/4w5qkaB:Y7lWKZhAeNZ9utcCc/OXBN4jj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647476066, "uuid": "a27e0aa5-1b6d-43a8-9edc-8ac6a2d0d0f8", "value": 1830977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647476066, "uuid": "976e8f43-1464-44f3-b75e-ccf40240dcc8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647476066, "uuid": "d8b14cc3-fd0f-4e1f-8443-85fa1f9e44a3", "value": "sample.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02bf8132-a62e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647547708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547708, "uuid": "ed77fdbe-3fea-4c7b-b8fe-d08156f03021", "comment": "Malware payload (Heodo)", "value": "0e25d555c33462a7703a409f49877daa", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547708, "uuid": "2d1e8ea1-1d4e-47f6-b8df-08fa6280de12", "comment": "Malware payload (Heodo)", "value": "223551706f386d089cc9fd2c063407b0912fc822cdde19c021706b506e5a8700", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547708, "uuid": "fb38bd45-61bc-4f3f-ae6b-9a7038f8d05a", "comment": "Malware payload (Heodo)", "value": "310cf9af383dc0c3532b156251cd0539feb9b1d2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547708, "uuid": "0b845343-f6f8-4294-bb16-2ba7fc43bfe1", "comment": "Malware payload (Heodo)", "value": "d7e76eb456d90551a780e997d0bcbd3bc55b28dbfd9bf13a6a926c20412ccdd763fdf561cd8f15749f63001f1a9b07fc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547708, "uuid": "943cc06e-5e5c-444f-9b03-d4fe3a2a1ef1", "value": "T140A2BF3FD131DC29EB7B9C7C820980F5E60A1D46200769DD2C51F75D6AB26BB038B9AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547708, "uuid": "262bc12d-da68-4fa4-b4c9-4f021c48214e", "value": "384:SHM0Vb1GNjDo4CGzPd6ZIwA1hKb5CzgObff9kC+xbX7qE7h:n0INfo4FLH2CBn9kC+xbLq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647547708, "uuid": "0b6b7f05-eb77-439d-9d45-e1dea2f030a3", "value": 21440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647547708, "uuid": "ed321b41-c548-4e5d-b988-bf65a1e8de15", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547708, "uuid": "72cc7481-b995-46f4-ab02-1977fba4b4fe", "value": "archivo_1703.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0b5974-a5ed-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647520182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520182, "uuid": "b0ba4ec0-c06f-4da1-b9b5-c0458ecbe9d7", "comment": "Malware payload (Quakbot)", "value": "f4fd95f99def1972a1169539a83d7bcc", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520182, "uuid": "0d901d03-2257-4e66-9bb0-de85f5b2eeaf", "comment": "Malware payload (Quakbot)", "value": "2363dea5b781dee9a82963fd80601be073812c7fb4edb4dcd61cc124fc31af65", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520182, "uuid": "861cd677-26fd-417c-881b-5714baad5f16", "comment": "Malware payload (Quakbot)", "value": "dabbddbc2c2dfa7165f9a4cd5050f2dcda4f032d", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520182, "uuid": "293bca3d-1709-4e97-9e95-97ce5bb02e50", "comment": "Malware payload (Quakbot)", "value": "8e8c70ded42f7c956f39a459c290ef0c25d6060e78f87c4b28add209be852917ad2c14f7d2c4d528427d5a44523b49c4", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520182, "uuid": "6cf6f49b-ec52-4cd6-8ebe-0ef4bfc0145e", "value": "T147E312878501806FD2F07B558A88265FB27FB360C53F668B268E77DD66F010F68F9660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520182, "uuid": "d07512b5-fe25-4357-8659-7ef2f04d45a8", "value": "3072:jL70CF+Y3HGkufmzZOhfUSCKsEZhxNL6QhFKa4FIVamY9nQkuzzM14:jH0CFmOzZO1zCgRNLzf7VamkUw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647520182, "uuid": "c3f08e79-0df8-467d-9f82-1f4ad50a5b1d", "value": 147173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647520182, "uuid": "d784e278-eaac-4ac1-9a7a-f1b307f3c3e8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520182, "uuid": "5c3bf9ae-b377-4b26-b2df-58aab8d29c63", "value": "5431791814606848.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83377b1c-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "34a880ad-8bdf-416d-a61c-feb915ec37d2", "comment": "Malware payload", "value": "d19246a609686b88475938b44c4ea501", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "c64ec813-3daf-4660-8da5-80334e014335", "comment": "Malware payload", "value": "23762ec6661e21d92dd57a8514c73b420370643a0fd35ee5541330863599abb4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "209acf86-c15d-4551-ad54-cc7bc8381a90", "comment": "Malware payload", "value": "9c24554c75f9794f06dd598f2633bec4c1c267a7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "2dfc4c3e-19d3-4650-b286-c43c6896de8e", "comment": "Malware payload", "value": "64b51112d2a202bce5eddaf37ffb702cfc84f10aa191741f85546ba6d8b78b1ec7a35fd7f6c0ee7d44ed76878f5e7f50", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "f38c5cb4-a7e8-47ea-907f-38fe1fea1014", "value": "T1A3059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "4e99ee31-9b53-45b7-93d3-aea49344e36d", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "e9b43010-78a9-443e-94a1-fbc51a50ac79", "value": "12288:V20BXOMcVzpWfmmnDDKX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDmX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553507, "uuid": "842cc16f-6002-4e8d-9fa9-0e6e09757267", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553507, "uuid": "a67e1bd1-c803-4301-84ed-ef7a872eeac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "947a7552-b66c-4fed-9ee3-1ebda126af81", "value": "emotet_exe_e5_23762ec6661e21d92dd57a8514c73b420370643a0fd35ee5541330863599abb4_2022-03-17__214459.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3019bb0-a5e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518476, "uuid": "d574589c-7a67-4078-98bb-058c06b12995", "comment": "Malware payload (Quakbot)", "value": "531911a31393a80fc654597d2e7b3abb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518476, "uuid": "beb2444e-0f02-43f7-94ad-7cf1d8ea9b82", "comment": "Malware payload (Quakbot)", "value": "243ad378e3050fb1269c63045fec3fffe72ea391ef3c214541dc2a1ad4da35a2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518476, "uuid": "d2b8a2f5-9a8b-4204-8ad6-52668f988908", "comment": "Malware payload (Quakbot)", "value": "6dd255f5491a24c3bf0f5d2bfd6fe8c22ee3a60c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518476, "uuid": "7b3c3b9c-2929-4167-ad89-bbebb0bd4e31", "comment": "Malware payload (Quakbot)", "value": "765e9aabbdea7f30bf27f8fb0b3b0d40f270037d8dfc2f469604e223dfb7cda697c26ab3eb0531e565e8b54481ac4803", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518476, "uuid": "10ba394e-bd1f-4115-baa3-ae993004b6db", "value": "T18515BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518476, "uuid": "c6c050f7-9313-42eb-ad17-700355a97b8c", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518476, "uuid": "538e87bf-a51b-4981-925d-3cd544528f2b", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518476, "uuid": "0e9c6780-9418-4264-a641-dc6be3c72469", "value": 958910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518476, "uuid": "7d637607-e73b-4191-beb9-846015a7fca0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518476, "uuid": "ebaca45b-6daf-4b6b-bc64-e33048fd21d5", "value": "243ad378e3050fb1269c63045fec3fffe72ea391ef3c214541dc2a1ad4da35a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec622d9a-a5ee-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647520612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520612, "uuid": "e7c45a4f-b5f1-4fb8-9740-041fb33a2224", "comment": "Malware payload (Loki)", "value": "4b10468895a11066dc29c0ed83fe6f34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520612, "uuid": "29784f8a-10c0-4b1a-a44e-8db574fe2f43", "comment": "Malware payload (Loki)", "value": "248f62db27bb542cbd5bc7b994658955fdeff3ac0e62df6e443ef4125b111d50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520612, "uuid": "5527c278-b343-46c5-93cb-d5fc92c85133", "comment": "Malware payload (Loki)", "value": "ae43f209c567ee527adce0f21246e94552e45498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520612, "uuid": "a4f0e263-1ef7-4289-ae48-bb972d3aaed2", "comment": "Malware payload (Loki)", "value": "24a8b5a0301a499b8273c9166c5da2aff5de7b4b9d3379a20824eafdd48116b553163c598b49d1820856506d4fcca1e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520612, "uuid": "950fac75-8c67-4433-96b2-b1c177f8388b", "value": "T110642322BAD18C7BE75521332067E7B9E6AAE5D906823BF31BE81FFC1F128D111485D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520612, "uuid": "b8013871-79f6-4109-8b42-9663196fb5ea", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520612, "uuid": "d876e7f2-9ce3-45b0-b392-368de5887454", "value": "6144:rGinozFcl1Afa2Vaa9f8wyEsV1JpG9Ygd8XzUP:Miefa2nGVEs/3gdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647520612, "uuid": "90e6d27a-7a94-4483-aed6-006871d10bbf", "value": 308742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647520612, "uuid": "2107ba2f-4928-4b82-bf51-6c5267db689f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520612, "uuid": "2c2bc66b-b3c6-4b9d-b09f-db30e7cab46f", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900b1664-a5f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647524323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524323, "uuid": "6c3af8d5-4d1b-4d21-a2b3-dc5d8b1ab0de", "comment": "Malware payload (Mirai)", "value": "b3e0c9aede59cc7c21fa8615fa90b0f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524323, "uuid": "30fc2f02-eb82-4e56-af67-b3920936a7e5", "comment": "Malware payload (Mirai)", "value": "249b2759b8fabac0fe53ce6a479ed30df192745e75a1afb4e5f822442563d22c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524323, "uuid": "d6ee89ba-6abe-46dc-b2e4-3e85a255b9c1", "comment": "Malware payload (Mirai)", "value": "09454e309fb04e0e6a7fb2b60a025de3da65b8bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524323, "uuid": "30d80016-6755-4326-9c4e-594afcc8c246", "comment": "Malware payload (Mirai)", "value": "4bd38e265d83f26c60d689a875ced3ae03fe02a7643568ee477d0270b41da40bdce0ce7420b1949de3f3db4694d44025", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524323, "uuid": "83da271f-b86f-4914-9a35-46620829681d", "value": "T152C3C63B67170E23C0CA50B101E34332AE75DF8B34B952D7AAD47D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524323, "uuid": "eb48a205-1be4-4da0-95b8-370f3306a328", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqP0L7ymm/QMurB1nKGNb:SMQplV0amm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647524323, "uuid": "96968062-9091-4526-bcb8-94b40486bec6", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647524323, "uuid": "ad337010-e68c-4aac-8dc4-876f23f2a301", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524323, "uuid": "07dd2c9c-f7eb-41f0-82e4-33d34d3c287f", "value": "b3e0c9aede59cc7c21fa8615fa90b0f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6179c10f-a5df-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647513937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513937, "uuid": "a411d5a2-a76d-4356-b01d-1a73ef69d7aa", "comment": "Malware payload (AgentTesla)", "value": "ae582a9f2ee6cc13419546b8ed219507", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513937, "uuid": "0f28bfb4-eee6-433e-b589-eff82d80f6d5", "comment": "Malware payload (AgentTesla)", "value": "24c2b6ca1cf283327df60603f7dd2e62e13c9f9568c548c5a955dc5b37de28c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513937, "uuid": "cc15ef6d-fb10-4d80-a323-dd7b1fce901d", "comment": "Malware payload (AgentTesla)", "value": "7ff2d937dc5885c5c4ab1bbbf88e50f33169bbb2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513937, "uuid": "d31e4a29-e731-4483-9cf0-a0b16e618e51", "comment": "Malware payload (AgentTesla)", "value": "9a72d8ea58ba17b5ab6c40027ba52f20c81116c364a89e52c32e0c286adb62c77db92f3a9211e087b14ecda0d1526c6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513937, "uuid": "ba902a7c-ee94-4a24-a19b-030bcc35a650", "value": "T1EE4512956BE49501E3BB57B5E8A31184CBB46E0A1416C76EDAC1FBE80CF27C40E1F627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513937, "uuid": "0b46efcf-2f50-47df-8313-8a2719e50912", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513937, "uuid": "f26a773e-4c31-447f-a069-fc6dedf09012", "value": "24576:F3p9sP3PhutJPN5e8JZI5+sQvx12mxo0N2bIzXqvm4S:F3bsvJujN5Zvr21f0CTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513937, "uuid": "5f4ecf4f-3f36-410d-8f59-f1fa812ce2b7", "value": 1207296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513937, "uuid": "dc2cb945-dfc0-4923-8582-d137b82753bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513937, "uuid": "7f58e4ee-4c45-491b-af5f-37cc7d6d3632", "value": "NLLU4164636 HALICHEM LTD ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "828dba29-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553506, "uuid": "c14c490f-2afd-429d-b2bb-d33b4d7e386a", "comment": "Malware payload", "value": "4dbb844e24b3838fa91c1e317e6486be", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553506, "uuid": "07a70d0e-6ed0-44be-b886-7e35a46da1ce", "comment": "Malware payload", "value": "24d0132f070d5a8251f583d32eb8717bb6d72b0349ed4d781fe1e24e49562a49", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553506, "uuid": "7fc0db77-b71a-445f-95fd-60e71843ac65", "comment": "Malware payload", "value": "6f723758c358e19c5d90f65a5e9315b161fe422c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553506, "uuid": "d34a8768-985c-426a-85e3-04770a91778c", "comment": "Malware payload", "value": "64dc72571f3bc04ec6d86f267775a52eba84f8628f2c05444b65f00128dc5720dda47b13a4e0f214bfbb1681165512c9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553506, "uuid": "707d0e81-e157-4674-9525-4d233c2291dd", "value": "T194059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553506, "uuid": "745d8442-50ed-43a6-86f7-5308f9caa49f", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553506, "uuid": "45496bbf-b1b2-4e0b-b446-8fb4eec59719", "value": "12288:V20BXOMcVzpWfmmnDDxX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDtX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553506, "uuid": "b3a359a1-53b6-4852-b76f-eacb55efa8df", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553506, "uuid": "2abdb88f-2d1c-462c-bfcb-476253d813c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553506, "uuid": "92a270ab-4437-4fc8-a63a-871fa271b048", "value": "emotet_exe_e5_24d0132f070d5a8251f583d32eb8717bb6d72b0349ed4d781fe1e24e49562a49_2022-03-17__214455.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a903e0-a60f-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647534771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647534771, "uuid": "4875226a-45e9-4f02-b10e-b14e1e25ae8a", "comment": "Malware payload (Quakbot)", "value": "dee2fe1b5043773c67832b6700a93520", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gml01", "colour": "#39A518", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647534771, "uuid": "7d4492f0-1496-4b49-840a-5803508a4784", "comment": "Malware payload (Quakbot)", "value": "253d3235027a124e222635ff5fe9944f1be550ecda757ac2b8fe6e7499f1c027", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gml01", "colour": "#39A518", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647534771, "uuid": "0230bbbc-2afd-4246-b8b7-9986b9c66319", "comment": "Malware payload (Quakbot)", "value": "76e5a3d2f368e0285b1e79c0a78ff46852c6cb99", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gml01", "colour": "#39A518", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647534771, "uuid": "183a815f-b95f-4a78-921f-6541a02c097f", "comment": "Malware payload (Quakbot)", "value": "55de20676e148e8c4bc7af19504476c935d291a24d96ef55e3b7d95b3fb49fb78aa76ac3aa3aaaa0be67f98003cf076e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gml01", "colour": "#39A518", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647534771, "uuid": "87ed6a7a-5198-4463-a29b-f3ce11801b0f", "value": "T11084F141FA80C471D0BD5838A07489A62A7FB9215DDCDD5BA3E41AAF4F742D0D930FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647534771, "uuid": "babecca4-5dd8-4e32-8758-8404094fbed6", "value": "78d96f0c3be707d45006fd9759c6ef89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647534771, "uuid": "27dbc67b-e143-43d6-8044-8547d82e2978", "value": "6144:yEIK8em50z49eDXxbpVpabpdAQOk5uSQuos+FUtzz5KW+/gFzIdh:y1K/2UDXt38CQOk8rTjFGzzX+I9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647534771, "uuid": "36e061f5-784f-4dbc-a4a0-be9494e2fd61", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647534771, "uuid": "e4a7d99c-fb5b-4bfb-9494-01528aac29ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647534771, "uuid": "51560880-8d0c-4dd8-8b8c-a55ddcae4f06", "value": "5395601.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d445416-a5de-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513366, "uuid": "63cef3d4-e198-4463-ae94-9336a75b7d83", "comment": "Malware payload (Heodo)", "value": "fbb729be1e218b601184ab6915fd3b62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513366, "uuid": "0522dfb3-9193-4136-9bb5-bd6f0785e3d4", "comment": "Malware payload (Heodo)", "value": "2587bc4176723610530d7e822b54716149c3d40425eaf97083b4265873c6a43f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513366, "uuid": "0bd35d1b-36d6-41c8-a36c-34d19dcea101", "comment": "Malware payload (Heodo)", "value": "47b5a2d8e6fbf6bbd88d54b78c1d8f3c3553200d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513366, "uuid": "90a43038-4187-4f61-99da-a4a9449176c9", "comment": "Malware payload (Heodo)", "value": "906d94db0838192f82b27af4d58c4e50003876f8256824fc296a0aa2acb3ba15be33cc8dab6c0e52bcfd5cebfafda2d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513366, "uuid": "dd35488c-be2f-4b5b-b138-456ab14906f1", "value": "T129059F7A2B43F27AC7E50DFC186002981A75BAB2CBF764272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513366, "uuid": "fc9c47b3-1f27-446b-b319-15d50077ccaf", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513366, "uuid": "ee81ca99-6cd3-4787-8197-e95402b2feaf", "value": "12288:KVHML2QJe6XxhqCWpQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqRQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513366, "uuid": "8a60b20e-2637-4940-8eb1-6eba04903cab", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513366, "uuid": "5cafa9f9-9b1b-410d-a127-99b8f1d3d0fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513366, "uuid": "48548d35-d608-4e3c-aff0-537056b3e1e2", "value": "fbb729be1e218b601184ab6915fd3b62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf4c274-a632-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647549708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549708, "uuid": "b7ae7898-ed24-4349-b71f-56e6d9a5fad9", "comment": "Malware payload", "value": "68df4d3bddb1d03d361ff6ea62034463", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549708, "uuid": "5af63460-4572-4eca-8ba8-2ebd4a43308d", "comment": "Malware payload", "value": "25d8bf8c0f0202b88b768ce6d9ac1da61b1168f839718bfa709e5b807d6a4acb", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549708, "uuid": "8fa0c72f-1ed3-4e0a-8677-97e3d331cee6", "comment": "Malware payload", "value": "0a638820d56d2e53fc4e93d2bab0d65c62ee6071", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549708, "uuid": "01c03afc-5603-43ab-996e-e639db4f07c7", "comment": "Malware payload", "value": "45cc25330a2d76f8e0ec43027f53ad8c6b700a754942d6dacf75e0333d400a9b12cc67a13eefed635c34c4bbbaaf2e3b", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549708, "uuid": "7509118b-b230-4850-87b7-c353a615f4c3", "value": "T126D28302B7588A2AE36D4770D88BD6E4322DAE4E4C41421FF340BF3DBDB51B65A1275E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549708, "uuid": "578d98c7-a753-4232-9588-93098296205d", "value": "384:JTEwLm2BhLQNOKpVhLd0qiSY5Uh8a9Y+:BLh4Vo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647549708, "uuid": "d8f7c66a-0537-4364-8243-25258af1ea70", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647549708, "uuid": "12b77533-8657-4834-bc51-4122f1083615", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549708, "uuid": "aff942c2-fde3-4a13-bef0-6170f7ca5378", "value": "SecuriteInfo.com.Heur.23553.26522", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fd3c44-a5df-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513976, "uuid": "c43ec11e-9bc0-4807-9837-21f48c696533", "comment": "Malware payload (Heodo)", "value": "4143608452fca3f61e79ece1d7daa3cd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513976, "uuid": "81c1aefe-181f-456e-8df3-2109ebbe0190", "comment": "Malware payload (Heodo)", "value": "2667dffa6be2018618a9d36e6b66f964d200157e6bc30c781edf948139a4a76d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513976, "uuid": "09285e66-748a-416b-a858-f3c4246a6a4d", "comment": "Malware payload (Heodo)", "value": "d9a8b7b3bc0462540049d39bac86777bcac8b26b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513976, "uuid": "eca15d91-e752-448a-a4b5-2d11c4ac6c3f", "comment": "Malware payload (Heodo)", "value": "c13d3033d3755b49aaa28b1f4b488e25179116ead08c3fb35c38b00779b86b5e0fdedf26af69786dd70c1fa7373c6921", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513976, "uuid": "5f84ae8e-702b-4781-9404-8eb143c45462", "value": "T1DF058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513976, "uuid": "d6726834-d1c2-4b08-8ab1-d50c4c66a08b", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513976, "uuid": "6ac7f4f8-57bd-4f64-9a24-a5fdda65fdca", "value": "12288:Wvz1CLJyyvmMLSrBgM4ruGbPlVpqb+DlYzv:WJCLJyybLqBV4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513976, "uuid": "0c94d171-7aae-4a5d-81a2-07b070ac8805", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513976, "uuid": "665d6d9e-6dbd-4ef4-ad96-8b20bfc7b3b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513976, "uuid": "6561db5c-e54b-4989-8fc3-854ffe4f9449", "value": "emotet_exe_e5_2667dffa6be2018618a9d36e6b66f964d200157e6bc30c781edf948139a4a76d_2022-03-17__104610.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8ecc35-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518677, "uuid": "d36c8b29-c18a-4d13-8e26-2f6afb8d2747", "comment": "Malware payload (Quakbot)", "value": "291b6ad955a0d64fae7c9aafbef2ac5e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518677, "uuid": "7de28696-bf17-45cd-92b2-c82a27e9de69", "comment": "Malware payload (Quakbot)", "value": "26cb0a447ab1b430aa58713e13e8f4a8a40612862a710e8a11693119161b96e2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518677, "uuid": "2091f59b-2b4f-4323-a06c-89f54a29a1cb", "comment": "Malware payload (Quakbot)", "value": "2f964aed12de77782a27e197c89901afa32af801", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518677, "uuid": "6053e225-20eb-4dcc-b29a-cbde67d3822f", "comment": "Malware payload (Quakbot)", "value": "588273c23ec958cd432b91022bcb47e621ee93f6d5698b6a3da3dc65a8007f8c67ed731f6d9ad9f53ac1f6e906d14b8f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518677, "uuid": "e4370032-686f-47cb-8272-3e5cb61e118a", "value": "T1CD15BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518677, "uuid": "9b7b501f-8435-4d82-9730-df856b6c9bd1", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518677, "uuid": "5e7f721f-2e81-42ab-a697-b5d6344d4bcc", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518677, "uuid": "5f0342b3-683d-4979-8f8e-403b6dafd2a8", "value": 938210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518677, "uuid": "e0769bba-6ec2-444e-88d0-3c0a365c3be7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518677, "uuid": "a9e4d248-c5fc-41e6-a808-2fa84aedc203", "value": "26cb0a447ab1b430aa58713e13e8f4a8a40612862a710e8a11693119161b96e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f132bd-a5bc-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647498882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498882, "uuid": "5ae29b8f-0102-4038-8b2c-a2add7785c1b", "comment": "Malware payload (RedLineStealer)", "value": "c9884e6eff872b0a65f4177f95eca55b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498882, "uuid": "fbfd1a67-72d8-418a-9163-a4f6f5ed7422", "comment": "Malware payload (RedLineStealer)", "value": "26e6364b3cef98f5e8442767ede767bf76c75d04f39b1e216aceca3c4b1e4221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498882, "uuid": "da042298-79c2-4400-a13f-e214ca251c42", "comment": "Malware payload (RedLineStealer)", "value": "8c883aa2afdbb02446d12d90a7c4b06056cf0b4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498882, "uuid": "173f6a85-13f4-472a-bca7-b1d6e53db7ba", "comment": "Malware payload (RedLineStealer)", "value": "ed5741b2aad94c155b3dc03e89a783bb65504bc861f62068e013dc2f0957c2e7903a2cd3e878c719327c96f81de4567b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498882, "uuid": "f90a7d6a-2727-4b4d-9e4e-008cc7e803b3", "value": "T15F663302B096C172EA311D37576DAF9168B5FE991E10CB6EF3C80A5CEE201D1B215FE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498882, "uuid": "d371feb1-1884-41e0-92de-18bfe508dc07", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498882, "uuid": "765ace5e-159d-4d44-8ea8-7d17f98f52b2", "value": "196608:V56blG91napV3o0v9dF17gWWTwfrUWt+U6S:V5GyBaL4qqh6rUc+U6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647498882, "uuid": "00a4fc63-d99f-49e7-9fc8-2e6aa211b0bf", "value": 6542188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647498882, "uuid": "89916e4b-6419-409a-bc99-532cb7efc96a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498882, "uuid": "e6bfd194-f0d1-4109-91a8-2d15432a659b", "value": "91343819.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809c32c4-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553503, "uuid": "d83c52c2-8851-4d91-813f-7a1b5be7535e", "comment": "Malware payload", "value": "b5a8f966b199fc5725f42b8f2c9e9608", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553503, "uuid": "e92e34f1-7c29-4ca9-91c2-6683de9873b4", "comment": "Malware payload", "value": "26ffedb35208953dcedd4b697f21290ae4b75cf48d59cbdb8deb7a96b53607b6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553503, "uuid": "70ee697e-b0f8-49f2-b747-91c0d9a04d5d", "comment": "Malware payload", "value": "65f3297fc6b811875ed8bda508b10e514a6410b1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553503, "uuid": "da9eeb6b-8002-4d6b-82a4-d031ef36de15", "comment": "Malware payload", "value": "98353d43c695f33a4d21cf559350753856f60ee682e1725b41af20e49ca9e54a373515525070e3dcf84eb80de699cff3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553503, "uuid": "302e1151-0831-4e51-a17c-2c16060ba0f4", "value": "T137059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553503, "uuid": "cc1373de-a342-41b1-8fd6-2c2a25ab92b5", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553503, "uuid": "af5b2a27-cfe9-41de-bbf5-36ccdda288ed", "value": "12288:V20BXOMcVzpWfmmnDD1X5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDZX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553503, "uuid": "ee8bd120-abfe-47d7-9244-ea46f59902a9", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553503, "uuid": "2002afd8-f257-41c0-806a-84fe2edf8848", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553503, "uuid": "14566821-c7d6-4871-8c43-90eac09e2da4", "value": "emotet_exe_e5_26ffedb35208953dcedd4b697f21290ae4b75cf48d59cbdb8deb7a96b53607b6_2022-03-17__214455.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e3c358-a631-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647549134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549134, "uuid": "d8087838-872a-4432-8cbd-cdd0a0be5f6c", "comment": "Malware payload", "value": "764b12146d949149c39f8741de185736", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549134, "uuid": "20fbeb04-e040-4fc4-96f2-ba5593e2cedd", "comment": "Malware payload", "value": "274ad8fbc0f3995418c0e0fa4a1ed960730f77e5fbfb0b7c511651144d613284", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549134, "uuid": "68eb9538-a7bc-4d1b-9503-14f9a936673e", "comment": "Malware payload", "value": "efb3da36db908f075578b173f1cedbda6779fe1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549134, "uuid": "e0924e1a-079d-4ee1-9086-253cc1f84a66", "comment": "Malware payload", "value": "7b3b78bc7c2393c927a135b79e0cc8d888f52e983f32c07c4b842a4e69eb0fce186e6ab6fdd19a8dbdce3368f2879944", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549134, "uuid": "ed44ab17-bf5f-4971-b8c3-1bb8b4f2fdb2", "value": "T1AFC48C3E15686377CA7BD7368651142AF691C1EB7902AC19FED31B800D271CA3FC662E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549134, "uuid": "e86920f3-725d-4ee8-805a-83d26bc4f408", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549134, "uuid": "2823a7ec-8848-4c32-9e68-f80d82713ae7", "value": "12288:Oky3VJawcEu0xatjndXwJy+QoJts8XIko:O9qauwGjxbSs8Yko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647549134, "uuid": "2248c097-ddd5-466d-87df-5a2a0c8d39d1", "value": 544768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647549134, "uuid": "579c10b1-f05d-427b-9e8c-28c2aeec4019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549134, "uuid": "4fdfdb19-6cc2-4b0d-b285-38f0a8d12e7e", "value": "OFFER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b2d1eb-a614-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647536781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536781, "uuid": "b41834ff-dd90-4a61-9c52-c9119077f7d0", "comment": "Malware payload (RedLineStealer)", "value": "b0be6868269066302e0d074d71f481d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536781, "uuid": "cb8e174d-b0c6-4f03-a42b-f328b5641e99", "comment": "Malware payload (RedLineStealer)", "value": "2760f66141ee54ef8ac37f1334792b381373e0841bb1a1ae8ab503b353532553", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536781, "uuid": "834fa911-e091-4513-8551-ad0fb8e2fba1", "comment": "Malware payload (RedLineStealer)", "value": "1cb7a789c61dd62f0a180b897f4c8bfd1d30f242", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536781, "uuid": "7d1c365f-8d6c-4101-b3fc-14c841980468", "comment": "Malware payload (RedLineStealer)", "value": "3f1fca077c59078ac1eb9e97fc608865a5d1d05e64d81a2c55dff1f116aceffc4000b6f099d67956359ce2b533999ad0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536781, "uuid": "83b70e1a-be96-4051-8fce-f8c6de6076c0", "value": "T15FA35D20679C9F19EAFD1B70B4B2012043F1E48A9091FB4B4DC164E71FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536781, "uuid": "74d69303-3ff5-4bf2-966c-072db2491069", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536781, "uuid": "d4b7dc3a-a064-41fc-b59f-2554fef9398b", "value": "1536:aqsiuqBXlbG6jejoigIL43Ywzi0Zb78ivombfexv0ujXyyed20tmulgS6pw:IRilYL+zi0ZbYe1g0ujyzdow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647536781, "uuid": "ba987d96-c4ad-43b0-8e19-7d6da152cc11", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647536781, "uuid": "6e0b836c-bb1b-4325-8f6a-434d815722b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536781, "uuid": "eca4dfa8-644e-4253-8bc8-e7a871fdc9bd", "value": "73808015.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12d5ba0-a63f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647555329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555329, "uuid": "e6079c29-d108-465b-be74-6661f610c60e", "comment": "Malware payload", "value": "aac93fe51a7b28c46c3d4554459835d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555329, "uuid": "52da1fe5-f16e-45d0-9538-dc3afc21a096", "comment": "Malware payload", "value": "27d5986461c37a7039c8bb02c59d7cd758c63d8405a0637b5a530ba20e966e3f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555329, "uuid": "18ed0b02-dcab-4b8a-a85b-264b77843901", "comment": "Malware payload", "value": "92452791eb0b2436ffeb3f745031f66a17b37075", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555329, "uuid": "8063977a-18ea-4207-bad6-4baeb70252aa", "comment": "Malware payload", "value": "1e91bfcdfc3a06422f4dc4890ce565829c51e9a7048588e2336a4c2cdae3b81571195e70ebcc500444855e57bb873513", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555329, "uuid": "a28b336f-08f1-4e23-8154-ccf76fed4872", "value": "T1C3059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555329, "uuid": "c388c8ba-7eac-4229-9e5e-f3fd60c8cdf8", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555329, "uuid": "5f06e3d9-7dfa-4e1d-90ca-afc37e22216d", "value": "12288:V20BXOMcVzpWfmmnDDXX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmD7X6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647555329, "uuid": "2b1fbfb7-656e-4507-b24c-d302459ed0d5", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647555329, "uuid": "1d1a27ac-cd0c-4546-809d-918158185380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555329, "uuid": "a5d7e870-67f6-4ecc-8a39-320aee52691a", "value": "aac93fe51a7b28c46c3d4554459835d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d472c8-a5cf-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647507072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507072, "uuid": "d78ebfdb-22a5-4ccf-bbdd-63e830939868", "comment": "Malware payload (RedLineStealer)", "value": "458efd9a305541cc921d97cefd641555", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507072, "uuid": "eff18e47-f0a7-4861-b64a-893d120bd841", "comment": "Malware payload (RedLineStealer)", "value": "27dcba6461ab42586d64576760dbfe569455cac90b4b18b49cfa6f0cbcda60a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507072, "uuid": "198dc279-4158-4dd5-8a2e-a2d6199e1623", "comment": "Malware payload (RedLineStealer)", "value": "d0c2aa2d0bd7e3b75ccc2c3efce1b5c3d78bab1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507072, "uuid": "16cd64c6-6f01-4960-8f0f-170de09eddd2", "comment": "Malware payload (RedLineStealer)", "value": "addbf1e7d56acd0d5993f571c93f3ed907649fac90dd91899967a2116d303a0235a8c54d4bfe2955bf560b44d254b9b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507072, "uuid": "7fb66322-b92c-4f14-8262-0c8c7c04189f", "value": "T1F784CF40BBB0D03DF5B352F8787993A8752E3EA15B2551CF22D62ADA1634AD0DCB6307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507072, "uuid": "514ffa9a-b4ba-4d50-a440-99c62e76c86e", "value": "d79bc79af6a4b9fec8512e1b410ce947", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507072, "uuid": "7e8597ef-ff50-413f-b44d-2baa98b57bf6", "value": "6144:e80ybJzQTTpNF1vvzvlyJ5hWZ2O3PursqyLxzkb096nMQddyioF9o3v:e8hJzQvvFJzNyJ5Ef3PusLxzzzQd7o0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647507072, "uuid": "a0c16c7c-5ee1-443b-9705-e8b4713df73f", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647507072, "uuid": "ec621490-3ee4-4b47-a484-3fa81c0c08e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507072, "uuid": "9791acc3-9135-4ea0-a068-1d5da7e6885c", "value": "458efd9a305541cc921d97cefd641555.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b8587e-a619-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647538830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538830, "uuid": "1b4a37bf-2922-4332-a5aa-b66b2148b26b", "comment": "Malware payload (Heodo)", "value": "3d103253d387578495cb0f4e1351d373", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538830, "uuid": "5393c7ee-acda-41a3-964c-9084f0a2b4a1", "comment": "Malware payload (Heodo)", "value": "2837e346d6f900511771e70621e49b03b2a74b550ca7ee64088bd431825e8991", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538830, "uuid": "ea68f446-5d13-45eb-b975-ecbc27d3866b", "comment": "Malware payload (Heodo)", "value": "41ff386b7fcde2a98ff4854454c1dcf47a5dc9a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538830, "uuid": "5f0b0278-fe40-4264-a5b8-658f5db2c875", "comment": "Malware payload (Heodo)", "value": "7c1988e75dd5f8c37f15f622e2a35bc47c8d7b65517c2169c652a5f67f59b708ab70fac2c5f5bcf2c703fab5864d481f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538830, "uuid": "50e56d12-9f27-4961-9499-47c4363c1e5d", "value": "T162058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538830, "uuid": "c163297b-6a5c-4f9a-abc4-4e61ef57ff72", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538830, "uuid": "7ea83779-1906-4282-b010-cb1ae986a9a4", "value": "12288:Wvz1CLJyyvmMLSrBgy4ruGbPlVpqb+DlYzv:WJCLJyybLqB34ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647538830, "uuid": "abe8a726-c24a-46a0-a7ed-1d00710df84d", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647538830, "uuid": "02868edb-1997-4a34-a890-94f49000271b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538830, "uuid": "a9a0fb65-0419-4918-a571-4118b77ac279", "value": "3d103253d387578495cb0f4e1351d373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11869757-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518527, "uuid": "777bd5a0-bfa1-44aa-b6c8-0a20caad36ca", "comment": "Malware payload (Quakbot)", "value": "5e48d9b9341030080107f977b9ce9263", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518527, "uuid": "ea8b0ae4-ac5c-452c-9dd4-8afa3e984e62", "comment": "Malware payload (Quakbot)", "value": "2857f7b66c7300d2c37a7ce9bdbd2ea16647f8b0c32b6a3eb78c62d0ff68cd27", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518527, "uuid": "866c3620-d610-4653-a359-9f6554fcf59c", "comment": "Malware payload (Quakbot)", "value": "af04cae5fe6db5648c1378bcb8e58303430f2995", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518527, "uuid": "fa3e7f55-7a11-4a00-a5d2-f7d8ad3eca55", "comment": "Malware payload (Quakbot)", "value": "cd06804ef6cb2a44135896b83b5dc926d4dbab6333bc619b6bb31be323681772298b21bf75eeb7cdd98b47201e219bd1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518527, "uuid": "8470c1e9-4dcf-4f73-9436-4513317a3000", "value": "T1E715BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518527, "uuid": "013171a1-cc6f-4a03-a0d4-700ce15192aa", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518527, "uuid": "d51fafdc-6b4c-4a39-9fad-917441ea5872", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518527, "uuid": "3be4e67a-7b98-4d80-97d2-692e746efc31", "value": 953222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518527, "uuid": "e84ce8fc-5975-41e2-8857-0015beecd0dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518527, "uuid": "619d687f-b528-4be6-bec0-e04206f88c79", "value": "2857f7b66c7300d2c37a7ce9bdbd2ea16647f8b0c32b6a3eb78c62d0ff68cd27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d17346d-a5cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647507031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507031, "uuid": "7197ff7d-e639-4be0-a831-8f4fe776de16", "comment": "Malware payload (Heodo)", "value": "b552ebe72206f26f5820437c83e49bc1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507031, "uuid": "fb6cef84-655a-452a-8398-4ca36e1e69b8", "comment": "Malware payload (Heodo)", "value": "28ed7bd4c9f79163f6c2a1fc11837e06769db95798ad2e2d41754d911ba86aad", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507031, "uuid": "8a96d570-1828-41c1-b7bd-2eba27582e82", "comment": "Malware payload (Heodo)", "value": "f978a58f401177b38d7ae176cb79080a6ddabad6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507031, "uuid": "7d796ab3-2be8-48db-a93b-516066027f64", "comment": "Malware payload (Heodo)", "value": "c4f4c4bec41690348269c00beb97ff2915acc3f2c124395e2c621c00664b8a2de0cd1d328ed369be22816da3f6e817e0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507031, "uuid": "76a891b5-4504-459b-bd87-8d4c2e14df94", "value": "T109A29E2CE921744DE3BB683C420650FA924A1C022147B5ED3991F77D6B73697068FEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507031, "uuid": "9a9322bf-2c15-40f1-b824-00d2c78688de", "value": "384:X3uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:rsNs/zXtFCBn9kC+xbL42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647507031, "uuid": "0a4e2751-20de-48b5-b423-a7d076116c69", "value": 21657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647507031, "uuid": "8fce6d6e-b8a9-4a09-a433-9610cc8cced7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507031, "uuid": "0597a2a9-28f8-4cb0-ba57-062c15c48d58", "value": "INVOICE 17-03-2022_1308.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e378e994-a5e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647518450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518450, "uuid": "f495b4a0-3eda-4afc-867f-c2f9759dffa9", "comment": "Malware payload (Heodo)", "value": "d647b7bb5d864949249f51d1a7927b47", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518450, "uuid": "9c11114d-04b6-49c6-b038-7d0c9596f055", "comment": "Malware payload (Heodo)", "value": "290280575775ab86cd5e1e568148049969fd2acc258a9c70ce288e31728d9211", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518450, "uuid": "f2672ed1-7898-46da-bebd-375601423647", "comment": "Malware payload (Heodo)", "value": "5f91d19d7c065a6af2cd633d0416c110056a0881", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518450, "uuid": "8d7c3ccc-fe1c-4e19-a4bd-3c57926bf226", "comment": "Malware payload (Heodo)", "value": "41bc866b6e5ae3351eb52d8ffd9258555b3b14022efc742a21a1576fdbc49171548a0455c22ad5040df135b08e47bfbb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518450, "uuid": "1587e02a-a913-4358-b223-f9dbda1b85a8", "value": "T11715BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518450, "uuid": "46a2c9ba-5d2c-41b9-924e-bb897fffbe82", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518450, "uuid": "4291fd28-6254-4aa0-be03-bf706a90d418", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518450, "uuid": "aedeb120-19d4-4f95-9f73-0fc3cd413e23", "value": 961880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518450, "uuid": "3d799aa6-f026-4cb7-b5d3-1b5344d2601f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518450, "uuid": "cdca4cc1-3478-4ccd-b009-9f1f26d698ff", "value": "290280575775ab86cd5e1e568148049969fd2acc258a9c70ce288e31728d9211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e4bbc5-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "870bcdc3-d8c3-44d5-b2ed-6e7d1bb29f81", "comment": "Malware payload", "value": "a9699de01a754dc05c4dcef2631bbe35", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "890a0ef2-51e6-4181-8258-48b39396b6db", "comment": "Malware payload", "value": "2a1161ef966a32dec21248004c63ee64f9da2122d5953855f648238792f8cdd8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "e054dcf2-8139-453d-bb7e-c80808b5756e", "comment": "Malware payload", "value": "4d440f73dd3be686310266732cdf7889ad28d98c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "94e61c30-14f6-4b4e-9b86-96ddcf72076f", "comment": "Malware payload", "value": "71f4e052e0583e9e370901440cb62147567de13ac71142b67585b8a180167ee6e97ac4c13a53365ca48b27f9036f8c4f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "dc51e067-aadb-4122-9ad5-8e1b10d036fc", "value": "T1CB059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "49c42660-7700-470c-b391-41e3d71f9ded", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "06e2724b-e26f-4e2e-a378-e7fb7c1fd9e0", "value": "12288:V20BXOMcVzpWfmmnDDAX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmD0X6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553505, "uuid": "dd3c9892-4df9-435c-9447-1fe6a21aac85", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553505, "uuid": "d55149b4-9a39-4aed-a937-8f87ace4d640", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "e00db7e3-c74c-42d9-85e9-79b8e71ad042", "value": "emotet_exe_e5_2a1161ef966a32dec21248004c63ee64f9da2122d5953855f648238792f8cdd8_2022-03-17__214456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9867e8-a62e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647547726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547726, "uuid": "5e4f47ed-5af1-42ae-8280-6c4b305ff1ab", "comment": "Malware payload", "value": "c8341135839e7a0d3eb0abc56e56e213", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547726, "uuid": "3fcbee54-7cdc-4f9b-a151-66573c2d18d5", "comment": "Malware payload", "value": "2aeb498522cd276c9d563cc2c3552676a9b797ea13d1f187321b84a35dc9ce1e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547726, "uuid": "db5203c7-3601-40c5-bffd-aa905b83d730", "comment": "Malware payload", "value": "7a83d1020b5c05d48ca4ec9eff1fa831fe746e75", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547726, "uuid": "38a61d0b-3113-4d55-a443-250449b780f4", "comment": "Malware payload", "value": "35af8acac35eb5def8c3001c328238aa16ae57492f96a52cce6e94ecb49865267857eccd05d90b7ba862bb916d58492a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547726, "uuid": "f9f2de32-25e7-449d-899d-1687e481b986", "value": "T1BD452BD2D54002F5FCA84B72A03B0C5616A73E7EADB4A89E659DB16217B31D3023BD1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547726, "uuid": "51f8a066-ba27-4fb9-a522-3ee5bc10935f", "value": "12288:dbgejnAbF2wfZ4X9it7GYd5DqGW3pQq4:dbgejnAI18tGYd5DRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647547726, "uuid": "16316109-2c7c-4366-9516-e9b59590ab92", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647547726, "uuid": "08590f7b-95d1-499f-b370-3a58a1b1c52d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547726, "uuid": "b86ff39f-f57c-4adf-b236-caeb320a63a5", "value": "Pepsico LLC RFQ Information.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec05566d-a5e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518464, "uuid": "cc424438-be1e-481b-8cae-c1c2985b9fa5", "comment": "Malware payload (Quakbot)", "value": "b0ffde08f15d2543caf52fc8863efbca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518464, "uuid": "b544fee0-78d0-411b-818b-47d86d89eba6", "comment": "Malware payload (Quakbot)", "value": "2afe6f6d4dc8faa0eafc030f53e278fb5c0ea925681e6c3a74514662fd105774", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518464, "uuid": "391ab3f0-9224-4734-a4d9-d598fa6b6321", "comment": "Malware payload (Quakbot)", "value": "4de3e5e1abd7b6a2eb5116cda8baccd78d99abb5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518464, "uuid": "dae442a5-4244-4c1e-927b-a95373a795f0", "comment": "Malware payload (Quakbot)", "value": "abd23d97d117953b5333a5420ace0c7045aba4cb9c0ff69355f225eefaeee1f78af3dc08377eaa4ce47d04373602684c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518464, "uuid": "192a8690-cc5f-4e12-90d4-68992c2682af", "value": "T17F15BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518464, "uuid": "1974734c-c46b-416e-8bfc-6060ea76ae8c", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518464, "uuid": "8cb66de2-aa2b-49e9-b0a9-8afb5b949977", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518464, "uuid": "ec1b2e24-63a8-4bca-9b63-dd77f29100af", "value": 960638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518464, "uuid": "0f38fe66-3192-4eb1-b5e6-cf4a4c1e3970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518464, "uuid": "fef1c064-a11e-4602-a294-5bd3de33dccd", "value": "2afe6f6d4dc8faa0eafc030f53e278fb5c0ea925681e6c3a74514662fd105774", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c66efe3-a5f1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647521767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521767, "uuid": "8b295c3a-5d58-4af2-9b3a-bf3884325eb5", "comment": "Malware payload (RedLineStealer)", "value": "a15779aee3ad377711d96d777d0effcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521767, "uuid": "8f842c0c-b050-44a1-aaaf-c3f354eb9bf4", "comment": "Malware payload (RedLineStealer)", "value": "2b722dbcd97e942647cf3861bef900a9cb66acdad2dfb975495d87d4b2b1d697", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521767, "uuid": "c80923bc-e9b8-4ef9-ae51-20e8505df6f8", "comment": "Malware payload (RedLineStealer)", "value": "2d5fdff72750fc7a8801208251827a90c1e836f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521767, "uuid": "defb540c-6551-425b-9b38-076925f6c472", "comment": "Malware payload (RedLineStealer)", "value": "720ce50763863670ce2a6d9e3d6afba69047f67e93c430ca93eb684e67c12f878afe78f0c2296ebc0bee3ccfd5814924", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521767, "uuid": "1140ce32-012a-4377-8c4d-f611b70020c2", "value": "T12575332B97A7FD57C34128772F1BDF828CD74E04A9A829E79BDB0ED31904467235C982", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521767, "uuid": "59c13207-3004-4edb-8985-086ac66b8bca", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521767, "uuid": "05dbbbd6-a033-4297-a3f4-a8cfc520fddf", "value": "49152:rj8jBvrUlXBmUd4FAtnEKfro6rjZWhBNa4024Yt5:yAdqKEF6rjMhDBhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647521767, "uuid": "18abbe43-06b4-4a7c-8c78-50c311e33a76", "value": 1590272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647521767, "uuid": "a2b28d21-b5b9-4927-9acf-6244eb3878e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521767, "uuid": "70bce5e2-e793-4556-af56-4538bc4bbab2", "value": "a15779aee3ad377711d96d777d0effcd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83481ee-a5d4-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1647509465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509465, "uuid": "b12f7c8c-5f2a-4f75-a00c-f884cf98f585", "comment": "Malware payload (Gozi)", "value": "a88eb1440652a0e919ae2a9a8dac1dae", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509465, "uuid": "ccb89f94-9682-451d-a39f-4895731a3066", "comment": "Malware payload (Gozi)", "value": "2cb2f5884d3c1a02febe53b8c8997d070a4c54dc75628714f829b894cf1c73a7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509465, "uuid": "b590ae80-f34f-4d05-aa63-5ebf0f4543d2", "comment": "Malware payload (Gozi)", "value": "4afb78598c94f5a1078a1cf3f30f3ed4495f31d6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509465, "uuid": "6bfbf6b1-4cdc-4cf1-83b7-0a761bd78f09", "comment": "Malware payload (Gozi)", "value": "3a8d2fabd604982a8007adc21e5166945f3594096db3438d8d53dd2366c216b66b20ed3e111434d54fe2ce6b33583b79", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509465, "uuid": "d268385b-8f9e-4063-81c4-228dc3c4ba8e", "value": "T15D356C22BE9E4437C17A2A389D2F576868397E103928686F27F41D4CDF397417C252AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509465, "uuid": "ab160aaf-966c-47af-911e-7c7e3060fc64", "value": "29b0a68551a99728af2da380e4cc5074", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509465, "uuid": "09490c18-0fb3-4457-986e-cedf9f6cd578", "value": "12288:jP8LPFKkgEUAa+Mp1YEZdFyHkvs0ky268wdiWTNLxJO3vp7WnUa5prq+KHrstj:LEPFGiatMEvsIfdi0Svp7WU2rzKH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647509465, "uuid": "f51c3d90-188b-4726-b7cf-5a07f0d8e556", "value": 1078784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647509465, "uuid": "4f0df397-1d15-4e0e-ae02-b88274be5b42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509465, "uuid": "63158463-0bbf-4338-9425-1b1e66f98158", "value": "readme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436378b7-a58a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647477379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647477379, "uuid": "448a2ebc-2e1c-4373-a94b-9d4d2e93e7ff", "comment": "Malware payload", "value": "e34e2beb0b877b6e15fa1e4ebad8a700", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647477379, "uuid": "e39b6fcd-7ab0-4a56-ac85-6311565a1798", "comment": "Malware payload", "value": "2d5b7f1cb652c25f90f2ad87549dbfff02a9a8ee9b38beb359e891cb4be96d08", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647477379, "uuid": "2f8b0602-b918-4f44-a9df-c6775bd88987", "comment": "Malware payload", "value": "0da64446fc2aeb22a3879332ea1aee317d75747b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647477379, "uuid": "3b2fe729-a2b7-4548-a469-da8f6470be54", "comment": "Malware payload", "value": "d755ed635898d0b3064f3e9b44b0144b8f2a16120ca66b847d57b3332d79d7195a75e5bf78b56e674d3324c1e72eabd3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647477379, "uuid": "cd5142ab-fdf3-4448-8dd0-abc0932a44cd", "value": "T190349E52BAD580BAC2F321B14A46726EB3F5D700473A6BC35BD11C2C6B385D7923C79A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647477379, "uuid": "ce33ebbc-cefb-44c5-b27a-075716bb31b1", "value": "6144:WZ7T8DsyVvuJb8fTSeOPwSyeuRJ0tvZVKudKV9M/9c:WZjb8BOPxue5dKV9M/9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647477379, "uuid": "173c1c71-de68-4975-8db2-e006e848b16e", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647477379, "uuid": "a1bb7403-3799-4607-8303-5691e0c98f62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647477379, "uuid": "c0e52abe-a87a-4b0b-9b57-1216c2d9c5ee", "value": "emotet_exe_e4_2d5b7f1cb652c25f90f2ad87549dbfff02a9a8ee9b38beb359e891cb4be96d08_2022-03-17__003611.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c0a16d-a643-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647556837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647556837, "uuid": "954770cb-2e96-44b8-891c-edc55a46e2bd", "comment": "Malware payload (RedLineStealer)", "value": "aded74f5f7503236764172192cde861a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647556837, "uuid": "bd6e84c5-c3c7-4aba-9f08-54ff7709193d", "comment": "Malware payload (RedLineStealer)", "value": "2d6f415fb10deb7d64dfc63ce212c180297920930000a2a52b4cdc21a813efb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647556837, "uuid": "1da43d48-0cd4-4fe6-936b-569255f2047f", "comment": "Malware payload (RedLineStealer)", "value": "a6e6cfeb7797b26c9a9cadb1109c4803854c9969", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647556837, "uuid": "8ce167e3-f247-4199-87c1-b56ec6f66f58", "comment": "Malware payload (RedLineStealer)", "value": "34a3aa3ad42b24a59a0d804b135ce378e8142058b0180e2ada2552f3ef101df2b035d148909d0fc60b309362782636c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647556837, "uuid": "3e5ef5fd-33b1-4a45-9e72-90242814f61a", "value": "T1BA75332352F5BC59F249F7F1622DE39E04D2E9A064D4FB22D2BDB2C620104EDA55D8EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647556837, "uuid": "b31d997e-015c-475d-a7ba-a3041334a40b", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647556837, "uuid": "7443bb3c-0b8d-45ae-a299-9f0a91741d25", "value": "49152:EDkAAySbaIhFN6m3nvtDuGqFSGPNanU6NVV:Uk7NbaC73pwPET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647556837, "uuid": "1aacc18f-b4ba-4c21-941f-00ade75cc05f", "value": 1596416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647556837, "uuid": "622d16ae-6458-436d-83ab-2b975d21be2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647556837, "uuid": "a2389807-e567-4ad6-855d-b93fa52cb95d", "value": "aded74f5f7503236764172192cde861a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5473aec-a5bb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647498723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498723, "uuid": "dd9f15f1-ee5f-4f00-bef8-66b6e6ea364f", "comment": "Malware payload", "value": "ef238844a5b878af9efca642525b89f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498723, "uuid": "17d72ba5-1a50-4bd6-a39a-275bcc994597", "comment": "Malware payload", "value": "2dd29a5deac6f50cd9418e0731a2f014e0ddac4ad35df67c861abdae058e8b5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498723, "uuid": "0b6f4a8b-5bb0-4ae3-a0e2-e8635cdfa0e2", "comment": "Malware payload", "value": "1fa8f19449fb106146dea79d20d56981d41a9bc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498723, "uuid": "d19fd4a7-3f41-424a-9b3e-4fde1709be06", "comment": "Malware payload", "value": "42135d618005862f248132a891da88c6d16f9d7fcc6859366c47188ffd35f783caf3ef9660b746c3705d5814e4a630db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498723, "uuid": "929a5cea-74d9-46be-8286-7e1c50530007", "value": "T1D143CF657398C428C5B50638F93466FD0935BF04CB12E72BFA90BE1F3EB9652D1A4B80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498723, "uuid": "92f1d61d-18f0-40c7-830c-ecb48d11ffd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498723, "uuid": "8e3405d2-d7aa-47c5-9f1d-1b9ca479c46b", "value": "1536:Ibf0LrKf88dAiuUcVpx53IADrmlWcGJZduBvPilS:Ibfhf88dJuUerZINlCav6lS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647498723, "uuid": "e83ea0f9-af3c-4950-88a3-eeec7000f0b6", "value": 57856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647498723, "uuid": "439804e1-3e4c-4086-83e3-37d5572fe4b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498723, "uuid": "785fdfdb-cc63-4918-a230-ae61b8056a43", "value": "91141640.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c3946b-a5bb-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1647498621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498621, "uuid": "bf56cb2d-6e7b-4efb-a457-14c6980c1d3a", "comment": "Malware payload (Smoke Loader)", "value": "b2a48c79ca637aa16d9451f24a348a93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498621, "uuid": "901a3bb7-8fa4-4975-b760-c2c29464ed77", "comment": "Malware payload (Smoke Loader)", "value": "2f3997329c41663f3cb476b2df1b5c09bec4277f2a18a4d437c4f259e13b0665", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498621, "uuid": "99672542-5865-4042-bd1f-bba0f49a7cb8", "comment": "Malware payload (Smoke Loader)", "value": "098f65bf027ce2cc080a3fd40df5bb9210529a9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498621, "uuid": "dcc03ded-58fb-4e0c-9965-2688fc1e4f63", "comment": "Malware payload (Smoke Loader)", "value": "2922046fc480c41518d95f95a4b65ebbf01ccff44ae1c09335a04d70b92d3de244d8c4251d81ba068a89ff4f502a05c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498621, "uuid": "7f39a2ab-8b99-49db-9507-959cdcffcd28", "value": "T170D2C01B4802E07BC696F4FE441563B25DF18DDA6CA65648B22F8B2B3D79C80A32F046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498621, "uuid": "3b5e2b46-c677-4923-a0cf-1e9921321adc", "value": "384:yb7ZYQoQtowX70euCd8GDiZ79dL1BWSQu6WDtz7+Bdaw46qvKkFh5FUINeeTNjOm:C6S70eNdavXWSNDpuBdiKkFhbUCeUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647498621, "uuid": "ea21c613-e43d-4fd2-bf82-ad56fee56336", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647498621, "uuid": "30091682-dc94-42cc-8bc0-2eb7d9ab5793", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498621, "uuid": "394e1ee9-1498-42ba-b99d-cff0e269a5e5", "value": "79121052.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54c7158-a5c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647503796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503796, "uuid": "9e8fab9c-1256-48d9-9f95-13fd026699bd", "comment": "Malware payload (Heodo)", "value": "b37e0972ef1a3a092509fe64579c69d7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503796, "uuid": "81c8af21-8556-47cd-bca6-9973ee6371e4", "comment": "Malware payload (Heodo)", "value": "2f9ddf1d4fd16c39c602e8e10e7189612f0c8ead7b4a853cd1de342bb992d061", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503796, "uuid": "4a3d4778-5bff-4732-a02f-58c80f37e1c4", "comment": "Malware payload (Heodo)", "value": "838be17efc829809b13fae6d3879120bdd7bbb49", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503796, "uuid": "0bc338f6-e485-43e2-8eaf-189afd2a9545", "comment": "Malware payload (Heodo)", "value": "c892d822cf9546ea4cbbdbf63fb07874e37bf75b0c81c1a14e6ae0281cf2a31e3b13c24c3728c2349784856d5985e0f8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647503796, "uuid": "3fb15e6a-684e-4a4d-9078-1fd21589983d", "value": "T125A29E2CE921744DE3BB683C420650FA924A1C022147B5ED3991F77D6B73697068FEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647503796, "uuid": "2d832032-2e80-47c6-a2e1-666dc84558c5", "value": "384:33uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:LsNs/zXtFCBn9kC+xbL42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647503796, "uuid": "bde9e6fd-2650-4cfc-9bce-567289cf5895", "value": 21657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647503796, "uuid": "8768eb6c-0a61-45c0-a0ee-b37291bf008f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647503796, "uuid": "657925d3-9625-41c8-807a-5253fa1b476d", "value": "Scan_20221703_31487.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eab1744-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518657, "uuid": "b2637638-5e6d-4089-9bfd-819be4336694", "comment": "Malware payload (Quakbot)", "value": "c640468581a747f755c21a044bd30f77", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518657, "uuid": "9af4df32-0cec-4422-b483-dfe51efd5a15", "comment": "Malware payload (Quakbot)", "value": "2fafff6c8b26a0de2531150cb601111b0064f655c9bbba4ed9d7200172b04975", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518657, "uuid": "f960159c-ac8c-45a3-b7a7-c8b3c96f9c20", "comment": "Malware payload (Quakbot)", "value": "d518b3ef93557786dcb432a3eb1d4ec4402e5d00", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518657, "uuid": "91bbb679-a8f2-4184-97ac-28189264b1da", "comment": "Malware payload (Quakbot)", "value": "07088fa47da616958fb7e0d75fce4cf0a70b52f7fc02dc45b10e1b8872ffcedd6b11b66eeec2a0afc43aa29fdc083a83", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518657, "uuid": "98216569-aa13-4cb3-8de7-cedbe9808f36", "value": "T13F15BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518657, "uuid": "b02f259a-5451-4abf-836d-d453cccaa3f8", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518657, "uuid": "9513b760-dd77-4051-a3bc-d095b64b77d1", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518657, "uuid": "d149eb43-0b61-44fd-91b1-6b9bf6a5adab", "value": 940352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518657, "uuid": "eaed89c5-4e81-4e23-bb2f-900ed81336be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518657, "uuid": "43ab5e86-0901-4104-8cbc-bb10c5262b85", "value": "2fafff6c8b26a0de2531150cb601111b0064f655c9bbba4ed9d7200172b04975", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb55ff5d-a5bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647498733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498733, "uuid": "2664a48e-5eff-4566-bcf7-87fc3c017897", "comment": "Malware payload (RedLineStealer)", "value": "135f4dc7a94327f4440453b9ab15d4a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498733, "uuid": "88b50292-80b0-4cf2-8cf7-d06fc4d971f1", "comment": "Malware payload (RedLineStealer)", "value": "301a8eb35a1c4a545c7f796d1b2c16cd151e37b5793e3e2deeeb020520654574", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498733, "uuid": "ae5ccdce-3cd7-4160-b927-fc1294157631", "comment": "Malware payload (RedLineStealer)", "value": "ca5e72970f8f350874411e8fa56bea7fc4254ef9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498733, "uuid": "60b5beb5-c910-475b-8a15-39254a1cb1c8", "comment": "Malware payload (RedLineStealer)", "value": "08261de732e1f47a9f1f0f4feb6e2ceceaac7f68499e612ce4f42b10763562cf998306766b531d7fde048afbf0e35cb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498733, "uuid": "35268eda-9956-4869-8f94-55172d6699fa", "value": "T14EB34C9027DC5A24E2FF4F7168B8119847F0F5136502EB8F9EC970E90F72B80A656BB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498733, "uuid": "e3a6f786-d715-4a63-93ec-105ed9fccbce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498733, "uuid": "f56228fb-f14f-45cf-bbe7-5f197f1384aa", "value": "3072:mGUUJZiCAYt0r0OTfyKiz8vJgG1cUGtyb4NCrex:mGUMH0vJg9uex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647498733, "uuid": "8322ba1c-bcb1-423a-b0d4-5dc93a82ded3", "value": 112000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647498733, "uuid": "e8757e3b-89dd-4c77-be82-6e3299bc442f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498733, "uuid": "cd72201c-16ef-4e93-abcf-2411286f5e70", "value": "ddf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2dc86f0-a5d8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647511174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647511174, "uuid": "b1bceed5-b802-42d6-8298-dd4ca0f649ff", "comment": "Malware payload (Formbook)", "value": "04dae103c36547a74f1cc194d7f2ed0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647511174, "uuid": "6610f939-a709-477b-8ad9-297c95118de8", "comment": "Malware payload (Formbook)", "value": "30e4c4c41a6a4d31abc2f98c77a01a5d5fdb562bdc19362728a65d986820352e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647511174, "uuid": "968e5ccc-2c35-4b6c-bdb4-af578f43d2dc", "comment": "Malware payload (Formbook)", "value": "d99a61639a2ddc1f447f7b6acd87f9a7a4eb996c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647511174, "uuid": "dbf5a1a7-0103-4dde-9f08-4f9afbb76662", "comment": "Malware payload (Formbook)", "value": "19943240d64110e51fb32b460b2f4c1b01ee43b18f1f7b5e2b47acad0978fee650844435d8b19be57591db52526bdec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647511174, "uuid": "199c207c-01cb-438b-9be5-d6b58011c971", "value": "T1A1354AF2A2508832D4223A384D5F4EB9B42A7D05DDE56546AAE43F0D3F3C5B2FC21A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647511174, "uuid": "03445d10-9730-429d-95f4-e6eb343433fa", "value": "066f2adf6884c84166ea572f3442e2f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647511174, "uuid": "e47cf838-7343-46e8-a955-a3d16fba01f4", "value": "12288:RbojJKNbgMwT2NRAvS/yqenMbJjRsBp8oziAO8Iz2sVW3MsqI6F3HAhcAszeVQ18:elKiCRAvS6qOMZGBNgzqqTHAhU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647511174, "uuid": "125c1f34-1da0-42b8-bdd2-19779e5b8bb4", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647511174, "uuid": "b15179a2-3b34-4987-8822-3d7d06417ad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647511174, "uuid": "cca90c68-dc66-48da-83c6-f4e46a177514", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71531de3-a5e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647515681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515681, "uuid": "b823af95-0e0d-4042-b42b-be6d14cae848", "comment": "Malware payload (Formbook)", "value": "b1ee8aa3e90b36aa601ce8b95e912cf4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515681, "uuid": "8725c8f0-6ee8-458b-ab41-14e242622f0b", "comment": "Malware payload (Formbook)", "value": "32159f1ad821e72d64a72ad89b670b498fbaf994ee9fabb8c180b10661fbf4ab", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515681, "uuid": "09b1aa86-6fbe-442a-85c4-288f8c5f38ec", "comment": "Malware payload (Formbook)", "value": "b14cce837bd6cceb2c26a1d70c09f5afb9224c68", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515681, "uuid": "6bad4727-640b-4a3a-9755-259024c8aaa2", "comment": "Malware payload (Formbook)", "value": "852bebbf6211367877481e768dc9b4047568e971bb6ea45bfc29d52e0301a3fb596cfd470a161c75800e50e878b81a36", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515681, "uuid": "a9e00bfe-0c8a-454a-94ac-0d93798b612a", "value": "T13114135B1918B00AE73A137EE3854D6415B3FE834E2683FDA45637342F7AD501AE8B2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515681, "uuid": "35caffb4-a65a-4cd9-830f-8a287fff1fe8", "value": "3072:QlM7Cweo0RA9lqky5qRtmGRth4O4LmOjAGGZ1AmyCOAibjvKRam3AEArPuPF6Z:n73e/ROHSqPid5AGGo3zX4JQEArPuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515681, "uuid": "10480c85-b3af-4222-9dc8-159e2b0a1dff", "value": 191336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515681, "uuid": "6d7d8058-e002-4c9e-a4af-08ce5f9c022f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515681, "uuid": "11f0d9c9-7cf0-4213-abfb-aa2808abfb7a", "value": "Draft BL and Packing List.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493af288-a619-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647538807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538807, "uuid": "ec65fddb-d918-4b9b-871e-3149484376c8", "comment": "Malware payload (Heodo)", "value": "d0b6c372aeb45bf788d199f924f54afc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538807, "uuid": "b490c10d-b04e-40c6-990e-ab12903e471a", "comment": "Malware payload (Heodo)", "value": "324b57e18c0ec8cf223e909685fbac03e540385c380fef11c263202b3abdbf7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538807, "uuid": "a36da8a0-6916-4d84-a861-2cc39e550efa", "comment": "Malware payload (Heodo)", "value": "64cd4a8d56b863d8cea19a24ca3335584553f71c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538807, "uuid": "c8122ad6-7b60-4021-a461-3cd94223f985", "comment": "Malware payload (Heodo)", "value": "02133e42f9407ab078b011686be37d56cf3492a43d7ef4c755d405c925f22f7946e044db87fb56640ae403c0e8586359", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538807, "uuid": "408ca39f-13e9-430a-ad64-7a676ef238e8", "value": "T198058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538807, "uuid": "f0510101-7647-44e3-b200-ab7784b92266", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538807, "uuid": "bddd26c5-2fa2-4cbc-8e3c-18a24385ecf2", "value": "12288:Wvz1CLJyyvmMLSrBg+4ruGbPlVpqb+DlYzv:WJCLJyybLqB34ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647538807, "uuid": "f72513b2-b0ad-4494-a0c1-b68eff5fff6f", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647538807, "uuid": "40f7cfa0-5df5-4520-a0e9-0042d567efc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538807, "uuid": "70944625-3648-440a-a7f2-fd0c9bfb052c", "value": "d0b6c372aeb45bf788d199f924f54afc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8721e6c5-a613-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647536334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536334, "uuid": "1b7ffc74-d3f8-4013-a658-c2f5b6d0f710", "comment": "Malware payload", "value": "de8e068832e8dcbbdd3b813273280e6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536334, "uuid": "43c12bab-c112-49f4-8016-d5446312293f", "comment": "Malware payload", "value": "326757eb88dd552e578b6166b7577a0d2a6408e401ce4cab835b0c2d6ced2b4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536334, "uuid": "168da843-2733-4a50-a53e-ea2ef35f67bf", "comment": "Malware payload", "value": "3758df7589458dfe363a2610aab5b41f49175961", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536334, "uuid": "cb6181c6-4efd-433a-be23-a70886a8344e", "comment": "Malware payload", "value": "778f4196be4891c1984a881e84a327cd0ed8611eb4bfed5ab6dabc559bc3a46a2204c0a830f5f931073f3481200546cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536334, "uuid": "6f7b3435-ca3a-4f80-abe1-fcafc0cec273", "value": "T13073D52BD7A34C48C5303BFCDEE2D7A50A9C5F8D2C32C79B49A1FC5070E6A45B8499A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536334, "uuid": "c9e1484e-1f6a-43fa-92b1-d5433e674370", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536334, "uuid": "943c257b-15e4-45ab-809f-fd76a80f8f57", "value": "1536:EnYXcobQ559anPwwsV0iOLdlEbaqEYdszM0N/U:lTbQ55InPwKlnEbFEYF0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647536334, "uuid": "8dbaf054-aa4a-4f29-8077-2cc06efa0792", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647536334, "uuid": "cbdd247a-6ced-4212-a4b3-67e6ea83338f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536334, "uuid": "a694c66f-370f-43e1-8c5e-31e44c58b672", "value": "24982297.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00f4661-a5d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647510713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510713, "uuid": "db81d7a4-5b58-426b-b597-9b75665089c8", "comment": "Malware payload (Mirai)", "value": "58c570850259c19531f43111464d2dba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510713, "uuid": "0a893004-68e0-4c8f-a2d4-f2f98257c7af", "comment": "Malware payload (Mirai)", "value": "327dc05b8236451c564146094dee7a5dd872bdec5fbc18993e2e79edccc0fd6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510713, "uuid": "4686521f-e8aa-4116-92ea-10a8819915b0", "comment": "Malware payload (Mirai)", "value": "3377ebdae7070f0040f8975680c9bdc9fc4a5172", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510713, "uuid": "1d2388ad-8d97-4fd7-88ee-07d2653fc504", "comment": "Malware payload (Mirai)", "value": "8f9e1b5e8a8b409ca60794d584ce550b4f5a426af6d4f389f00956e1f8edade4285e67855a784f30b6075ab5771db539", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510713, "uuid": "02feb408-144c-49ae-aa9b-7865e2947b09", "value": "T138E2F243BA82D1A6CDD86273E939C1DCBB9B29FA9DC614F06C74C31F11D302479B9A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510713, "uuid": "d717051a-f751-4847-bc6c-eec9bef11e64", "value": "768:32ytkgE166WIokndu0hIfUnem/51WXaVHg1p8Yosm2b+Z3U+:mytZS66WIokQmDN5E2HUpjoOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647510713, "uuid": "0b600c7d-98e1-493b-82e0-9364c1f01a9a", "value": 33708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647510713, "uuid": "f8d3fb4f-75f3-4f2f-9b97-3cec15c1fd9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510713, "uuid": "26f95e16-1bf6-4cd3-9450-fe7c47670e14", "value": "58c570850259c19531f43111464d2dba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66943bec-a611-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1647535420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535420, "uuid": "0122a511-9354-46fd-934e-a7d9882da5b9", "comment": "Malware payload (SilentBuilder)", "value": "89319157ebf0d99453639b7c8ddcfc32", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535420, "uuid": "dafebb78-1af0-47f7-8ac0-692179874881", "comment": "Malware payload (SilentBuilder)", "value": "328050ddf642f4f911a531a52c9a7f55de0d0061f4344e2fdf34028295f7c6af", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535420, "uuid": "83d21a20-6c05-46e5-9140-5688ae433fd6", "comment": "Malware payload (SilentBuilder)", "value": "477080d5a3f6567a1569af02c89eddc2bd27756f", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535420, "uuid": "7fab3f83-35da-4968-a5f3-d62c9818f431", "comment": "Malware payload (SilentBuilder)", "value": "8c82460c178190ef3aa8bdcdbf7401c9a41b8e1b89212826805b8069a364bdebdd80b9b7f7350e2ee9d499b06004762a", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535420, "uuid": "9b6ac792-236e-48ba-8c36-845d8be89a64", "value": "T1F444E006B67DD898EF19833446834B5A7733FC202FEA174777D4B2695E74CA82E02986", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535420, "uuid": "a04ab690-c2f6-40d1-beac-d2024d467db5", "value": "6144:WKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgLMr92nbIoJKlHsQ6wejcmAIqr3:a92nbxKdsQdwcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647535420, "uuid": "81a9af2e-ed1b-4524-8f11-48bb6e4b4e9d", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647535420, "uuid": "0bc78eeb-cd76-465d-b1c0-b4c2c766f280", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535420, "uuid": "2016e8d9-ea0a-4bc0-be7b-63ee6ab7da06", "value": "SecuriteInfo.com.Exploit.Siggen3.29980.18636.27264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58dfc57a-a585-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647475268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475268, "uuid": "aba8b445-4634-4922-bc7a-b3083a02c5bf", "comment": "Malware payload (Heodo)", "value": "f8d7a417b252365ce127878743786125", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475268, "uuid": "22259aea-0649-4192-aa2d-601ee9a50efc", "comment": "Malware payload (Heodo)", "value": "32c434b581b27e2aa5d844413835e77df6bfa2abd06cf4e51e82e8f2c9f3145a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475268, "uuid": "534656fe-93c8-4356-833d-3c54b077cf46", "comment": "Malware payload (Heodo)", "value": "e9eabfb1031a949a0ce6ea80bb86f7f300603ec1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475268, "uuid": "51b382b0-ef22-448e-9c79-7902d16f3422", "comment": "Malware payload (Heodo)", "value": "45b5811899f923c3031126c981954952f6244e2b549174b03a59ef551b4805841788190f568925f2f33410e6620245a3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475268, "uuid": "9ae77a0e-2896-4406-a2d9-6dd3482f78ed", "value": "T100F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475268, "uuid": "21ca2e07-4e0f-495b-a79b-4f5cc35f2027", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475268, "uuid": "5c72a931-e0c2-420a-968c-4d47d325aad2", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7ha8rLneTfABCJoWRWwfpW:BeCCF88j+XX8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647475268, "uuid": "f765408b-cc9a-4818-9b5d-577eeac1f5ea", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647475268, "uuid": "5a15fc17-a491-4676-82d5-247b1e493ea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475268, "uuid": "3d53eaa6-86c5-4058-88f7-de3f49912d70", "value": "emotet_exe_e5_32c434b581b27e2aa5d844413835e77df6bfa2abd06cf4e51e82e8f2c9f3145a_2022-03-17__000054.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33a4d77-a5ce-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647506773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647506773, "uuid": "f9bd6c8e-a920-40a1-aa41-bad020c4a299", "comment": "Malware payload (Heodo)", "value": "209c7e6379432e59ff11dfa4c4b8be03", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647506773, "uuid": "f6aae89f-0735-4726-851d-758ebd241057", "comment": "Malware payload (Heodo)", "value": "33b0e641f2ff85cba08525b595afeb01f77761a6fc60596a46fdbb0f264e755a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647506773, "uuid": "2f6dd8c3-1e97-4a40-9568-11256f0e3acd", "comment": "Malware payload (Heodo)", "value": "b86fe9610da07a7744c624b8daff7fe04be47d94", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647506773, "uuid": "2f9b02f0-ad2c-4078-859d-cedf78bd77d7", "comment": "Malware payload (Heodo)", "value": "630f23d9664b737a8962f957fc5961579af96bbe1c057ba058da6b3857dc79f8539395447a1af1f29664caef4149fe8d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647506773, "uuid": "d5ba359d-659f-47b4-b9a0-e5ddf0f07679", "value": "T136059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647506773, "uuid": "a8b62f65-dff9-464e-91b8-a2629dcd003b", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647506773, "uuid": "dbd6a9ca-bb47-49f7-9d68-593a1098efd0", "value": "12288:KVHML2QJe6XxhqCWGQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhquQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647506773, "uuid": "fa49b4c4-9e12-4bf5-890e-2ed76a48bcf1", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647506773, "uuid": "376b8b2d-f046-41a9-8f42-d7e9ebc88705", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647506773, "uuid": "76ab4ee5-462d-47e3-98db-0e25a3553bd1", "value": "emotet_exe_e4_33b0e641f2ff85cba08525b595afeb01f77761a6fc60596a46fdbb0f264e755a_2022-03-17__084608.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3538a165-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518587, "uuid": "86d8e8d5-6bd1-4a4d-961a-b1cff823e3d3", "comment": "Malware payload (Quakbot)", "value": "083ac8b93aabdd9c11c15cc2e279d6f0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518587, "uuid": "3f7c3352-9fe5-4c88-a480-e4621154a3de", "comment": "Malware payload (Quakbot)", "value": "34738fa839fb1a46400c417d8f381c63e27b6eb9af7335de3560fb1c00d833d6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518587, "uuid": "7f632b29-377f-427f-918a-6e0ca2690991", "comment": "Malware payload (Quakbot)", "value": "45cc3477cb850cc7a190161251c2b24d1d2e357f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518587, "uuid": "edf3f79e-cc19-49fc-8549-ca9dd20f812a", "comment": "Malware payload (Quakbot)", "value": "be0273de9b976b54fb4574fab960c250ca0a5b43da6853f2c8388eef1e1568e78cc75ee9b01f281e371b67b3969d9bb5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518587, "uuid": "c065e1da-b190-48cf-9a6a-18fb972bae76", "value": "T15915BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518587, "uuid": "dd1dc80d-a77b-46be-81c8-0b83e5c808b8", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518587, "uuid": "132e92ba-0859-4eed-bf1b-af8e77be0239", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518587, "uuid": "0289e5a6-26d6-4dc3-b246-7bcc2a965802", "value": 946292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518587, "uuid": "ccdce177-1dc7-47a0-83af-f05ed248a905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518587, "uuid": "6540cbac-a1d3-449f-ab18-d63a9fd24643", "value": "34738fa839fb1a46400c417d8f381c63e27b6eb9af7335de3560fb1c00d833d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2d2800-a62e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647547729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547729, "uuid": "04219a4e-5bf4-43d6-ba26-3a2659a1598e", "comment": "Malware payload (Heodo)", "value": "8765ff861e7924f6b2901fa109f8be5b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547729, "uuid": "a76b8ca1-240e-40b9-a729-36afefdf6231", "comment": "Malware payload (Heodo)", "value": "34b7946edfdd6ab473a0262ed5555e74bf8573ce3594300b977bdd23b34bd768", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547729, "uuid": "7e991172-9d4e-4f2f-8d96-096aea17b4ca", "comment": "Malware payload (Heodo)", "value": "ed9ce978b6b49574356c19f8cf1a2528d69dce96", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547729, "uuid": "d65591cf-4447-47aa-af04-8d91a0fc523a", "comment": "Malware payload (Heodo)", "value": "6d8459ffa4a8d17a61084947ec9d4e3ff32ed8b51140afbd4e267d7c02ae04ab4f0cb4e60b3252108ea013fbb475bed1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547729, "uuid": "2c40a3c7-9c71-4f65-8d28-7c9b83b5b959", "value": "T131A2AF3ED221E818D67B987C830580F6E70B2C561007A9ED2D51F25D66726F7138FABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547729, "uuid": "0de0e270-6ab6-406c-befb-7dc13a197618", "value": "384:2QZAVb1GNjJITo4CGzPd6ZIwVKb5CzgObff9kC+xbX7zL0crX:2TINqTo4FL3CBn9kC+xbLHjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647547729, "uuid": "a106f51c-f167-4536-aa51-3cffb1cbf6f4", "value": 21461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647547729, "uuid": "0b98cbb9-6323-41a6-aa76-e41c6c8d1193", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547729, "uuid": "4bc4513d-9390-4afa-9a06-40b990e50a50", "value": "Transfer info.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481ee178-a620-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647541812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541812, "uuid": "4d1e3baf-5704-49f5-a19f-deda75fce876", "comment": "Malware payload", "value": "a118f9881ad5f454303ecc4cb0e4c321", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541812, "uuid": "1fae6cba-5ea9-4385-b490-5d679b1bda5c", "comment": "Malware payload", "value": "34d39156d4b079f5a9019a71075fc6aaa811d26ccf1836a41dd092c920356d91", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541812, "uuid": "d48f0d67-cb16-4c0a-b711-692bc5b43c5b", "comment": "Malware payload", "value": "9fbc0a6530615ca1903a81ed8ea588e84ba1a6b6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541812, "uuid": "1b577426-2ec5-46b2-8ac2-d98b61271b08", "comment": "Malware payload", "value": "d39e2a80d8c7a25b1ba880aecccee8951b5c29e8a3c3614a7b98ba837451f11891c273eaadacf951cfa5af72b08c7743", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541812, "uuid": "5802aa37-fa12-4839-9fcf-c399c0370366", "value": "T1E9C43B017896603CDFDA363601F7EB2531E75CB0677CB52E6EC168EC9B2628A051D63E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541812, "uuid": "e4ee4d53-177d-4387-9537-20f822853a3f", "value": "fe91b35dbbcef6d3f3836ad3e8b836df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541812, "uuid": "10fdd703-bfda-44a3-8617-66e31336c280", "value": "6144:xe4HnxyzcUzcUin5jBd4hp3CBj6O7O7OOuw/RRRI7E7E7E7Z94kx8888rLCkxEZZ:56Kv+tEgqjdov6eimJEeTN+sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647541812, "uuid": "a419d777-a71d-4703-9a7a-84684d0828bc", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647541812, "uuid": "d66f65f8-f58a-43d2-9e3f-25b28c977e02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541812, "uuid": "87c32705-a79c-4584-ad6c-bde496719419", "value": "emotet_exe_e4_34d39156d4b079f5a9019a71075fc6aaa811d26ccf1836a41dd092c920356d91_2022-03-17__183004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca14a3aa-a5e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647515830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515830, "uuid": "33c43699-caa3-4179-9043-062049e7120c", "comment": "Malware payload (Heodo)", "value": "feaf2cf9737803022449166ef5d1ea71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515830, "uuid": "00db3fa6-4808-4fd3-972e-ef682f2e23a0", "comment": "Malware payload (Heodo)", "value": "351244e48dfcd64bab8770ddb7af6613cc9119f1c5ea444853feeda62e1b354a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515830, "uuid": "4411b65b-e6ad-4dac-bde4-87d932dfee0e", "comment": "Malware payload (Heodo)", "value": "56b5deb06e25174644ce6f37e8e28802bfe5aa8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515830, "uuid": "c7b2f12c-fffd-4f8d-ae45-3cf0cb8c6b4f", "comment": "Malware payload (Heodo)", "value": "2ea3361b74654026bb51bc15e333540442bb14c11dc4efd5061dedee68232076475b4c79a79407611ad7407496fde793", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515830, "uuid": "fff5d00a-0104-4698-bcfe-740e25fc6c51", "value": "T15AF4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515830, "uuid": "9bba5684-814a-4b67-8f9d-fb832f4dd2f2", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515830, "uuid": "96bdd29b-516d-4888-bf0e-3f85fed9f32e", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7h98rLneTfABCJoWRWwfpW:BeCCF88j+XM8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515830, "uuid": "8c0ca0a7-d0d7-415c-bc13-bf691fb91ebe", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515830, "uuid": "ccad16f9-ea2d-4dcb-b1e9-e44640316eb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515830, "uuid": "cef2c4ea-7537-4079-8748-25009f31da39", "value": "feaf2cf9737803022449166ef5d1ea71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8a0353-a5e4-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647515974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515974, "uuid": "632a5433-2203-4c69-898c-e1afed0dd0b9", "comment": "Malware payload (Formbook)", "value": "c8ea3f1edb3c713ad1da388bf6d5c795", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515974, "uuid": "856bbd6a-752a-4310-9430-4f72a4fce464", "comment": "Malware payload (Formbook)", "value": "351960ddeabf584922b413c95094ab9186475f64dee24cbad1288df20e4e01c7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515974, "uuid": "44f2ea2f-01fb-413c-8caa-0f0d9fc7eb15", "comment": "Malware payload (Formbook)", "value": "4cfa374dd8d17ac26b75071997c4239390a455bd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515974, "uuid": "a30fac65-7a96-4449-a3d9-8beb67dceec1", "comment": "Malware payload (Formbook)", "value": "4665db805160bf77639cc1cd0cdab1e2a0de8894c33ee146598efeabe9b7fb2328c23124e66ebb3232b025b6703f9bf6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515974, "uuid": "b17f8daf-c2b7-4c1f-b6d2-5ad35148e376", "value": "T1DF1412B137BABA9CF5C0143831CEA9D53B5AFC006D795E972019F75C28330B15EA0E16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515974, "uuid": "38ee1f9c-1d46-4368-a845-8cf02cec36cb", "value": "3072:mNML6mWCvXoY4Mga7ldRV55Hzyp/oujJTY4O9JP7SHaki0sKx1knYY1cQ4U3taxZ:g2nIa7bR/5E/oyT3O7T6akiRy1kn3cQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515974, "uuid": "a68bfe64-3134-4ea3-bdca-c84b13d0bcd9", "value": 191080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515974, "uuid": "163b51b7-af9e-4636-899a-598fca12df6e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515974, "uuid": "34ea063d-7fae-4430-a62a-13e9ff1e8ec9", "value": "Doc_TRW9920.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9dd51c-a5c2-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1647501557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647501557, "uuid": "def71f17-1cb3-48ac-9b29-d46c94501877", "comment": "Malware payload (AveMariaRAT)", "value": "274062bb47897de21cc2fd0396a4f17c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647501557, "uuid": "4122fe36-36ad-4218-aa98-26ce7edea7ef", "comment": "Malware payload (AveMariaRAT)", "value": "35ae8b9822c3230b0a92b77e6fbcd8b322449ad289aeddd437f5bae6deb08c30", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647501557, "uuid": "f3931942-7a30-4943-ab4f-13b09e246e04", "comment": "Malware payload (AveMariaRAT)", "value": "1d87e9dcc222a7e6e652ac55168bf2aed0604820", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647501557, "uuid": "9328676f-356a-4748-ac02-63b623b6ef1e", "comment": "Malware payload (AveMariaRAT)", "value": "4bd6f8772d44a5fbfdc03ce5c8bbdd73d2a3c0f0b2a2ae91662ee92f6007815dc4cba2d25fd969591ebd722f3ed22950", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647501557, "uuid": "dfe343c1-c5f6-4b3a-833f-7e700c0cac25", "value": "T185F48DF1542C57FFEA6B0672A411B0AA70F05C58B1868097B04B3FA6F47A74245EEE7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647501557, "uuid": "476e32d8-3d00-44d4-a6f0-01156fa04d00", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647501557, "uuid": "2a23eea7-ab54-4f1c-b38b-a3230837dbf6", "value": "6144:QGiWbtq6XuJcL67YnehWtIrhtWU4/UYjHElj6l/xtDv1AU5PSk1iIbp3xl45lERA:J5oAU4LgWJxtD9v5PHVl4GqFxhrhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647501557, "uuid": "419b04c4-4e5a-4e27-8693-c0863e42193d", "value": 746239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647501557, "uuid": "f3477f90-2c12-42b5-9869-5fb9226077ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647501557, "uuid": "d3f44957-4004-4d86-8311-04ebc93027b1", "value": "PO_035638.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68f63c1-a5e5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647516630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516630, "uuid": "28a1b7b5-6939-4319-9aba-a7372544eeec", "comment": "Malware payload (Heodo)", "value": "54fd350c3a2b9f804f07245201ea84c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516630, "uuid": "bb7ee834-5a88-4ee9-886e-24aa55c268e3", "comment": "Malware payload (Heodo)", "value": "35ded837e17183f8ddb0438ec888a3c7ac6b4355c37029db806e734cf6b6fa00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516630, "uuid": "8d00ad0d-bb2e-4804-bbb5-bc6db27040f0", "comment": "Malware payload (Heodo)", "value": "dec46d7288a0c7c729e59e39b4c9c644726e74b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516630, "uuid": "61975388-b9ea-4968-9e95-7c7081824b32", "comment": "Malware payload (Heodo)", "value": "b23abcbdd5fd32613dc18293b2e668208488411509e6cda014daae8eaaafbd77ad76bad8a5086a5fec102ec0cc2c1e92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516630, "uuid": "91091fa7-2f62-41cf-9852-3bdb83bf62c3", "value": "T1FA058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516630, "uuid": "5d3b4793-73f3-476d-95c0-3d1de14503a1", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516630, "uuid": "50b4a383-225c-4c85-aa0f-948f1bdd0444", "value": "12288:Wvz1CLJyyvmMLSrBgN4ruGbPlVpqb+DlYzv:WJCLJyybLqBM4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647516630, "uuid": "797ce3d2-f7ef-4780-9cd7-4e65f0c48f9a", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647516630, "uuid": "6285abab-36c6-41b1-bb4b-22b140874451", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516630, "uuid": "5f538eed-cb6a-4ea3-863a-f5bb87a88ac9", "value": "54fd350c3a2b9f804f07245201ea84c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f94126-a5de-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513723, "uuid": "6a68d06a-8bd8-464f-ba48-3fb54071a897", "comment": "Malware payload (Heodo)", "value": "542cb64ae69b1bf05769063e263eeab9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513723, "uuid": "ce4e81f8-4e8b-427f-badb-c803aec0d858", "comment": "Malware payload (Heodo)", "value": "369af0f71c4661bc116c9869ae63baac31e029c84fc20d155529705f3de37426", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513723, "uuid": "6fb84b61-2c9c-4eaa-b620-301d0da83324", "comment": "Malware payload (Heodo)", "value": "531a4cb42e0bd20430b3cdfa635cd6ab696466eb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513723, "uuid": "a80ec869-0ff5-4801-a084-860534245389", "comment": "Malware payload (Heodo)", "value": "4ee65e49d0265675bb1377a14f0b10df1377bccd4e48aa4844f8659e2caa56b81edaca88810753779db8a46e1174a0a3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513723, "uuid": "042d585c-5319-4bc9-be26-dc5ce552f3e2", "value": "T12DA29E2CE921744DE3BB683C420650FA924A1C022147B5ED3991F77D6B73697068FEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513723, "uuid": "c506796a-a07f-4c90-a6cd-045294672e18", "value": "384:D3uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:nsNs/zXtFCBn9kC+xbL42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513723, "uuid": "080e5548-f3f9-4814-98d8-080e70ad9589", "value": 21657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513723, "uuid": "6438f449-1a6a-4e23-98e7-acf91511a61c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513723, "uuid": "454104d1-a03b-4fef-9bbc-c2c553a08d76", "value": "2022-17-03_0933.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de41f355-a5ec-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1647519730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519730, "uuid": "f252dace-5c41-47c0-aab5-ed036d4f3a73", "comment": "Malware payload (Gozi)", "value": "c29d1dc9e9ed594f08bf27ea0bb63ad5", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519730, "uuid": "20f83baf-e07a-4ccd-aa4d-70197e699fe6", "comment": "Malware payload (Gozi)", "value": "372a3aafe51bb8d5e38bc30bd5e33114bec67f3fe965093e697420f42de1c2fd", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519730, "uuid": "11bd9d50-4cb3-4c76-8ade-3aee2aa6849c", "comment": "Malware payload (Gozi)", "value": "f8b6b76645022baffe32caab653608ddcbd05614", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519730, "uuid": "1c60819b-a55e-4128-9845-47d2513917b0", "comment": "Malware payload (Gozi)", "value": "31792d03534723d4ac8a88f2f2c3c6044660be6055b3f713f32319803cf11e8cdff7e948a10869021a8746f2a455bfe1", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519730, "uuid": "73d01320-0277-4b1d-94ef-6ddd42cb24af", "value": "T14B412C1BE8115F1AC59986F5E0898F4BF5903C6869D165480D3D08266BF5D1902C7E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519730, "uuid": "20929226-3f8a-4652-b2ee-2889b72baa4a", "value": "48:9PZF7OY8OdBbLzoyTlF4lJLLAt9E+gk6+vkXnJ4psNt:lKY5bAyTlF4e9VgCvkXnsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647519730, "uuid": "ad2c8bd4-0fe4-43d4-b63a-5376d6341935", "value": 2034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647519730, "uuid": "7515e964-5afa-44ea-9427-983ede320bc4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519730, "uuid": "391cec7d-68f9-4df2-a258-803dba8343f1", "value": "mise_169.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4755d0d5-a647-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647558561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558561, "uuid": "04969b0c-0872-4c68-831c-670f91f701a6", "comment": "Malware payload", "value": "3d7d1ffcb098230e46b55645e7dec370", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558561, "uuid": "7080637c-18f0-4e45-a629-55def31916de", "comment": "Malware payload", "value": "37602441e7ecf26e4874bdee68aacdb771610bd200cdc2a85d14c375cb59b0ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558561, "uuid": "5ba8b686-6b9b-4db1-b99c-5473b6dbd0a9", "comment": "Malware payload", "value": "6af4915486a289311cac8e9266907fb2ffe69efb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558561, "uuid": "12343edd-aede-4cc8-a0f3-538f06eeb46d", "comment": "Malware payload", "value": "0df948613879a58523236f033c3bb7af8cebd1f001aa3837a327635f4801ed8d58c64fefc30922a8ecda904850306711", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558561, "uuid": "931c316a-4223-4bf5-a77b-e642a963b518", "value": "T134059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558561, "uuid": "e53c971f-9559-4047-a4d7-4cc63b1702c1", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558561, "uuid": "f702a9b6-a5d4-4f8a-ae21-0fd40158e929", "value": "12288:V20BXOMcVzpWfmmnDDxX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDNX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647558561, "uuid": "4f58d794-7e2e-4dd8-9925-084c73c7ed8b", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647558561, "uuid": "9dcb8e1f-1258-4f15-8635-6b7553be182e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558561, "uuid": "82e7e013-3cbd-48a1-9942-db26011855c4", "value": "3d7d1ffcb098230e46b55645e7dec370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b0f043e-a615-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647537173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "a5e745e9-0e3e-4941-ac53-8721cf85c244", "comment": "Malware payload (Heodo)", "value": "5b442d1b19b690d37c38af9ed5c71a1c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "b6c4cfaa-aa55-4d17-a925-1d633c0a14f6", "comment": "Malware payload (Heodo)", "value": "37d6a11ac750ade77db686a7140a84750ac01e41067ef84117b1c7808490f57a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "a0ce543f-d8a0-45ba-90ee-c22cf4fa2c52", "comment": "Malware payload (Heodo)", "value": "b81db9e52acebdbc72f347b1f4073ce99a146633", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "4ab052ce-5ddd-4933-bbe5-d57c60651f54", "comment": "Malware payload (Heodo)", "value": "1b510bd09274fc10c857c19ae20a3461106101ffc1c711f8a4ed8eef4e44d2490c36e4740ba3e99da1ce6b6e1ce841b6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "bd14c0b8-84d0-42f1-bf72-346a7788f4e4", "value": "T1FD057C5037818037E7AA58740601BA783D797BE38BBF72925E80957DEE704C3C768B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "0dfb62ef-b273-4f48-b18f-778fce17acf4", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "7bf898dd-0d8e-4e31-bfc0-13dafc4304b2", "value": "24576:xJjq8sc5JGxNNNNI+++++h3/UQUQiSj5URW2AeF+99V3kW5Qk45:xJq8s4uNNNNI+++++h3/UQUQfv2AeEB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647537173, "uuid": "839510db-f348-477f-b628-0cf52b570d58", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647537173, "uuid": "0634afd8-2318-4d53-95eb-f594f787e9be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "39861e86-a8aa-4bc8-8dfa-c2553a7b1823", "value": "emotet_exe_e4_37d6a11ac750ade77db686a7140a84750ac01e41067ef84117b1c7808490f57a_2022-03-17__171245.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7d9ac2-a615-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647537172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537172, "uuid": "81fb4448-2fd1-491d-8018-c46a79c5b3fc", "comment": "Malware payload (Heodo)", "value": "a0d60c94822849555174c3e06b919f3b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537172, "uuid": "94780e23-9077-46fa-95c3-3cd1476df13e", "comment": "Malware payload (Heodo)", "value": "3817e1fecf766300c1ec7aefefd1edf34d6e2a11b39ae3613040f74e4db23545", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537172, "uuid": "5c2050e4-ae9f-485f-9195-fc81e403b489", "comment": "Malware payload (Heodo)", "value": "7061514c10c5e77f0777cf57d56c5a2fb30f2221", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537172, "uuid": "ffe41182-e240-4c79-b2e0-8b74ebe07997", "comment": "Malware payload (Heodo)", "value": "908647be07acb3cfd65150730e466f6b4316067c3a48af5dff355611030965b6fb1511d0eb5454e78d7857ca56fd4b15", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537172, "uuid": "7b61323a-7032-40bd-8d88-a21a8e493c9f", "value": "T137057C5037818037E7AA58740601BA783D797BE38BBF72925E80957DEE704C3C768B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537172, "uuid": "91a7ef2d-a667-4113-91f9-216da6846924", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537172, "uuid": "0dc619ae-bd95-4792-b860-290f8c770023", "value": "24576:xJjq8sc5JGxNNNNI+++++h3/UQUQiwj5URW2AeF+99V3kW5Qk45:xJq8s4uNNNNI+++++h3/UQUQ5v2AeEB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647537172, "uuid": "1d1374f3-0261-4eea-9888-bf93284d4670", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647537172, "uuid": "633662da-b589-4d22-b4d2-9c2e835c10ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537172, "uuid": "d873099d-12a0-433c-99bd-0229f15455d8", "value": "emotet_exe_e4_3817e1fecf766300c1ec7aefefd1edf34d6e2a11b39ae3613040f74e4db23545_2022-03-17__171245.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6329334-a5f5-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1647523608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523608, "uuid": "50c7695c-9761-4aec-a769-0ac08c87a6bc", "comment": "Malware payload (BitRAT)", "value": "9e342a138b0c75165b98fb21f2f8db3d", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523608, "uuid": "ff4fc074-7ae5-4952-a3ce-e634216c94c0", "comment": "Malware payload (BitRAT)", "value": "386b39cb3cc76bda5984f68ee427314c61166aff557d9c243fad0d6b731293c9", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523608, "uuid": "74e90a1f-f319-4dd2-8624-e5a762c3fb1c", "comment": "Malware payload (BitRAT)", "value": "95df40a1c77b388e89e38cded6a50256de4174c3", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523608, "uuid": "fe3284dc-5254-46ec-980c-91a59a8152c1", "comment": "Malware payload (BitRAT)", "value": "d6b49b15e2f7773f1a5fa25ed2f4a0fba6d2350181c5a0d5b018a7435f7ad275564afa63b8f1dc2f980d490fdf64f4fe", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523608, "uuid": "82c96fea-625a-47db-a5ac-01775dbdd9ec", "value": "T10006CF02FA46C562D2170230E96E77BE053CF9354B2085C3B3946E6859B66D17A3BF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523608, "uuid": "32c58287-a8ec-4650-b739-763b0dc9fe82", "value": "71955ccbbcbb24efa9f89785e7cce225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523608, "uuid": "353626ea-6112-45c9-8820-7824c7a696c3", "value": "98304:877Pmq33rE/JDLPWZADUGer7B6iY74M/PmlwXVZaFB:K+R/eZADUXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647523608, "uuid": "510ab963-3f96-4442-aaa0-dcdb991246d7", "value": 3943424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647523608, "uuid": "bdfa4a7e-3525-408f-8f3c-cc8f609aef89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523608, "uuid": "6d5bbe98-c64a-472e-9541-4ad576626a14", "value": "s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd06a5ed-a60c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647533471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533471, "uuid": "fdb533c8-d464-4962-893e-d090ef55f892", "comment": "Malware payload (Mirai)", "value": "75fbef63ac6b845ac71dc2f7b453bc9e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533471, "uuid": "51e40aa3-a95e-427f-9631-b7982a5fa06d", "comment": "Malware payload (Mirai)", "value": "38759669ebe461a772299b05f588222a0e437da34c698ccf0ffd457818825784", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533471, "uuid": "6d10c53c-fd65-4896-a848-92e853ae38cb", "comment": "Malware payload (Mirai)", "value": "c65ea191c0bbac954d4ebc699ee6a08da7a7fc17", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533471, "uuid": "50c99b1c-f8d2-4a35-974a-471994d52f8b", "comment": "Malware payload (Mirai)", "value": "c31f36cddf753c47ae5bdf2bd9e5695a56a524953528272a39777bed05c60f6b02ceab1745fafcca3ea1dffea1536141", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533471, "uuid": "b75b4f09-fdbb-45d0-a9f2-fa45e40f26e2", "value": "T1FA031AC7BC998600C3C40172EE17472D2228F6D4E199EB03E9E4A2746D07DAA7FD76D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533471, "uuid": "61843dc4-450e-40a5-8acf-a6259dcff2a5", "value": "768:95CJbQjZSifPBQ4NOE+vN/NlUZy/WjceRkE:9cidSiXADlUA/WjrRkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647533471, "uuid": "d6da90af-c020-4b1e-907a-e4065f5c8cdf", "value": 39452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647533471, "uuid": "c039e101-8abf-4e1e-8e63-71345cb92897", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533471, "uuid": "8ab979c1-5a34-4d85-8cab-0541ada50170", "value": "arm5-20220317-1611", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64af38fb-a60b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647532840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532840, "uuid": "1f9208f8-1a87-48ce-ac83-703070f96937", "comment": "Malware payload (Heodo)", "value": "19eed8de23cfb553fac02d81125674ad", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532840, "uuid": "8bf4b827-8f19-464d-ba52-a4906c09f24c", "comment": "Malware payload (Heodo)", "value": "38c66cef89135f8797164e1721d35d2e72397312d9c85d722d15759e2ac1f239", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532840, "uuid": "04049221-781e-4110-8357-515f780a8e20", "comment": "Malware payload (Heodo)", "value": "7d48318d4e4a75cf6786bc1bd6bc51444c197a91", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532840, "uuid": "6f7d8751-4dd5-453b-b7f2-3c01ec5069b9", "comment": "Malware payload (Heodo)", "value": "a2ad12a4cfc77a945bff93e6704f1946f73b09f561f175e412f92b85f6543fdda5d2081c2dcba59877d89578b39d5ce5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532840, "uuid": "b417348e-77d6-4738-a514-6a54bb12b049", "value": "T139A2AF2CA521B80DE37A683C830640FAD64F5D023147B59D38A0BB6D5B7769706CFAAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532840, "uuid": "062aafc9-15ca-44bd-b4ff-1d15defc6398", "value": "384:SyuAi/NjwS8EibbwBlwHSYrLb5CzgObff9kC+xbX7o1vfD:BsNyzXTFCBn9kC+xbLoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647532840, "uuid": "28b3b82a-4777-438d-9598-97fe85c8eda4", "value": 21628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647532840, "uuid": "9e431f7b-a3b9-4396-b45a-601e2a7d6743", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532840, "uuid": "c146dc11-e442-4fd0-b220-40727aad5fa0", "value": "Scan_20221603_318477.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e86055-a621-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647542214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542214, "uuid": "9789e28c-9dd9-46a5-9e75-e49ff350450d", "comment": "Malware payload (Heodo)", "value": "8578e141ee1c0e65d10e28d3b7de6963", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542214, "uuid": "8ed930ed-fcd0-4628-8d6c-675cae7b5c6c", "comment": "Malware payload (Heodo)", "value": "3917e3be48cebb9644443706f670ff3405296d1d475664c7ffeaf20607846562", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542214, "uuid": "695c16bc-a782-4245-806a-f771cc989bd2", "comment": "Malware payload (Heodo)", "value": "86b4f87f8d5e5d986a6a6926738bcfb066844488", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647542214, "uuid": "c62c6890-ec15-4da4-abbe-8e01c3797fd1", "comment": "Malware payload (Heodo)", "value": "ea467ec851579f676f36dfe80ccbcb1142a68975674f970a2a7bf9edd110e9608bc73d74822b0c3bf210769a7a8dc074", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542214, "uuid": "455e7294-039d-4cd3-9322-4d6c5dd44e4d", "value": "T1CCA29E2CE921744DE3BB683C420650FA924A1C022147B5ED3991F77D6B73697068FEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542214, "uuid": "b37df515-10a0-472d-9d0f-a984ce4bbb03", "value": "384:H3uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:bsNs/zXtFCBn9kC+xbL42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647542214, "uuid": "a7daf52f-fa62-458e-9a9c-df53cc1c46e9", "value": 21657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647542214, "uuid": "7fb7587c-fdad-4dd3-a571-2d8c7bdddd67", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647542214, "uuid": "309393c7-7333-4e3c-9d8d-02b99d7e1cb4", "value": "Invoice for payment.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44fdf963-a647-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647558557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558557, "uuid": "a6c5adc6-ae4e-4dbc-808b-a17224906eb0", "comment": "Malware payload", "value": "51bfa1cab90ad0b9a52afe9a21096565", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558557, "uuid": "1c23de88-b002-4bdb-9057-ba82e1453ec7", "comment": "Malware payload", "value": "392a4a0b8fddcf5d1dc6b94ab233ddcefbc9e0c6710540770b97c628afb8ed11", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558557, "uuid": "ae869686-9720-4173-bb05-2771d6f12599", "comment": "Malware payload", "value": "6868a0f5cef7e954cd61446330e8473f9d273c46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558557, "uuid": "03f8df10-ffaa-4deb-814f-c744a60b985d", "comment": "Malware payload", "value": "731e2a06abc13b9725bf1df1a3ee5f518f1c541bc2015f6dba3190c429c3ae64f482d048fb17d47b73f0b9a9318fbba1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558557, "uuid": "f5a27677-5e4c-413e-8ff7-e27542e5096f", "value": "T170059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558557, "uuid": "fe31aa16-d966-484f-9e0b-0b7ab72d94c2", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558557, "uuid": "42b29f6e-0792-41c4-a449-0eba1532fd24", "value": "12288:V20BXOMcVzpWfmmnDDWX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDSX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647558557, "uuid": "1cbff9c1-b427-4ff3-900f-a0c6f81a7e9a", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647558557, "uuid": "85d50594-bb14-4e16-8fa8-5fd86cb7d29f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558557, "uuid": "6e95b15f-3307-4e21-b648-f987996e96da", "value": "51bfa1cab90ad0b9a52afe9a21096565", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d7220d-a5fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647525838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525838, "uuid": "749aa7b2-0ae1-4ce7-b963-707c32b2e428", "comment": "Malware payload (Formbook)", "value": "8a4fe566aacd64ccb76f460d858caa42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525838, "uuid": "8af99d51-a8a6-45a7-9831-da63aef0bd03", "comment": "Malware payload (Formbook)", "value": "39992920b2ad02ba761413d61b8c4b7eef23827d26cb50b4236f97c5af7d4d33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525838, "uuid": "3528a179-930b-43b8-af98-bc52373d2804", "comment": "Malware payload (Formbook)", "value": "740c982befd0e3be1b5aa3294a4481f50b30faa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525838, "uuid": "ed35f15c-5517-42fa-9bd5-c6cdacbc2703", "comment": "Malware payload (Formbook)", "value": "21c0da044a68fe283c2f8653193212a542c73346be0b8097e649b8977ce069af589a35dd6c28c507c393961f5042afaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525838, "uuid": "6e9b1e2f-d817-4bf6-999c-bfdf1b68f597", "value": "T184B4E0159B14C197F3909C704ABDEB348BB44EBC2956A40BAAF07C2B717C7B57C8D12A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525838, "uuid": "4139b78a-42f5-4900-a2a3-63e4a70cfc20", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525838, "uuid": "a6c0b93f-5f2b-48ef-9392-e8a530d8b60f", "value": "6144:bGi5dY5KLzDqVsMLMESNvQpBdDWq5vqNDFmjqyxFGRP2Kc27077XZvxPcniXT:nYcXDQcQvdt5vumeP+V2Q77pvxknc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647525838, "uuid": "e79a9db5-617d-42d1-9884-004fceaca4b3", "value": 509095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647525838, "uuid": "3f4da1f8-95c9-4ca3-b88b-723a3cbbd0c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525838, "uuid": "d3496a87-30c8-4512-b081-cb8ac037376b", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35834daa-a637-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647551659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647551659, "uuid": "d6e34ec8-7b39-4d32-959a-c37440d897d8", "comment": "Malware payload", "value": "1e06012fb56b593f0aec90f3b4f4dedf", "object_relation": "md5", "Tag": [ { "name": "ALPHV MORPH", "colour": "#F97ED1", "exportable": true, "hide_tag": false }, { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647551659, "uuid": "9d5607c5-f242-4cdb-9a78-e5c966cfa7ed", "comment": "Malware payload", "value": "3a96c3075b8494fe6a76c6325946ab3f200e75ce26ad886446ea1394b5ac6ba1", "object_relation": "sha256", "Tag": [ { "name": "ALPHV MORPH", "colour": "#F97ED1", "exportable": true, "hide_tag": false }, { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647551659, "uuid": "b2b98d38-1b29-43b9-9661-c120ff78a97c", "comment": "Malware payload", "value": "20d7a428a340e30ff3f3ea5c43b4e2c1f4a1d0cb", "object_relation": "sha1", "Tag": [ { "name": "ALPHV MORPH", "colour": "#F97ED1", "exportable": true, "hide_tag": false }, { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647551659, "uuid": "7b339c05-ea39-4ea6-83d0-ebe179351ab1", "comment": "Malware payload", "value": "051707661ceefbd7a8ef0fd543d15385360404130575b7f1da9d6398ff76368064fd9996b26ea68d3559cb359717bb95", "object_relation": "sha3-384", "Tag": [ { "name": "ALPHV MORPH", "colour": "#F97ED1", "exportable": true, "hide_tag": false }, { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647551659, "uuid": "f5ebf769-b85d-4ed6-909b-5f1be0a1f598", "value": "T15FE5AF95FB43E2ADEDAB14B0305EB33ADE34481C00199FA3DBE45D71B92EB115E4861E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647551659, "uuid": "dc4a856d-48be-44dd-9420-42cc6b509e09", "value": "b995e2d96ad0643b2e68e3050c3eafef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647551659, "uuid": "b305cde3-e7dd-433f-b760-ef98ff00c31b", "value": "49152:BQMStZChL9rV/HFHVnR3/sTUfCgUdbdNza8keItX6e/7SM:CghLfH1xR3/ZqTaltX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647551659, "uuid": "a7c17b46-7687-437b-8262-38c789542bf8", "value": 3077632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647551659, "uuid": "0a4cfed9-fa47-4f4f-aacf-70bee150bdf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647551659, "uuid": "e4d217c8-ff3a-440f-b1a0-774fbfe90919", "value": "3a96c3075b8494fe6a76c6325946ab3f200e75ce26ad886446ea1394b5ac6ba1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc6b0282-a5b4-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647495621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495621, "uuid": "f5d5c623-c6e4-4f37-bf19-6839aa784ef7", "comment": "Malware payload (Loki)", "value": "8f1801919360b240191e7b4f2bb95e13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495621, "uuid": "b7c22994-d490-4ed4-9f7e-d101c532a857", "comment": "Malware payload (Loki)", "value": "3aa4f3ce390f30f71e6214bb8c30b02c3fce5835007bbad4d7cf4dae918222ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495621, "uuid": "90b3454e-0c8b-42be-98bb-5016628f7ed6", "comment": "Malware payload (Loki)", "value": "804bf63360b689472d17419e4111fd9a870da2dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495621, "uuid": "fbcb1faa-7bc7-4701-a38c-b4331d8d8061", "comment": "Malware payload (Loki)", "value": "26de0e844b30a3678c3d4d495939cb04fa2522d27302142030eee435f1c3a1734ab098e69f6fd8d3feac25dc6a588475", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495621, "uuid": "87d05bc2-14bf-4a57-ac0c-af33c4b3cd6d", "value": "T129F1E701E7D8873BEEBA4B7258676341C734FB134C5BDF5F6888521A7E207941163BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495621, "uuid": "fb3bf499-0835-47eb-b329-ac277707bad1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495621, "uuid": "24cc0273-7df7-4230-857a-b0586cb82d78", "value": "96:WTL+j2MCR6MTZQ9JBNLoSkA1vi0gPj0uhtlHgoM0eR1x5yclaDtrrQozNt:BhCRPTa3v1aTP4uh7Hq1TycQDZEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647495621, "uuid": "1ca49045-a8ba-4d82-af28-837aa2fca8d9", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647495621, "uuid": "659edc10-e2ea-4c01-9f6e-496e590f1f4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495621, "uuid": "6259d211-7592-4b08-82c7-b7820fdd116d", "value": "PO ONIMO 9636228.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51bc23c2-a5cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647507038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507038, "uuid": "5df677ed-6e94-491c-84c6-a9d31cb41308", "comment": "Malware payload (Loki)", "value": "81654f34e51691fbb56e5551d964a852", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507038, "uuid": "5bd93119-536a-406e-84e2-acfd6d9a6217", "comment": "Malware payload (Loki)", "value": "3b5304c3fa9ca46262a00c4469b81785468309bc3d3f30365c04669f6473448d", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507038, "uuid": "bea093df-38d8-451d-8494-bb13333ebaad", "comment": "Malware payload (Loki)", "value": "de4fccd4ff7f0bbd078935d09a3e4c1888101aa1", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507038, "uuid": "6ef20831-4493-461c-b996-c18c629a4ec6", "comment": "Malware payload (Loki)", "value": "d582f3768b0747bea5986cd3c81be957eff035eaac23ccfa104318e0a0f9201c65c4b34b37f44ebe8da55d30825f57fc", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507038, "uuid": "b7b74f09-c211-4cc4-8b88-790b8f5c04c6", "value": "T15645BEC1DA8556A4DC19AB316A36CD3542237EFDA874A81D38DE3E273FFF2931026452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507038, "uuid": "2d9267ac-a82a-463e-93ca-3e7247487e5a", "value": "12288:NYxq3V42FxmEZ/8HZMSPCq7L7fHIrwc/GOB5b/KZiaTP7r9r/+ppppppppppppp7:NW2u+mE8ZvrL7vIr5pSZiaT1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647507038, "uuid": "8e69f76b-0033-4dd7-b933-06f21cfb86b2", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647507038, "uuid": "e80e2b99-a740-4d90-9441-551281b533bc", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507038, "uuid": "5a0a638d-e5ee-471d-8526-39bba4fda7ce", "value": "Odeme_belgesi.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ce2fe9-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647518855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518855, "uuid": "4bc450c0-387a-4d6b-ae54-89cea9bfb0b5", "comment": "Malware payload (Heodo)", "value": "7bfd626a8869c0659a0befcb7c71b2dd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518855, "uuid": "444771eb-6a44-44fd-a5c0-923091177a07", "comment": "Malware payload (Heodo)", "value": "3d525c1fa7d15e92fc3d25372de999fdbea30b8bfda0149b276d8ec647ed5f9a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518855, "uuid": "750e50de-a755-4223-a79e-dcfea4ee27f4", "comment": "Malware payload (Heodo)", "value": "ffe9ba1ff5f42cd45b9f542b164029a0e37a84c9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518855, "uuid": "58eb7c76-fc12-4e16-94fb-c0869e2125d2", "comment": "Malware payload (Heodo)", "value": "29932ebd8dc6d10850fad723bcea175986db03f8ae22a0f1af159ca3e733722761d54adb4c659946eb835dfefb1c1652", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518855, "uuid": "c38ce2f2-b117-4c1d-9459-6809923f6b83", "value": "T109A2BF3FD132981CE67F987C430440F6E70A1D86600765EE2C45F26E66726B6038FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518855, "uuid": "90aade36-225a-463f-a9bc-16b52ce50dab", "value": "384:IHTyVb1GNjyo4CGzPd6ZIwGdKb5CzgObff9kC+xbX7zUSA:8uIN+o4FLYCBn9kC+xbLzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518855, "uuid": "cfbb3697-7b6f-4753-8337-c905ff3ea318", "value": 21444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518855, "uuid": "803272d1-a616-40c1-b5f3-ad9f4193900a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518855, "uuid": "53dde003-da14-431d-a86b-525e36dd912f", "value": "Rech 2022.17.03_1121.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0dbda6-a630-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647548828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647548828, "uuid": "9380d4ea-09ad-4b9a-95ac-607158e2c983", "comment": "Malware payload", "value": "da4c6bf4b954d7d890ab26670d619dc7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647548828, "uuid": "5065df0a-99ba-461a-8d37-d537eeefc948", "comment": "Malware payload", "value": "3d5fcc1ad097a1e7b58a23f4afebe161b307e563c938650d65e2ac71e91dcdce", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647548828, "uuid": "fb20f5cd-a199-4d3b-bbcf-6cfb88ee7d47", "comment": "Malware payload", "value": "4f835c61b11e203882ae6471a290dc4e5748075e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647548828, "uuid": "05f83ac0-9d5c-426e-b291-1434dcf8a4dc", "comment": "Malware payload", "value": "841833df9ec10503febc8b631d39577e4c5a9a440b6b29b64010ba3b6012f6c328144b8b92415e704ff78834804aeeb9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647548828, "uuid": "3a600a4a-37e7-48e0-9ee5-6cdf33019a2c", "value": "T1AEC42B017896603CDFDA363601F7EB2531E75CB0677CB52E6EC168EC9B2628A051D63E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647548828, "uuid": "dc8596e6-b389-4ab2-a68f-c6f4145f1935", "value": "fe91b35dbbcef6d3f3836ad3e8b836df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647548828, "uuid": "2326e4e6-3742-432f-9b89-1a2e65a3eba2", "value": "6144:xe4HnxyzcUzcUin5jBd4hp3CBj6O7O7OOuw/RRRI7E7E7E7Z94kx8888rLCkxEZz:56Kv+tEgqNdov6eimJEeTN+sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647548828, "uuid": "1e335e18-0afb-4107-be51-c27295e510e2", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647548828, "uuid": "8f03f7a2-766e-4e0b-9239-ae389cd4a098", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647548828, "uuid": "8bf95783-ccec-4c3f-bc94-6f993e6f6752", "value": "kytk.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b54c2c-a619-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647538801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538801, "uuid": "4c0d27b0-1673-4d89-b348-91c6168aadbc", "comment": "Malware payload (Heodo)", "value": "bfab3257a1424bf31b5ea042ca3ac861", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538801, "uuid": "65087a6a-9bdd-4f53-adfb-f1dc1329d555", "comment": "Malware payload (Heodo)", "value": "3d736cb946a728a2dca5b2b96d585ce785b5a95a528627cb4d98909d46cddb3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538801, "uuid": "3c347915-55a5-4172-a48b-d755da775775", "comment": "Malware payload (Heodo)", "value": "e9e8564750cf9ff50d8fa8ab6955ea4f286e0cd4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538801, "uuid": "84c693e8-b766-4e19-a5fc-8287044456d7", "comment": "Malware payload (Heodo)", "value": "ad542ec03c18cef84a862e20725bfa57f5bf874f2e1f4f5c063453c26e1d716b9f5ea7618db208060b0d025ccbe4c2fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538801, "uuid": "ec896e00-8824-495a-8df7-c09f89b6290c", "value": "T1CB058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538801, "uuid": "de3777fb-8d46-4f19-8db2-c252a07b9362", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538801, "uuid": "0ad070ba-fa8e-4414-8c8c-28ecb5cefb2f", "value": "12288:Wvz1CLJyyvmMLSrBgf4ruGbPlVpqb+DlYzv:WJCLJyybLqBi4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647538801, "uuid": "c7459c12-10c6-4af6-9075-f428ed4410b5", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647538801, "uuid": "be5f0241-c919-4251-ad3e-9f4cdba1f752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538801, "uuid": "3352a798-8909-4216-bb1c-81abeaeb845a", "value": "bfab3257a1424bf31b5ea042ca3ac861", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502a3949-a5cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647507036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507036, "uuid": "932919b4-c6d3-4bd3-9987-76eed88451f7", "comment": "Malware payload (Heodo)", "value": "d621975534d86a1913256c58c3b0da56", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507036, "uuid": "f62a4c1a-22ee-49ed-a9de-700bc4f8577d", "comment": "Malware payload (Heodo)", "value": "3e0240d07f18728f653f50f0de1a8f944626cc1a3f623b78f99d5f284424851a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507036, "uuid": "0c997188-647e-43ea-b0b7-e9fefc844337", "comment": "Malware payload (Heodo)", "value": "4bf510eaab6d34412e678392faeaa8c1278826c0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507036, "uuid": "a9300aaa-505d-4262-8dff-1273d11ff0b4", "comment": "Malware payload (Heodo)", "value": "95f588ec05fd68b7ad98acf90f4aba911ebdfd6ce7f79df779a19faa6fef9df075b6e69ea964c4d79fb612c1826a6e0d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507036, "uuid": "a1e188ba-a9fc-4b60-a728-35eb2749e60f", "value": "T152A29E2CE921744DE3BB683C420650FA924A1C022147B5ED3991F77D6B73697068FEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507036, "uuid": "c0b6d4b7-bb87-48bb-a63d-c28abb446a50", "value": "384:j3uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:HsNs/zXtFCBn9kC+xbL42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647507036, "uuid": "bf55af48-f83a-4161-9813-e227c8386ccd", "value": 21657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647507036, "uuid": "c98dea9f-7678-4af4-9f4e-f261769b3112", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507036, "uuid": "8d33dd79-1928-4530-a10b-c013e8aeaeeb", "value": "Latest payment.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80fd6616-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553503, "uuid": "c20125d2-22d6-4c60-abec-889c3307a625", "comment": "Malware payload", "value": "e10dc72298fc8c99095950744d1ef7b6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553503, "uuid": "92114a12-85fb-4c3a-9f3d-8000d39a935b", "comment": "Malware payload", "value": "3e42243c593c0f4d4ce56ad03b04540d4444c960d6e698f8eee56cd815bdfb4a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553503, "uuid": "d2843f07-d542-4697-87d1-cfa05e8753da", "comment": "Malware payload", "value": "0fd2fae6b5d57baa3854cd1ea8ca3afdac3a31a2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553503, "uuid": "8547b1ab-9e01-4d6c-9304-2a0507813e91", "comment": "Malware payload", "value": "7ad53820a4a6a5c6a8f849f290282066ac2880782ee6e618c44cd274321d0da8b3dcd909594cfd275c3c6b7a8fde9fb7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553503, "uuid": "54624d4c-7f08-4cf3-b973-e69284d1b931", "value": "T1AC059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553503, "uuid": "7513d687-5641-4ca5-ba17-6a77838ef452", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553503, "uuid": "b291f2f4-d2d2-4e2d-9c15-af2de0ec3bec", "value": "12288:V20BXOMcVzpWfmmnDDVX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDRX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553503, "uuid": "1fd98f88-0017-44ac-8a47-cddc8d6f8a2a", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553503, "uuid": "a85f5535-0e85-4fb1-a925-a1a87fe3a1f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553503, "uuid": "2131ec7f-0a3a-4ef7-b566-f29a8d5d2c5a", "value": "emotet_exe_e5_3e42243c593c0f4d4ce56ad03b04540d4444c960d6e698f8eee56cd815bdfb4a_2022-03-17__214455.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938907b7-a5d3-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647508867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647508867, "uuid": "da254253-b54d-445e-a5a0-3537ba7e0787", "comment": "Malware payload (RedLineStealer)", "value": "d99744b66249bea6f7dbed284ada1cdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647508867, "uuid": "11ae8376-0606-44f5-b06c-a32882c31df0", "comment": "Malware payload (RedLineStealer)", "value": "3e7a0a1f11097e02ae12abc589907c6d8a0a373b0001412d80573aee6bd4d748", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647508867, "uuid": "0665466d-1fee-414a-b24f-833586dee53a", "comment": "Malware payload (RedLineStealer)", "value": "8f58385af61b8de842957bcd07e4ee686f9f82d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647508867, "uuid": "d58b734d-e960-441f-aa90-76570d2d6d56", "comment": "Malware payload (RedLineStealer)", "value": "e8f7865f787ab95b000f83d24178b51fffe679aec01bea47760fe24ff9dc0b684843c7ed33db3f348e9065abb4d6ff65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647508867, "uuid": "194d1f5a-d9bf-4aff-b7e1-edc98837b518", "value": "T17784CF40B6A0D03DE5B341F8BD7593ADB42E7DA15B2024CB62E62BDB16316E0DDB530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647508867, "uuid": "2cac6b87-424d-412e-b229-fda98dd92a8c", "value": "b472aaf48fca3ed6a184088234bd1425", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647508867, "uuid": "02533a3e-b08b-4df2-840a-b2d3990f2eda", "value": "6144:xFMpM4Di5wf52qWTeVvc4kXL17DmRtSfrZ4HoVLCl2:xFd4Di5SwqWAU4CLZmuTyiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647508867, "uuid": "e3699bf8-e754-45e9-9422-13744039a534", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647508867, "uuid": "2acf6307-0aa9-4bc5-afb4-697727f532de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647508867, "uuid": "5ffd888f-e53e-4881-98f0-7517e0184501", "value": "d99744b66249bea6f7dbed284ada1cdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c91835-a5e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647515748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515748, "uuid": "af751b49-7842-4cc6-aef2-a11bbbb16bf6", "comment": "Malware payload (Heodo)", "value": "b6915a0349ad81d14c4729c9ada182b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515748, "uuid": "a27b4c10-21f2-43c2-8ba2-3705d1422ff4", "comment": "Malware payload (Heodo)", "value": "3f6f1ccaf05f702471ca1647a4182081282c7153699e3f49e6d4ac16f397d7f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515748, "uuid": "ec4596e7-1e6e-45d0-b7d4-ffea788f4c3b", "comment": "Malware payload (Heodo)", "value": "7108d52ac3af67434a1f84fd8f4747987e1e4a0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515748, "uuid": "82581556-dc91-4931-a551-6497999939a2", "comment": "Malware payload (Heodo)", "value": "69edda71157f4fa11aeeb1d5b5e2c52822f3d1b30a337c1abbd708c15ef9f83497e1c22bed5058496de2995b776d4b74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515748, "uuid": "7a1ae828-429b-4929-9bb3-c7b626d048ba", "value": "T174058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515748, "uuid": "3b42b74a-2a13-4053-8293-aff84e84c6da", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515748, "uuid": "9f12b8ff-2ab8-438e-b4ab-207cd9e8c745", "value": "12288:Wvz1CLJyyvmMLSrBg+4ruGbPlVpqb+DlYzv:WJCLJyybLqBD4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515748, "uuid": "dfa55e55-23c7-43a4-9f1f-43202ac14b53", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515748, "uuid": "ed77d2d9-a996-4f31-91c0-0eeac8bbdd03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515748, "uuid": "6465d7ec-460c-45b3-ab20-0183f78597f2", "value": "b6915a0349ad81d14c4729c9ada182b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e8d2ed-a5bb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647498623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498623, "uuid": "be04b6c5-b1e1-49fd-894e-59511ab46db6", "comment": "Malware payload", "value": "7d8a9ab8b36169a7c160f7a5f60e3ac2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498623, "uuid": "af144fe6-7566-4bee-88a0-23123d4c7180", "comment": "Malware payload", "value": "3f74da2639b650bcf628332a9e345e57a599632e893f71628e299dc66f8d9589", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498623, "uuid": "854865cb-17b9-4ac7-b026-9944f3aa8e1a", "comment": "Malware payload", "value": "4c955cdfc26f62778e5dabdd24f115b4d513f07c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498623, "uuid": "ac9234ea-c5b2-42b4-a05a-a7a845a12789", "comment": "Malware payload", "value": "4489f330e025b8ed0a4971867589a429c6cdc6b7b19cc4b1283c8d46aa601522f6df280a90dac0e354a0d74c2e8fc153", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498623, "uuid": "ef13493e-2aa5-4161-b821-ce26e9519ffe", "value": "T1D8A63314A3401CECF1F2103275644926D53A78324760E98F6B68622A9FB7FE5BDBEF50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498623, "uuid": "6e4fa3a8-a615-4fed-9fb5-58c30c81fed5", "value": "c5640c7a22008f949f9bc94a27623f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498623, "uuid": "cbfd3de4-928d-4961-a6c4-f8e8f2e722e6", "value": "196608:JVl4XkYUGx7/ICteEroXxWVfEqlbkkwR7VTEiwYgFFNtf8kmXQeDXjyjeyZG:l0XUU/InEroXgfEqirRRozYgn/f8kveg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647498623, "uuid": "760eee9e-11c5-45ca-8525-83fc3fe41d5a", "value": 9705983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647498623, "uuid": "028417d1-a835-4b7b-95d3-82cec6228691", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498623, "uuid": "73030172-76c7-4ff6-9247-855bae9c30dd", "value": "68796819.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155cedb3-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518534, "uuid": "38c38bf8-11eb-4e4b-b002-183500fb51a2", "comment": "Malware payload (Quakbot)", "value": "8a6837b631b6b816867a216174b8a004", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518534, "uuid": "f493ca40-4782-4cc0-80d1-ce05d9b431e2", "comment": "Malware payload (Quakbot)", "value": "3ffd62eba858da0f4da41432a94857ec9b15169d4cef87e84509f2d47f179a7d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518534, "uuid": "3ca367be-b2c0-4387-9b21-c2fd0677520b", "comment": "Malware payload (Quakbot)", "value": "b338641db46c6cab344711a5498c8c76c5c1b5c3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518534, "uuid": "b931761e-f82f-47c9-8ae7-477dcb7a1ede", "comment": "Malware payload (Quakbot)", "value": "17b4e3d8bf85637356d376adc095aee2c92d68dda955795617afc30322ac240cd23333b94081aec328dbe581d7c08ac9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518534, "uuid": "a6dbae47-cc96-4349-aec6-6844874ffd4e", "value": "T1FD15BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518534, "uuid": "65ed2371-2c23-46d0-b549-e480dcb71dc1", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518534, "uuid": "c59dbb3f-5e5c-4ce2-837e-4e53ec0bfe67", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518534, "uuid": "687fb12f-232f-4db4-93d1-15f0e96ec6d9", "value": 953186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518534, "uuid": "5abac62a-6e84-4f0b-8065-6ac654cf647a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518534, "uuid": "e5808e1d-d4f7-4468-8a2d-afcb547d2bdb", "value": "3ffd62eba858da0f4da41432a94857ec9b15169d4cef87e84509f2d47f179a7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c88ac3-a5f1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647521568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521568, "uuid": "0c13a304-b031-4757-8427-9bc9821d77f9", "comment": "Malware payload (Heodo)", "value": "f5e8245bbbfdd4eece28341709444c97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521568, "uuid": "15dde360-f4b0-4344-9e60-de32db7f8fa0", "comment": "Malware payload (Heodo)", "value": "4068467e6e7e21f4e6624b6a910c371f58413bbf6932afb1108faca8e1057b26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521568, "uuid": "828382b4-2fc6-4c96-ae02-ba4ac432f23f", "comment": "Malware payload (Heodo)", "value": "bee7ddddff7fcaebf2d530b72812290a068631c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521568, "uuid": "859abc01-44d0-4594-a44a-c093bc3e7839", "comment": "Malware payload (Heodo)", "value": "a5a177d16d2e6994bccc3bbedc2502bb5ec7f87d5df846cbaeb769e2ae22b2e81c876fc0e8091ae2890921939b9ee38e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521568, "uuid": "f005f436-8998-452a-afae-86773aa2b75d", "value": "T1D9058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521568, "uuid": "d3058e6d-4744-4c71-9592-141b4262ba72", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521568, "uuid": "c6c776fa-afea-46fe-8a55-a5470274fb25", "value": "12288:Wvz1CLJyyvmMLSrBgb4ruGbPlVpqb+DlYzv:WJCLJyybLqB64ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647521568, "uuid": "dfda18b3-c490-4317-b591-e97cbbb53f20", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647521568, "uuid": "c181b149-6514-478b-b256-74368bc63ebc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521568, "uuid": "fa2b24f5-d452-4759-9fa4-adf4c86c482f", "value": "f5e8245bbbfdd4eece28341709444c97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb56b65-a5e4-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647515940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515940, "uuid": "f6589eb2-ea92-45bf-80bc-79b8aa3d432b", "comment": "Malware payload (Formbook)", "value": "5b721574328d607e2aefaaf78d54a4a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515940, "uuid": "ed9718c0-18c4-48f8-966f-1d06b098edf8", "comment": "Malware payload (Formbook)", "value": "40fa9ba8113198bf73af0101d0c0275ed1ef014a15fd83457dbdbd29e80f99a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515940, "uuid": "7b7136f2-4e3f-4605-a3ef-ce5abf3053d6", "comment": "Malware payload (Formbook)", "value": "f62ed63dc0558ffdba1289ac8221d47476bdd645", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515940, "uuid": "3db2b154-2913-4cc2-8603-03807ad5381d", "comment": "Malware payload (Formbook)", "value": "462eb7bc83b72b15ea8b41cdd69dd3475ed8b211ef275afef87b63bb5be31ab3527687eb950608e042053bc4f328ac18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515940, "uuid": "0551b691-148a-41ec-ad90-0a61f935d23e", "value": "T144A46B7E14AD5337CE7BD6728650141AF691D1EB3902AD28EEC31B820D176CA3FC692D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515940, "uuid": "05c1676d-cf4c-467e-bf4f-3200969243bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515940, "uuid": "dc08a6bf-bdf6-48ce-b190-3817187953fb", "value": "12288:goEu5lT5UePF/C1MF4EDRh7CkcBRZ7sqVc8ao:V5llRPFPF4ENBOTnu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515940, "uuid": "e51a00bc-9185-4bc3-95d1-a40d94ca1ca5", "value": 455680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515940, "uuid": "5440cec0-7565-4f11-b0a7-ccfd3f0731e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515940, "uuid": "b381f2ea-c9e1-4097-9570-07dfd5d55c63", "value": "statement of account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c2f644-a58b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647477804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647477804, "uuid": "b6fccc77-a936-49eb-9338-a11bab522bbc", "comment": "Malware payload", "value": "a56fbb50f0805f1277c990ae222891a7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647477804, "uuid": "1899d594-aa51-4a53-8480-5b40f887a1a4", "comment": "Malware payload", "value": "4130989c4b4ac68a41ea56fde6875141918fc77ab8791b3b7f6c8c6749ef17ca", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647477804, "uuid": "ee998bb4-4780-45f4-929d-49bd7ad33e79", "comment": "Malware payload", "value": "696e5bd6a2889c0b516c1e43a611c975fe721576", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647477804, "uuid": "8a32e222-31a2-4de1-a0d4-76c078784826", "comment": "Malware payload", "value": "ee8a36ac20154d0bae2ecf47f9e9dbdaff4090fa11cca8aae389d6302263bd2e4f673ee1146f522e1292e87893ce7e3e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647477804, "uuid": "fe8c46ec-4f10-478b-8eaf-e76c35bb6be7", "value": "T1A2B49D11B6D1C07AC1AF02711906D25E73F2FA508BB99B83BFD44F7E7EB41928A34295", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647477804, "uuid": "6055d829-4b4e-4bf3-9020-18e1d675de1f", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647477804, "uuid": "940eb8b5-b55c-45b4-807b-28c84613b092", "value": "6144:WZ7T8DsyVvuJb8fTSeOPwSyeuRJ0tvZVKudKV9M/9KnAuMW4d/GBdYtkoL7OSEfe:WZjb8BOPxue5dKV9M/98f0koPJXvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647477804, "uuid": "85fdfbc8-f5bf-415a-a9dd-4c2536ad3a35", "value": 495996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647477804, "uuid": "d0a934bc-ffd3-4fcd-ac6b-592c419486d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647477804, "uuid": "f8e5db8f-ddbd-4752-b5f5-1b5cf3c2df8c", "value": "emotet_exe_e4_4130989c4b4ac68a41ea56fde6875141918fc77ab8791b3b7f6c8c6749ef17ca_2022-03-17__004320.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "480bc023-a5cc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647505734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647505734, "uuid": "9076c973-d82e-4d31-ab9f-ae0782d9ab5d", "comment": "Malware payload (AgentTesla)", "value": "bf0af4d73ed7c6a3a0deb96a1e84b4f0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647505734, "uuid": "b7d50eff-b7a1-4fa5-ad05-4c199fffdfc8", "comment": "Malware payload (AgentTesla)", "value": "42e15b80fcb901f018cf51baf1c0e70591d9f60cb8c3e6f01628c1f7d7815db7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647505734, "uuid": "8d29835b-0b11-4d58-a983-da61ef9a74b8", "comment": "Malware payload (AgentTesla)", "value": "22f36562d62c9cda2a158bec96b3c92886e813cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647505734, "uuid": "1b340476-4fa0-4e3b-a2d6-490cf054ffd5", "comment": "Malware payload (AgentTesla)", "value": "fe733a1a9d65c4a646c63705ef81a9839104d01f68d2994fae1296f72c2e1b110b024b4f5415f91bb17eb32baeb6afea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647505734, "uuid": "53c7ef54-c308-4ffe-8668-760d46303154", "value": "T173742397AAD5E967E67305B21CF7D5F9C3F35AE4D12006170B804F1F3E30A1A0A595A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647505734, "uuid": "a73b2919-ecd8-4996-958f-f0f376d03c25", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647505734, "uuid": "38d8eb4d-2f80-4b68-b574-033f3fa5a859", "value": "6144:rGiHBTE5m3q8FzuuzYTWEtBGQ09nm2vM8fj8H8iByu89OwVhspUwIy0:5XFicManm25j8ci4Qwzs+wIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647505734, "uuid": "c3794513-7f04-4639-a2d0-4a441356b74a", "value": 362488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647505734, "uuid": "f005d348-83db-4926-9af1-2212279ef4a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647505734, "uuid": "ff3933d6-624f-47dd-a888-3b079dba7161", "value": "Rosegold22222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3ec705-a5e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647515758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515758, "uuid": "52dced42-a0ab-4196-a342-e5f17356b5a4", "comment": "Malware payload (Heodo)", "value": "1d6a17d2d01d0291f3fb31e8f4d78dc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515758, "uuid": "f1c26d23-a7b6-4f20-8d2a-b3c36d6d1438", "comment": "Malware payload (Heodo)", "value": "4399c8c82f019c0dbf531e386a43ce293fa0845ce5d0c9225b3a4681770d7f4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515758, "uuid": "06edc880-0891-456a-b25c-fd6cecfe4515", "comment": "Malware payload (Heodo)", "value": "c5f3e88db8f8a7c6a5bd32a13d44eeab2d11fdf7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515758, "uuid": "49caa448-0836-4aa6-9fd9-ce03e4d658ac", "comment": "Malware payload (Heodo)", "value": "f2a48b000160969ff1827fdd3b22310e037ea1ddfb4ee0b519f87dac9fa5ff6f006de50d9003350a0edb95bd441a44f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515758, "uuid": "147a1c5d-f88c-467b-8856-cc2160f2fbf2", "value": "T141058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515758, "uuid": "2e87602e-50de-49b0-b6d9-04055c100208", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515758, "uuid": "8aced621-e1d2-4eae-8b65-816d5cfebb3b", "value": "12288:Wvz1CLJyyvmMLSrBgq4ruGbPlVpqb+DlYzv:WJCLJyybLqBb4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515758, "uuid": "058d3203-95f8-4a54-9d05-54f921edf52b", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515758, "uuid": "6b0cb574-30e3-4703-88a7-9437885f6a44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515758, "uuid": "35954ede-32d7-47d4-9fb6-b3a17dbebb82", "value": "1d6a17d2d01d0291f3fb31e8f4d78dc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad6afb2-a64d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647561036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561036, "uuid": "6f41d9a6-9322-419b-bffa-7654e10b22fb", "comment": "Malware payload", "value": "91a3d0c8998d7ad6c68da68b0c8e33f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561036, "uuid": "16c956e0-07b3-4149-bcfc-71d9dff2edff", "comment": "Malware payload", "value": "44757c9d36c831a05b1fc8c283bd0c032be475e182eb979f64ff8e4c8e8d1251", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561036, "uuid": "0509f740-facc-4825-91a3-4ec698060689", "comment": "Malware payload", "value": "889aa8426b5063869d8ff26a0841735c921c5cc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561036, "uuid": "caf2b1b8-87cc-448b-81bf-cafb787ccf80", "comment": "Malware payload", "value": "d22c9079fe82397aff51d27bb80e8540fe5886b1fe6f48c596fd35d3d07b1357d8e8cd0f37808d852a4943db814a32f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561036, "uuid": "24425ab6-13b6-453d-b63a-4d30d2261041", "value": "T1BD4302AA0F146B48F94A9123119960877CDB89DF52BC227766C00DAD0DB6FE1CF21F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561036, "uuid": "1969b893-7927-4ebd-acdc-d95b634c013e", "value": "1536:/wDa9thvCo0RSrpi5sjEpl/ZMfF3+hTkFDCLQ34ct5gtz0:L+RSrp1WbMfF3+hsoQoumtz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647561036, "uuid": "f05a3a04-13c1-41e2-b809-cd704c343a44", "value": 60184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647561036, "uuid": "9e7f0793-4a86-4394-ac87-65f0558c4c31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561036, "uuid": "81aecf4e-1d0b-4f52-93cf-4ac1023513d7", "value": "91a3d0c8998d7ad6c68da68b0c8e33f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6cd1f3-a5fc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647526651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526651, "uuid": "6ca24d30-190a-4c75-8f0a-521cbc4040b1", "comment": "Malware payload (AgentTesla)", "value": "5bbf1ac7511f74613fce70d43ac6662d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526651, "uuid": "728c4d81-6259-4434-840d-bfe002c524c1", "comment": "Malware payload (AgentTesla)", "value": "44788b7fa546e301e226ffb82982a2e621139bdfe697d31f0003b0bea2fba5f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526651, "uuid": "0ea4efd5-6796-46c3-8454-468f9fdb5a16", "comment": "Malware payload (AgentTesla)", "value": "0c076e866ff5ef8508e6016829a44c237f8276a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526651, "uuid": "fb404341-a40c-41bd-bdec-4f40d82e88d6", "comment": "Malware payload (AgentTesla)", "value": "a268a8b68d10293929e1475d7145da3794efe8a86ae269c706851f32c527dac6012b886e103f7168040f4385280fd0e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526651, "uuid": "ffcc45ae-0de3-4601-8aba-8c20b26edadf", "value": "T1149423CAC828DAE84DEE486CB6E3455B5534BBBC11C7EE638F4EE108940D37D2A4DE51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526651, "uuid": "d1012d1a-ddd5-4131-b1e8-248c63ccfa74", "value": "12288:h2N04b1cEWJJGtSde3hNGQyu9hEhx6UtbCdbTGs:UN/b1tPtSdeLyAhktCnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647526651, "uuid": "9fa9c293-1918-4999-8117-9e11dbf7329d", "value": 439126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647526651, "uuid": "974d8c08-70ab-4c1c-b01c-c21f6da3e106", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526651, "uuid": "17de9e68-8cfe-460f-891f-6127b95e432f", "value": "SOA.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c0c38af-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518625, "uuid": "65d09844-d1b3-4d18-a832-a3387881025a", "comment": "Malware payload (Quakbot)", "value": "aaf9db74093b270f8742864361ba3a45", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518625, "uuid": "1bfeb9fd-acf1-485f-96dd-1fdd2b1877ac", "comment": "Malware payload (Quakbot)", "value": "44d28956c8ca91b1a81492faa9f8358e543441642bb8be7d1d17c5bb3bc8c69f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518625, "uuid": "a167a0ef-bfe6-41c3-9126-8880659052a4", "comment": "Malware payload (Quakbot)", "value": "f9921915af95beea1ff4971617c23d89d8b7d32c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518625, "uuid": "2df9957f-64f7-4795-833d-519f9a31190e", "comment": "Malware payload (Quakbot)", "value": "aeb1eae0a101df2cf825bf510565deed691b524dde9a950746a382c1c79eab629d4bed5407575960ef3479684aaa1d26", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518625, "uuid": "bf205d15-7632-4a1d-92b3-80bb8b257864", "value": "T16B15BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518625, "uuid": "0d74d81f-6778-4e26-b2c5-a8686e10cea4", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518625, "uuid": "b3223a29-e410-4dc9-aa20-c6a54c1f11f0", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518625, "uuid": "7663c613-2fdd-490f-903d-03a332d274db", "value": 944177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518625, "uuid": "6397629d-4f4f-4729-be9e-88324850c668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518625, "uuid": "bf7471d7-a148-49a2-8627-dc961538439b", "value": "44d28956c8ca91b1a81492faa9f8358e543441642bb8be7d1d17c5bb3bc8c69f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c919db-a5f5-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1647523574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523574, "uuid": "0c242eb6-e73c-4eca-be5f-9c3c91e92d4d", "comment": "Malware payload (BitRAT)", "value": "3702037393f33c2dfe37ffdb2d91f8e1", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523574, "uuid": "bc28d0dd-62e1-41c5-b4c0-4716886e7eef", "comment": "Malware payload (BitRAT)", "value": "461e0c83c06e8d9a92f96883f823db68d910fee85faea7af4b6ccc5fa8284905", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523574, "uuid": "f8746620-9c06-4824-9a47-e30baa7fda20", "comment": "Malware payload (BitRAT)", "value": "2a10216de2a4d7397c9ded4bbb5c6b05eb5a2285", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523574, "uuid": "4d87c0ef-f29a-463b-bf81-5d50044b6730", "comment": "Malware payload (BitRAT)", "value": "abe0124e9508740565dd784bd525b84e6adf09342049225d98ade1831ea5d0a32328f8427134dec1cd7256193b287922", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523574, "uuid": "a4ec9ca1-7a52-4c7e-abb5-269246e8bbf9", "value": "T1EB06CF02FA46C562D2170230E96E77BE053CF9354B2085C3B3946E6859B66D17A3BF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523574, "uuid": "f180cf65-cba6-40bb-aa0d-43913fb231ee", "value": "71955ccbbcbb24efa9f89785e7cce225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523574, "uuid": "7f3253ea-5c50-4639-8e0f-c96b1103e52a", "value": "98304:877Pmq33rE/JDLPWZADUGer7B6iY74M/TmlwXVZaFB:K+R/eZADUXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647523574, "uuid": "61ef5748-1d84-4086-b982-ce8d6a862ada", "value": 3943424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647523574, "uuid": "6e1a2c23-ad5a-427c-a751-bee739e741f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523574, "uuid": "9646a3e8-06a3-49ac-8a7b-52390836b9a8", "value": "a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141e9012-a5e4-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647515955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515955, "uuid": "735c54cb-08c8-4a2d-be39-ce5b5132bae0", "comment": "Malware payload (Formbook)", "value": "e5e0107332af4bc79dca4cebacad88f2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515955, "uuid": "cbdbd53d-c9bc-4b05-8a02-2cfa426e20be", "comment": "Malware payload (Formbook)", "value": "47140d802730c933124136ba8606acc1cfe44e8ca8ce032d3e2ac402864326d5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515955, "uuid": "163eedf2-4a72-4cbd-9753-9fe10d487f0c", "comment": "Malware payload (Formbook)", "value": "a76e1c2f72e3de6f5dc112a425f55cf6a2679aeb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515955, "uuid": "e012ace3-0194-4982-83f1-6c46b63b35fd", "comment": "Malware payload (Formbook)", "value": "6261e55a2ff3854f37103e3cc887af75bb3d2458348b61e38d01ab9390168a82e5a7cdc998056cc7a1f6f1008896c271", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515955, "uuid": "44fda313-4ac7-414f-95e5-f3e103a1a77c", "value": "T13F141286E66280A5F16F25781AAF82515633FD00EA25EE38717C775A6CF0B8C8513F63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515955, "uuid": "1152db8a-6204-4794-ae60-e342f1fce1c2", "value": "3072:nHnf895eMqnkZaT1NdhtEiXJxk8yvP9ybQUTkB7+HPivM:H0eMqzDHJxKIUmkFMPik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515955, "uuid": "9fae8548-f628-4729-9fbb-b41497e11466", "value": 191320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515955, "uuid": "f8751415-cfa2-4843-9263-be5b81ad6aa5", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515955, "uuid": "057450cc-5efb-44f2-869d-a8332f09d41d", "value": "RFQ547788.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070b4739-a5cc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647505625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647505625, "uuid": "9c804d78-33bc-4ad2-86d5-05c434bd1917", "comment": "Malware payload (AgentTesla)", "value": "ce2a52c2283a9dd366a533d261200ddc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647505625, "uuid": "b2767210-373d-4c53-9cb1-01f414e84f13", "comment": "Malware payload (AgentTesla)", "value": "4719bacba228ae5f5976f29644ca2b81b6816668429e35ddb7572462ef276978", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647505625, "uuid": "2458005c-3ed7-418d-91f8-b705d8346d19", "comment": "Malware payload (AgentTesla)", "value": "28f24fb3216e130c95f7f8970e54d41752f536c7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647505625, "uuid": "999e73c6-84e1-4758-8579-6226b011a50b", "comment": "Malware payload (AgentTesla)", "value": "ece6f7b5a94f2d471f3451f335611929bcffd1bf8cfeed4661adbda525e66c31c6234cc21c5523601f8fa216f8305fa1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647505625, "uuid": "401ca90a-6f20-496e-919b-016dbb1d4005", "value": "T100742316F1C1B7FBC66355395AB5EBB8DBB70AC96197212A8B140F583F119C30407AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647505625, "uuid": "c9c82f01-2d35-4600-8bbd-ffa4ece8354a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647505625, "uuid": "36106dde-3ad8-428f-b464-568daffee742", "value": "6144:rGiFbBYtNubKHSCAUhHnTPrtIMo941hIjbkVu4U5O:BtwBcUhnSrmIji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647505625, "uuid": "6a2a8125-ffd6-461d-b21d-79858c86f9f8", "value": 363103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647505625, "uuid": "1cdfb5ce-7a36-4f38-9af7-ff47f5ad6d5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647505625, "uuid": "be0ff52a-6368-4bf1-860e-8b94511555fa", "value": "documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0177df-a5ad-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647492693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492693, "uuid": "34d2f5a0-2e3c-473c-aa6c-0ee7ae289d22", "comment": "Malware payload (Mirai)", "value": "7a45d3b81b764ea50df4224a409c43cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492693, "uuid": "28e5fc6d-e24f-4e4a-8b08-fc276c00af8b", "comment": "Malware payload (Mirai)", "value": "478cc7fbf00bd217e36ff2c1ed9b902d14622c08ca0c940437e95da7c4c733de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492693, "uuid": "852dd280-4613-4a47-8df4-cdb691dd53e8", "comment": "Malware payload (Mirai)", "value": "e7782d4aaab8ea240a6b1206b7a3c46ef9517c96", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492693, "uuid": "84bf6d5b-449f-4f71-82d8-10ce1f8befa2", "comment": "Malware payload (Mirai)", "value": "ef113ff6e2dbdbb053299d55b5315424dbf21b13235533d5dfcb474ae8f12a5c6ce6f8e49212a7816d42d000f5b2c709", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492693, "uuid": "26242877-52fa-4068-a470-1728cbfdf96a", "value": "T15FD2F16723063D64EA70057CDE6580490D435BBEC0FA318B17D6BC2979FE19785E8A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492693, "uuid": "7a838220-425a-4f43-af42-824b64ce8790", "value": "384:uHEQxbmEzTUMrB7f46nPQvZuAmepX5Enuzh7qmdGUEpia4EM:mxTzTfV4vIAxX5EnS9q3UEL4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647492693, "uuid": "96799792-4428-4c1f-9a01-4a65736ab28d", "value": 28428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647492693, "uuid": "183c52cd-d95c-425f-a03a-9822002a1747", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492693, "uuid": "89e04aae-5af5-4e73-bf83-e0efd53eaa99", "value": "7a45d3b81b764ea50df4224a409c43cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5786f011-a5e3-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647515638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515638, "uuid": "74b1310d-1af5-4119-a3ba-83f2372affc7", "comment": "Malware payload (AgentTesla)", "value": "e2bb0c5fab436a2deac65ac419c07dae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515638, "uuid": "9801fe8a-33a9-4e2c-ac3c-f979459e2484", "comment": "Malware payload (AgentTesla)", "value": "485eaa30fa9fac132bf7313218a452e5993f029a7562094a1a2ca797c1d76f3c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515638, "uuid": "9bd3db2e-e497-4310-8ea2-167d14f455c4", "comment": "Malware payload (AgentTesla)", "value": "87b64cef32a2ba3a27755fa423b2cd4542504c68", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515638, "uuid": "54caaeba-6075-4e8d-a4a9-e565304bc080", "comment": "Malware payload (AgentTesla)", "value": "8d59cf80706f19f9a9a9679ef037b94845796e3d4cd1d4e8ee294809f39572e3e17ad297a1ef122c14dd252c90211677", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515638, "uuid": "232f6ce4-0236-4852-bbbe-a07f841b2594", "value": "T11B8423E6515E301AB98D3E294B97B824E1538428AFD5BE7B400C4A811A78CDDF0E7FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515638, "uuid": "7cb75190-49f0-48ef-a0bc-d58985859947", "value": "6144:f5+VwX6La6x9c7DOV74kZPdG2AheZSxtIBVBPPFZAluWTHxhXIywV7xsiWH8k:fsVLlc7DOphZM2AoAxtYPdZAluknYgiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515638, "uuid": "ab53aefc-49f8-4ee5-82a2-5e9449685e25", "value": 380979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515638, "uuid": "55f33220-3921-4ef9-be91-6a462959de41", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515638, "uuid": "d0b6d893-d27c-4e76-8077-b0aeef01558f", "value": "Shipment Docs.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081ed5b5-a5c9-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647504338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647504338, "uuid": "4ea42022-8b81-4f2f-91f7-66b968f71436", "comment": "Malware payload (AgentTesla)", "value": "8054397fdb7aca3de19dba03ff645373", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647504338, "uuid": "81dc37f3-14a8-4332-b09e-1755b557d765", "comment": "Malware payload (AgentTesla)", "value": "487b2c624b17c8595357fcfe99ea06402255c53340d2676d42c5a04ca9e8b4f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647504338, "uuid": "2a2510dc-78e7-450e-9c2f-26063afa2161", "comment": "Malware payload (AgentTesla)", "value": "deed8792bc6fcff1a143c2836a127636037fc0bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647504338, "uuid": "3335012e-99f3-488e-a294-08135aa7445d", "comment": "Malware payload (AgentTesla)", "value": "3b11c5efeef5089907a069a131103bae42e2f6738159471dba1bc43efa5f2a6e9301bbc52e417b52a3a3ae729038331f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647504338, "uuid": "be63bb97-d5d3-4cef-a8b6-1f55669d2ef8", "value": "T113F1E701E7D8863BFEBA4B7218672341C730FB134C5B9F5F68C8621A7E207941193BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647504338, "uuid": "a3ce6cc5-04c4-44ba-93e1-9c5861ea61c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647504338, "uuid": "7bc8850b-f982-4d24-845f-b7b0669f98e4", "value": "96:7/7L+j2MCR6MTZQ9JBNLoSkA1vi0gPj0uhtlHaoO0eg1x5yckaDtrrQozNt:7+hCRPTa3v1aTP4uh7H71TycNDZEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647504338, "uuid": "9c62bdd8-b4b4-4da5-85ca-8936de138532", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647504338, "uuid": "cc6dad80-6974-4cc2-b318-5f3917ca76d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647504338, "uuid": "34208a80-602d-475b-bc0f-012be998be42", "value": "PO-317202.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3036be-a5eb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647519246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519246, "uuid": "e6b9e10a-1407-4024-bf12-38aedf0dab87", "comment": "Malware payload (Heodo)", "value": "a66bf0f6c1bc01104dc1fd06fd9dfa22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519246, "uuid": "34361aaf-085b-40bb-bbe6-0c425e6203bb", "comment": "Malware payload (Heodo)", "value": "488cff00baf4fc669f639f2446cf483fd00cc10ea00ffad6cac597038f7e05b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519246, "uuid": "be78e05b-72f4-48c1-96b6-b3049c746f41", "comment": "Malware payload (Heodo)", "value": "bf408027b9ed1540aed959df2a74050291fb577f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519246, "uuid": "04c607a5-0852-44e6-8024-bca1cbaeb69f", "comment": "Malware payload (Heodo)", "value": "51fd3f30e2caa6654e9f0af60fcbe36dace761bc2608616e48d7f0ad360019b5bbaa4be05f1e6b14b93d5b35063b6f87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519246, "uuid": "6887093f-66eb-4b87-806a-e55073616175", "value": "T1F7059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519246, "uuid": "6218fa39-5dcf-4ee3-94c2-1c2132415cb8", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519246, "uuid": "44fe5c1f-3860-4d7d-ab7e-b92642427845", "value": "12288:KVHML2QJe6XxhqCW6QHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqiQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647519246, "uuid": "5a7a174a-63b2-4899-ba50-54a03a3c63dd", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647519246, "uuid": "7ca422e4-fa98-4edc-9dac-7dc1c2abe8dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519246, "uuid": "96d2ec68-ab86-4ba5-9799-51380568cd4b", "value": "a66bf0f6c1bc01104dc1fd06fd9dfa22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eebd6d5f-a5c4-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647502577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647502577, "uuid": "faeaad65-32bf-42a3-a46a-d85441d188d2", "comment": "Malware payload (Formbook)", "value": "7df337a1f8ed1c0606881e794ada99ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647502577, "uuid": "d553320a-919a-4d1a-9bb2-e316902c8993", "comment": "Malware payload (Formbook)", "value": "4892e9b8ed5aa57661e3a1fd4bc2d48570cd416af12ab88bbade473ede45c1ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647502577, "uuid": "a04c4e21-8946-4547-b85d-fb12ece198c6", "comment": "Malware payload (Formbook)", "value": "20786d5e7bca1e0946c11d851c4857f49a245454", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647502577, "uuid": "6d4990f7-f543-48be-bae0-e240b1c32c81", "comment": "Malware payload (Formbook)", "value": "3e5a680e5c84f9cf87d5dbf977f459094dd61c51f5f7152221bc5b5bfc579d12d6cdc478b9ba24f92c7b566da1c72328", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647502577, "uuid": "26861275-607c-4240-848f-567eed30789f", "value": "T1383523587FA44522F3AB87F8A09309905BF0724A201AD74EED81B8FC5D973E54E2F257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647502577, "uuid": "d0d1bb5a-9927-4733-aca2-135044d99580", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647502577, "uuid": "d484bf1e-57e0-487e-991e-c7d619f600e8", "value": "24576:g3I9IRC+bszdCg6u5gG5FLZoqS9Vm4JPdA2UeVNb:g3gIRC+bszdCMGG7+/tyJeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647502577, "uuid": "4edc743d-9611-4616-b81e-c9c172d8174e", "value": 1146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647502577, "uuid": "80da3aff-ca31-4135-bebb-4a6287abe23c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647502577, "uuid": "ca13eb5c-2e22-4497-b245-63e376b8c48a", "value": "Purchase_Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09cf61cd-a5c8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647503911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503911, "uuid": "987933ed-7751-4bf9-8dd0-a976dd7df254", "comment": "Malware payload (AgentTesla)", "value": "b8caa3aa7d02af206a2f9298b54d4000", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503911, "uuid": "f9a7531c-0df8-4415-b9d1-5503e9bdc56a", "comment": "Malware payload (AgentTesla)", "value": "49498eef5949e18ee49bff54708104840ad078170edd990931c9662ba5cfb168", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503911, "uuid": "1c793ae4-5eb9-4577-ad4f-f14886e86453", "comment": "Malware payload (AgentTesla)", "value": "419900c1bc2d48b9ffbde8e2b07706b65faba1f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503911, "uuid": "8e6ee539-dd90-421f-9704-1574d5309ae9", "comment": "Malware payload (AgentTesla)", "value": "4b759e274b9ead1849042f222c9b086439394547df26f0afb890d359a3631f15257791b9418303dba3b0c6c2aaee1932", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "exploit", "colour": "#F98DCA", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647503911, "uuid": "77ff1f82-41d5-4690-9e89-f2053c8b23e3", "value": "T1A372D0B4C8E81F5B4C9C9F713E87B27841580197AF8AA5C8C77E413E8B46F9439E2417", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647503911, "uuid": "6166ce30-ed3f-49c8-8633-04237ff47604", "value": "384:sXjBtT4xA2l9IF4Di9tu7pS1uOpw8yzohSh:sBtT4x/l9IkSt8OpvhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647503911, "uuid": "ea69cbdb-44bb-4bf5-9c69-4dd35772ad97", "value": 16472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647503911, "uuid": "7eab7072-3285-4d05-9a2b-09814135de2d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647503911, "uuid": "07f54e4b-c4a3-466e-8b07-09455fc4e520", "value": "491b890f6733ed8864a08b904042deec27fc4eefcda3543ed93994eabd81ee24.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf477f8e-a5e5-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647516671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516671, "uuid": "f662a92b-fe3d-4695-836c-e65b468d5d02", "comment": "Malware payload (NanoCore)", "value": "45cebd1db0ccdbeece2f706f8b7bb623", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516671, "uuid": "492c3a3c-722e-4323-9e0e-24f5ea9e9541", "comment": "Malware payload (NanoCore)", "value": "49ceeef25cac6108f018104aec1f8cd7b3992b7a4b4c9af14d076968aeb03d34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516671, "uuid": "b965c12a-8fbb-4e70-b19f-76fd96ab83de", "comment": "Malware payload (NanoCore)", "value": "5f2dc72072767f129f07b77dcc65a6ee38036ae1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516671, "uuid": "b4176024-78c6-427e-a084-a683598970d7", "comment": "Malware payload (NanoCore)", "value": "847205466e5cd78cf0eaaba9d31d8e3af44ab2b36c7522485ce53c57fa2f2cc76dcb5e7568e52203d88f1e62c84f63bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516671, "uuid": "8445b4c3-9f58-452e-a70f-9eca662ea5f2", "value": "T18905C090BB0F08CCC5ADB7B774D61BC09C1B6C461753EFE71589660786A290B3E3A9E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516671, "uuid": "9527083a-a5e5-46d1-861c-f7ae456cc19f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516671, "uuid": "8c06309e-c83d-4074-acef-773b4833ac21", "value": "12288:22BQyHZY6p6RRk93qweU2/8fhhkNftlRBJDD1UBrwlHDHzyYNgRLqPDA:22Ba6aoCUQ8ifthJv1UBrwlzyh9qPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647516671, "uuid": "46099751-75c8-454a-b1fe-9ed76483722b", "value": 833624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647516671, "uuid": "31f72dcb-2a58-40c5-99c5-de52bcc80a50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516671, "uuid": "358d5bd6-f79e-4589-9c04-de667f93f9a7", "value": "~RF~2345678998765-09876543456789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff16c22f-a600-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647528375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528375, "uuid": "4caeb614-ee4f-4b32-a591-46e18fa6da3f", "comment": "Malware payload", "value": "8c3777145058ed6f0b515f5c3d7af50e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528375, "uuid": "e5cdf059-758f-4189-9af0-98bebf6b0b12", "comment": "Malware payload", "value": "4ab9ec36e8f4dd60fa5a249700981007b0347a8703bd3cc31d9058eefe37b231", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528375, "uuid": "c89f6713-5447-4e8c-aec5-e262619080ee", "comment": "Malware payload", "value": "9b1db7f24a39d6c1b5c577f96f3855fc1abd5bd6", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528375, "uuid": "57c126ad-037a-4b5a-b66a-622756bd6922", "comment": "Malware payload", "value": "f29a929ef87c56e2dfaa26724295832af783a03891b5ebc6b8d9cafe5e6bb71bda8184b3fbe14d369d0a66bff13f6764", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528375, "uuid": "39124834-c277-4647-b543-99d3e14ded39", "value": "T143061281E3E8A42FC93781334ABB073612464D468896D7575B68F23C5DBBAC05F9AFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528375, "uuid": "9303a256-f8ee-4f35-8a31-a8618650b78d", "value": "98304:ppfmV5JN9XYiUPoWnW8xq92/IUJOCfu26PPLw:z4JN9XYi0rnWEqU/JRAHLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647528375, "uuid": "73b22c50-814d-4980-afc2-c24b08d2b881", "value": 3799331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647528375, "uuid": "38c989ac-992f-452f-bcae-eef6034e2e56", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528375, "uuid": "6bab0df6-05cd-4c20-a2c0-03b89e9b73c9", "value": "sicurezzaweb.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb3aa5e-a5f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647521470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521470, "uuid": "fa9bd5e2-560b-4ed1-b5fa-f165764c29f1", "comment": "Malware payload (Heodo)", "value": "fb6b029ce23434418de0dea3ba6297ec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521470, "uuid": "62dfec7e-9107-40f0-b51e-42a6763a3927", "comment": "Malware payload (Heodo)", "value": "4af397c1302a3ad5f0a01dbb6898c4093c8163c2135658adcc9223d286f2387a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521470, "uuid": "131eb3da-f6c6-4945-83cc-6adf84bebec5", "comment": "Malware payload (Heodo)", "value": "5937cf332b7363f73df96a72faa362085b877cb9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521470, "uuid": "63b3b82d-8292-43c4-838c-6b9e55520201", "comment": "Malware payload (Heodo)", "value": "fa5e723d1430345041e771649d565aad564bd408d37cca6921e6b82cceb36897498904efdb1658e5e1e2e062a29b9c81", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521470, "uuid": "134e4815-2395-4897-b223-07fd91bccdd1", "value": "T12B058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521470, "uuid": "a85a74ea-b608-4d0b-93d0-07e2c5a0875a", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521470, "uuid": "ce9d7562-b529-40cc-a3f4-46384a0cde8b", "value": "12288:Wvz1CLJyyvmMLSrBgI4ruGbPlVpqb+DlYzv:WJCLJyybLqBV4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647521470, "uuid": "db7d61de-a861-4595-93d1-5792d646cf4e", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647521470, "uuid": "a4bae1e5-7661-4fe0-8940-f01bf8886a28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521470, "uuid": "dba1cf5b-5986-4cbf-94cb-55a97f0ea974", "value": "rfs.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13547e60-a64d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647561050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561050, "uuid": "3086a93a-57d7-4bdb-b80a-139d197bd47b", "comment": "Malware payload", "value": "d49a39611aed8ffcd37208a635f0f152", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561050, "uuid": "ba3796ff-d9ba-4109-b3f9-42cc3edcdcc1", "comment": "Malware payload", "value": "4c226031cc9a652a3e8ccc55f7a10ddea8fc48f488db59751f292d54d14fedeb", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561050, "uuid": "d9839288-e098-43a0-b58c-e8a6e4d5fe61", "comment": "Malware payload", "value": "4f51460d5bce5d6d5730b19c29d29270940a64c1", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561050, "uuid": "412560fa-5fe8-4fe1-8abe-12c4fae1bba8", "comment": "Malware payload", "value": "5853409db5a978c4a780e73f27965242ca38cf1acf91bced50cf507d9106bb877c85f1433990ba2e26b752f6852cfe17", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561050, "uuid": "11174907-1df6-42fe-bb54-03f6d29e8420", "value": "T12F13F15D6859E593E9FB6EB216F3C7D25F6B037C2B404A17521E3C236C4E42A5322A33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561050, "uuid": "17a87d0d-73dc-448f-a54e-976da69b5158", "value": "768:gMMukd5+HF7dO5siNLS5RVkfdb5GTi3yTMsUjyOPK7J1PsZtT:gMM7+duroR8IiC8j5K7J1PET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647561050, "uuid": "a380c9a3-5f61-4e23-a008-9005a544ae36", "value": 42096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647561050, "uuid": "e1b55174-364a-4efa-873f-f0f8e0debecc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561050, "uuid": "cad3089a-22f5-48fe-9289-770af006b69b", "value": "d49a39611aed8ffcd37208a635f0f152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6f487d-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518685, "uuid": "c5b728a5-41fd-435b-8891-6773f17f2c4d", "comment": "Malware payload (Quakbot)", "value": "1330fdb5121c445cb1bad6a2d04df63e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518685, "uuid": "c974b639-37fc-4102-b313-5f0098b3bfe4", "comment": "Malware payload (Quakbot)", "value": "4c70f64526f28d74ba969e89577ba242e12acf141a8bc0a96bc9e7dd33eadcfa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518685, "uuid": "de8e9405-549f-4413-a97b-5680d83e429c", "comment": "Malware payload (Quakbot)", "value": "485209a850213cfe52324658efc7066db78378dc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518685, "uuid": "e4e89ed7-908e-48cb-811d-6fb248b16324", "comment": "Malware payload (Quakbot)", "value": "a3883749b140559bfab6a255f72c774c6accb02cca3c236a106b99ea77cb5692dca2527a53ff4a48b4692f5c0d3a15b1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518685, "uuid": "e12ed34a-992f-4bbb-9f7a-05968246e1e9", "value": "T1A715BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518685, "uuid": "5b84e735-8e7a-49bc-adea-86250b10d34e", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518685, "uuid": "a5db5476-c3af-4e41-8741-f2e2904d60d1", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518685, "uuid": "d63a464a-d51f-477d-9707-a849a15c0b00", "value": 933476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518685, "uuid": "33d4e712-ec2c-4277-89dc-9d4f9b2486c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518685, "uuid": "3c7d1c92-2745-41d9-9f93-c6d869ad2fe4", "value": "4c70f64526f28d74ba969e89577ba242e12acf141a8bc0a96bc9e7dd33eadcfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6295af43-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518663, "uuid": "bcb04c7f-3154-4fd7-8117-2b67c151965f", "comment": "Malware payload (Quakbot)", "value": "da3b944da04513346d8eded4304fefc1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518663, "uuid": "5474e6e2-5afb-4522-b265-585cee7a199b", "comment": "Malware payload (Quakbot)", "value": "4dc3983e5af920472c15e49dcdc3437c5ac389c3a6a1e14d560a38bc4c9f8ac5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518663, "uuid": "58d9f558-88c9-4bc3-9ddf-722b0ca6a4ed", "comment": "Malware payload (Quakbot)", "value": "639f67954fa48ce5431204d8edc4d6d83687a3ac", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518663, "uuid": "5e697f96-6ce2-4985-8c93-4ee43fea328f", "comment": "Malware payload (Quakbot)", "value": "5c583b5f7295f81de9221b9e0f0645167aa3d57a4fa6092147f340264a6af857230d1a259011ab0950d6bf0fb2294947", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518663, "uuid": "64c05ffe-e35f-4706-a384-03080ca83b30", "value": "T19815BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518663, "uuid": "fec823d2-b7d1-4b24-9196-e82a328e5629", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518663, "uuid": "46176ed0-d008-4211-bdba-67ffc35b1cbc", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518663, "uuid": "3cbbbd99-9279-4c08-935d-bbbea2e8a8ed", "value": 940325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518663, "uuid": "ab542139-1c4d-45fb-8748-bef6b57a3390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518663, "uuid": "3c586f9d-6aa0-49d2-b9af-8d0936d6631b", "value": "4dc3983e5af920472c15e49dcdc3437c5ac389c3a6a1e14d560a38bc4c9f8ac5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f19e658-a5ed-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647519919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519919, "uuid": "c9254679-4194-4cd5-a0c6-e1889c59b4a4", "comment": "Malware payload (RedLineStealer)", "value": "dff05a79f92b7f4906abefc992ce632d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519919, "uuid": "2cda7063-0a06-45bd-94db-7adf5db09d87", "comment": "Malware payload (RedLineStealer)", "value": "4dcff0d28d08fefd0160b28aa46e5b859b076a42803eb783dd562d54f7dabf44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519919, "uuid": "6042e6f1-6c69-4609-9996-8355b2d367ed", "comment": "Malware payload (RedLineStealer)", "value": "db86173e44b2223f36ba80be3380c76523ee90af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519919, "uuid": "31dfa0eb-1fa5-47af-a15a-1df6cc4fefbd", "comment": "Malware payload (RedLineStealer)", "value": "443ca5478181fbcc1138bdbcbd84d259ac086d971272bfef687a7ed2f16cb31a926cea15ece1303fc8743b2f42f92e39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519919, "uuid": "911217b0-bef1-4dc5-af7b-3be9231da7fc", "value": "T1C384F122B790C173F0639530A821C621A7BF793256B9CD0F7B9927364E712C29E7974B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519919, "uuid": "eb6ce9dc-d465-4d1f-80a3-47c72de1b764", "value": "1bd024066a86f151729fa49bd4381603", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519919, "uuid": "8142fa1f-2150-4fd5-8e4e-45817e6520c1", "value": "6144:1TldL9I3dkKzVXh36ebnvHUX+4Oclj8XeBKmAj:Bldxc1VR6ebvHUuDkj2eJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647519919, "uuid": "ad20344b-f0e8-437a-9591-fd73bbcfa13a", "value": 380416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647519919, "uuid": "20c48366-f1a2-4f03-84e5-db7df01521d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519919, "uuid": "7746ac60-d7ab-4612-b919-9ebd644f3dcb", "value": "dff05a79f92b7f4906abefc992ce632d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8c0803-a647-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647558546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558546, "uuid": "b44615ae-d1ba-4ec0-9d6a-d5ebad570f49", "comment": "Malware payload", "value": "f12760bc011132489008aa90f78f0655", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558546, "uuid": "099362f1-640d-445e-92f7-3090f19d64cc", "comment": "Malware payload", "value": "4de18a13e8d3ca6d3304f48028562f3181bef010a69f6342d9c37314ee8792da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558546, "uuid": "6e00507f-9d1d-40bd-a030-3af2db58a871", "comment": "Malware payload", "value": "78ad5db3b0a703dddbbd721492cd3bd332008d24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558546, "uuid": "c7f7b508-de60-4162-a6ec-cb4d2acc8e4c", "comment": "Malware payload", "value": "61b56aca1ad01c9c9e1e34b087eb84be5ee78932bd09e34360a9c8963afe6b37fe86960c699d4a3b0385122eff1d7c20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558546, "uuid": "6c35f841-c681-42b3-8b98-cbeebffffaca", "value": "T1D9059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558546, "uuid": "766548bd-76ad-4ebc-9168-665e8296c7af", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558546, "uuid": "3a5c5baa-529a-4c69-a09b-5c704e83493c", "value": "12288:V20BXOMcVzpWfmmnDDBX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDtX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647558546, "uuid": "86bc38be-3c67-4f11-b99e-1e708533aa0b", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647558546, "uuid": "4640cf55-12e1-4ae7-9024-807649be6f08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558546, "uuid": "3d5956db-0c78-4692-9649-998bf1904382", "value": "f12760bc011132489008aa90f78f0655", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17bb4cf-a60a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647532539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532539, "uuid": "d7c08069-2c88-4ba1-bc37-03939e472541", "comment": "Malware payload (Heodo)", "value": "38cac6fbd812c06941e9b177081d5652", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532539, "uuid": "574ac1c2-c9bf-4b4e-ae7c-5f2f45732af4", "comment": "Malware payload (Heodo)", "value": "4dffcfed325631c645775f39bba4e59d84711c4f9c96a6178af8c3de1f5d3b0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532539, "uuid": "1d6a8d49-455a-4ca7-afdc-7ec78f793553", "comment": "Malware payload (Heodo)", "value": "664f1a1a043c4c883a99603784baafc9e67123d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532539, "uuid": "ea028340-3d7b-4177-9c0d-891551bd9be4", "comment": "Malware payload (Heodo)", "value": "b18fd91a56cc730d1a3f904d7cb556eb66f0109562f01ab4597d8493aad4435b5cdd3ccbbd54872ed2dbbf52af40f1d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532539, "uuid": "53c405fe-dc4b-4a80-9c59-932f62924493", "value": "T110059F7A2B43F27AC7E50DFC186002981A75BAB2C7F764272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532539, "uuid": "574c04aa-862c-4646-924f-c502893b73b4", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532539, "uuid": "2a6b1333-821b-442f-a8e1-a66ef0373a6a", "value": "12288:KVHML2QJe6XxhqCWaQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqSQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647532539, "uuid": "141a4b25-af6c-4a75-9386-b2b1ea99454b", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647532539, "uuid": "24cfcbd7-5ec4-4800-a814-7ff6815a4126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532539, "uuid": "26aeb841-0fa4-48e5-a204-6b2ddc637ee9", "value": "38cac6fbd812c06941e9b177081d5652", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d039c1-a5df-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513973, "uuid": "f16c6df5-0172-47ac-a9ef-c9f0a171fe2b", "comment": "Malware payload (Heodo)", "value": "b5ce4ff070bc299e77b4f62a7f573947", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513973, "uuid": "d7f741db-9389-4d40-9c28-182bf3295e38", "comment": "Malware payload (Heodo)", "value": "4ea23c90a6ffb86c996137172f9405cb8e49503920b19a5fd760f487f3ca8418", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513973, "uuid": "ac81b01e-c32d-4e8f-a46b-40fe606e23bd", "comment": "Malware payload (Heodo)", "value": "e9c89aace7ff2d401bb5839ffc1bf3ad44527957", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513973, "uuid": "699023ab-dfc6-4b8a-b306-50bbd9cf8f96", "comment": "Malware payload (Heodo)", "value": "efbc6ca33e5f66e3b8461e4dfc114aba4836ae3ed060607c05371005520f6cf0079ccfef6da1f58892b0b349298e9853", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513973, "uuid": "1289bf6d-185f-455c-832f-14e537dedb60", "value": "T10F058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513973, "uuid": "26350e43-2bcc-415e-81a4-75cef81f129f", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513973, "uuid": "2521da2c-99de-41d7-8462-c60dbe875990", "value": "12288:Wvz1CLJyyvmMLSrBgZ4ruGbPlVpqb+DlYzv:WJCLJyybLqBc4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513973, "uuid": "dfa25cd5-d335-486b-9178-62ccc5527a95", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513973, "uuid": "0817ce2b-61fa-4bfe-8604-f55106a1d6f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513973, "uuid": "58f6f5f9-4a5e-4f7f-9438-f3e8f909ecfa", "value": "emotet_exe_e5_4ea23c90a6ffb86c996137172f9405cb8e49503920b19a5fd760f487f3ca8418_2022-03-17__104607.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a741ba-a5f6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647524057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524057, "uuid": "f994bfaa-1c49-4a51-9537-92c476024a58", "comment": "Malware payload (Heodo)", "value": "188aca8769471de616fc520200badbd0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524057, "uuid": "ee580dc6-08cf-4da1-97a5-23a9aacc1e9f", "comment": "Malware payload (Heodo)", "value": "4ecf210a35eaadff6bf9b1835f2de9c1ff75492035984e3b89393f2fc0667671", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524057, "uuid": "a8eb25dd-67a1-4361-a764-a978fbbf51c9", "comment": "Malware payload (Heodo)", "value": "6d266780c50e331da75b8c0348f794d89de7c754", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524057, "uuid": "20fb7445-88ec-426a-bb83-a3f5362d112d", "comment": "Malware payload (Heodo)", "value": "bd04a11d9677fecc4c589868708a3d033a1a4a824b230c7902813c67b919359446c3d44de0beb61ad4d7bf9ff9a88460", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524057, "uuid": "5fc196b6-9638-4e95-850e-84baeccf333d", "value": "T1F7A2BF3FD131DC29EB7B9C7C820980F5E60A1D46200769DD2C51F75D6AB26BB038B9AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524057, "uuid": "e02d3af0-02e9-48ba-a935-1eb5eecebff8", "value": "384:uHM0Vb1GNjDo4CGzPd6ZIwA1hKb5CzgObff9kC+xbX7qE7h:T0INfo4FLH2CBn9kC+xbLq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647524057, "uuid": "d08abb69-fe0e-4987-864c-8539f2ceae60", "value": 21440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647524057, "uuid": "7b436d18-3cd3-42bd-9105-8ea67ba330d4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524057, "uuid": "c0d32101-e995-44e8-a688-4a6144f43899", "value": "DOCUMENTO_6.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9129bc4e-a5d4-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1647509292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509292, "uuid": "720e4cfc-9e9a-4ec1-ad81-a07f26015a2e", "comment": "Malware payload (Gozi)", "value": "2ea2dd1d185688d0015229b78ab8cfef", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "usrnif", "colour": "#DC4B10", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509292, "uuid": "ab7339a9-936a-492f-9e00-d01699b5f4e2", "comment": "Malware payload (Gozi)", "value": "50d72b24653a0b3dcc684fedd39538157acc4864355549986dbaa1a36ccc6b06", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "usrnif", "colour": "#DC4B10", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509292, "uuid": "edda7dc6-7164-41d1-b0eb-94609fd6bbe3", "comment": "Malware payload (Gozi)", "value": "ea5453d96faf99228c29453c29fee4ec43f794f0", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "usrnif", "colour": "#DC4B10", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509292, "uuid": "3bd5d7d5-e1c4-467a-8f03-f4cfe8c23b21", "comment": "Malware payload (Gozi)", "value": "5f724356a037874987e3d4acf449c36c46c4a9f0e60d6a1c6bb7f5dfd521270104e237a78646e3ce0c73bbf72ca8e5a9", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "usrnif", "colour": "#DC4B10", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509292, "uuid": "237cdee9-5478-40f1-912f-532de924c980", "value": "T149224A2D6BD7D499430350FBD8BB0F1B5250DED9DFE2C0C5B02593922C98F9AAA2039D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509292, "uuid": "b4d67a44-db0a-4f8b-bf1f-f031e0acd36b", "value": "192:1Yh3xviAMZeVnFefo6vjIpD5zFio8SQj5pbus1BJcYF5pZlqhy1G:1YXJFeJjIfzMzLbusflm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647509292, "uuid": "4b0fa7d7-1c2e-4c9b-9f27-17fded18a135", "value": 10421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647509292, "uuid": "b1e01702-cafe-4b56-9319-d1489cc0e2be", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509292, "uuid": "8af4485a-98e8-4912-9cb5-6e8ac82b7614", "value": "impresa116.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c175828-a586-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647475622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475622, "uuid": "6113b11d-8b81-466c-83b8-2aa3b0c93356", "comment": "Malware payload (Heodo)", "value": "de0df80fff7539f6a33c123bf0c4c219", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475622, "uuid": "096f52f0-5a96-42cc-916b-3c2a9c01127c", "comment": "Malware payload (Heodo)", "value": "513f386d5bab1a1f22117b4980efc2f0d7f9f69a26e8eae8f3e10adc8fbd227f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475622, "uuid": "fa270078-59f3-40ef-97ea-f3c576402386", "comment": "Malware payload (Heodo)", "value": "d4dea71987a9a2e8e7967fd14fa066cac874d201", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475622, "uuid": "74490c50-db1f-4ec6-8e87-da7603fc9b95", "comment": "Malware payload (Heodo)", "value": "c5d92e50d3f28183acde9214dcc40943fa31c9f5f5df0426fbdab12d684d8098f5bc5c5b6a0164c949b39143c49fbe49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475622, "uuid": "8a4df82f-4bbb-495e-8958-64fc445678fa", "value": "T118F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475622, "uuid": "2ed0e85a-c3da-4af2-a0f7-c523233527d8", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475622, "uuid": "c650cb10-4bf4-4a21-b9a9-3e66a7671d9f", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPIXvkgKtuBdfMAofD:WCBAdKV9Xf0k73KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647475622, "uuid": "d240435e-ca18-4457-ad3a-639c1817036b", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647475622, "uuid": "d71dc3dd-449b-4f6f-a0e7-73c2d7c50a48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475622, "uuid": "ceb11ff0-fdbc-4347-a405-f01a27ebde02", "value": "de0df80fff7539f6a33c123bf0c4c219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef20c1e9-a5f6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647524053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524053, "uuid": "f22a22cc-9d8c-4e2a-80fc-d68d395f7a8f", "comment": "Malware payload (Heodo)", "value": "d555890442ea71ae1e5b3bf8efb845f9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524053, "uuid": "d1398028-7b9e-4b5d-a42e-0ed070563e65", "comment": "Malware payload (Heodo)", "value": "514559aaeb8acd0637bbcc1fbfca4359fa4d41a9ea9d08a3dd709ff04f68ba9e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524053, "uuid": "097320ea-4520-436a-b731-cb37e35d7b63", "comment": "Malware payload (Heodo)", "value": "4f932eaccf0c9f2f1d4cc148cfa5ffc9bebde24c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524053, "uuid": "65f81c9b-e18a-49c0-8585-b149396f39a6", "comment": "Malware payload (Heodo)", "value": "1dc0faf045536019f9d78ded1e1b704d42bc862912746b526a3b6c9fb849933e864186f3131867a352b230dcab915ce7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524053, "uuid": "22052c47-845d-486e-ba87-ebcaea36bb4d", "value": "T16AA2BF3FD131DC29EB7B9C7C820980F5E60A1D46200769DD2C51F75D6AB26BB038B9AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524053, "uuid": "03505c59-5bff-458f-8f66-30690cac594b", "value": "384:SHM0Vb1GNjDo4CGzPd6ZIwA1hKb5CzgObff9kC+xbX7qE7h:n0INfo4FLH2CBn9kC+xbLq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647524053, "uuid": "06038d7c-13a4-41d3-ae3c-598792146656", "value": 21440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647524053, "uuid": "26cdb798-4890-4edf-bf64-4a7cd6ee14df", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524053, "uuid": "49987535-3cdf-4447-aeb6-5447c08c318c", "value": "Documenti_04.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f063b94-a610-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647535085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535085, "uuid": "92f95bef-8587-4bf6-ad1a-2083191dc1fa", "comment": "Malware payload (AgentTesla)", "value": "3ae1b85ce68f42d2198d6e6f71728a5c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535085, "uuid": "7677d272-de03-4bff-ba17-963a2cdb00a1", "comment": "Malware payload (AgentTesla)", "value": "514844fc62522a934bebb29f422eda6aace2965d3cdd1ad717f05c26280f09e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535085, "uuid": "c217def7-99ba-490c-9f63-51f968d5fa7f", "comment": "Malware payload (AgentTesla)", "value": "932114b647c7233ea6577922ab4ad5ab60e7c47f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535085, "uuid": "29ea3b7e-7c0c-4043-ba32-760d3eed5718", "comment": "Malware payload (AgentTesla)", "value": "55e507b723523e1cb7f2706a697abe2e7cc30148775072abaeadf7fe402bd99ab82af3c4dee1cfeddd4567685bdf5af1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535085, "uuid": "9157da41-221e-4e16-ae3d-91acf49596c2", "value": "T1E234094334808598CE7D55F2B2178584339ADDBFD658A60C7BC873A35FF2AA20936B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535085, "uuid": "a96e2793-e30d-4399-8033-4145e4aaeb95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535085, "uuid": "601fe523-e159-4cc4-a2df-8fe8049a2e82", "value": "3072:hbXX2qCu5Z6ZWaNlMMdG4UG/A2dedGTJ/7kYmwpWU7/3lLTqKnoBojSq:hbWq+RHMAIGI2pjkYNJVqKoBo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647535085, "uuid": "52966926-7170-4386-b9d9-36773826c5ce", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647535085, "uuid": "0b74e525-58e9-4a08-be71-38b22e559859", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535085, "uuid": "c0c33c85-52cc-4505-a890-9dbd5bd46eea", "value": "TMB-CI2006-003 USD.7.73459.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2e7b5c-a615-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647537173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "3f6995c4-60d0-419c-b3dc-04285a92a9c4", "comment": "Malware payload (Heodo)", "value": "f1aec79f18ed72f7efa477ae675d9ddb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "d9568971-0033-4a99-b8e2-e38871dfc96c", "comment": "Malware payload (Heodo)", "value": "51554d15fb748423ada5a44295bb7e64b5010895449946fb480de150491972f7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "1c572546-d258-45d9-951d-08397f0481d1", "comment": "Malware payload (Heodo)", "value": "66006a6990a712f5c07d134bcfea921cecdb7217", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "5590bec7-252f-403f-8056-8b6ebf292d3b", "comment": "Malware payload (Heodo)", "value": "b561d58cdcadbd083c7022f34028ed6db0a4a04e68c8bcda8d798e9f644ce8e33e0506e8ad44fef0d44ec11db0dffcef", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "fe25e7ca-ebf6-4adb-96be-c89238fff206", "value": "T18D057C5037818037E7AA58740601BA783D797BE38BBF72925E80957DEE704C3C768B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "a3964af2-d4bb-480d-ba1b-d7779c7922ce", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "c0a29c74-9e45-4685-afef-4490aa52c57e", "value": "24576:xJjq8sc5JGxNNNNI+++++h3/UQUQiDj5URW2AeF+99V3kW5Qk45:xJq8s4uNNNNI+++++h3/UQUQ2v2AeEB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647537173, "uuid": "56f9b859-6b84-4f24-a9b1-1824fb8bca5f", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647537173, "uuid": "4b6dfeb9-fa2a-4f00-a87f-f2330af21b0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "ac8b4515-225a-441e-9fb4-822ca6fd0c36", "value": "emotet_exe_e4_51554d15fb748423ada5a44295bb7e64b5010895449946fb480de150491972f7_2022-03-17__171246.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901f9dc3-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647518740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518740, "uuid": "c87f6eac-cb48-475b-83ea-68554b47e158", "comment": "Malware payload (Heodo)", "value": "c793ab4b1665d6055435e43616c73739", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518740, "uuid": "d9caa27e-e367-4707-9e96-c4a3dfe90737", "comment": "Malware payload (Heodo)", "value": "515a9d4e76d83e6dd56338fbd0b4aa8a47a4145a8adba1efd4dac6ad99cfca8c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518740, "uuid": "6cf574cd-92cc-4c1f-a0dd-9c886d2bf833", "comment": "Malware payload (Heodo)", "value": "97149e60cbc311aaac4914d9c9a986edb1e980f3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518740, "uuid": "e5b40406-1f46-41d2-ad70-5ba90d69ecdf", "comment": "Malware payload (Heodo)", "value": "72036fa039fb7920e5b8ed6c70973e71528f73d90f29e9c004303dfa332cdf624908b625c973e394faedf28980f5a527", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518740, "uuid": "8516e513-5236-41a2-abcc-d94b74ca8dad", "value": "T1DBA2BF3FD132981CE67F987C430440F6E70A1D86600765EE2C45F26E66726B6038FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518740, "uuid": "479d584b-3411-47c0-ac8e-36b929cf7e87", "value": "384:IHTyVb1GNjyo4CGzPd6ZIwGdKb5CzgObff9kC+xbX7zUSA:8uIN+o4FLYCBn9kC+xbLzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518740, "uuid": "d55e2e8a-9ce0-4926-bbd6-80f105517338", "value": 21444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518740, "uuid": "5e30919c-e79b-4cf0-9c98-b2a21c64f800", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518740, "uuid": "ea46b91b-f4a6-42d6-98ea-934867a60684", "value": "Rechnungskorrektur 2022.17.03_1124.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a82f326-a5f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647524314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524314, "uuid": "87597a4e-3f3f-432f-94ff-cdb5557826c3", "comment": "Malware payload (Mirai)", "value": "16c0aece37ad617f0d18ceaa58445ca3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524314, "uuid": "89dd71b7-df6e-43ce-ac35-6494d857cbfe", "comment": "Malware payload (Mirai)", "value": "516fbcafcafa717fedacab56aaa54f7949772efdf9d304dcfa2889709c94b778", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524314, "uuid": "00144d31-2b55-4cb2-9080-80c9158d7d46", "comment": "Malware payload (Mirai)", "value": "4ce739765d0b779d444cef221458e79b0a810684", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524314, "uuid": "9e3b42bd-42bf-4498-88cb-0579f543180c", "comment": "Malware payload (Mirai)", "value": "578a1171d6487a706656a813b7d81fbc6a3905259c93bb156f253194990d3896bf6febd5eddbff16b57e1428def5ab39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524314, "uuid": "75d0fe9e-fd90-4121-a6b5-83caa9c4d2e6", "value": "T1AAA3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524314, "uuid": "02f36fd3-7dfa-4538-bbdf-77cb6dd1aea9", "value": "3072:VK1z13U6HzHoXRtmTUhQogPEmmFVcqq0GnDZT:VK7DDeKlogPEmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647524314, "uuid": "d3ca8231-e073-4bd6-ac71-7d8da3d336ea", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647524314, "uuid": "07f966f8-e6b3-4e72-a636-c9fa14d1144b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524314, "uuid": "85033e76-8514-4c7f-bdab-44935c9852f3", "value": "16c0aece37ad617f0d18ceaa58445ca3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eceb755-a5e8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647517825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517825, "uuid": "c4acb8fc-7fa5-4be4-ba8c-587dd428b0ed", "comment": "Malware payload (AgentTesla)", "value": "b5a63d39514339ae954e0c4b08e33858", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517825, "uuid": "ada62a9f-5eac-4d9e-87d4-7f058bfc054c", "comment": "Malware payload (AgentTesla)", "value": "52070720ff5c4b6095e4a7aa082f7647fbc576f3e4ff538b941131fad8842a1f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517825, "uuid": "f0295532-7c01-482e-a2ac-f586c4337074", "comment": "Malware payload (AgentTesla)", "value": "1b1ee836768c9923b493a1a5fd5759d2ade26e45", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517825, "uuid": "0921ad33-c56d-441a-9ac0-053875c72a2d", "comment": "Malware payload (AgentTesla)", "value": "9b9ac1158017afaec7011370ae65680db92fd7ea6ad2dc8c519fd39703d55adaf90b0149e02217bf71c56b7fbfbbbe21", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517825, "uuid": "cb972a5e-f10e-43d2-9696-7c7d9d804184", "value": "T1C04523997FA8C513F1AF97B0E05345888FB0B209A116D79DDDC260E91D237C54A3F2AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517825, "uuid": "d2e7a2ee-ddf5-4daf-a189-ba0679ea9bb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517825, "uuid": "f81d434d-cf71-447a-b133-5a0ccce0f2b1", "value": "24576:U3s9TxuXCh4C/JSIZhodc1V+jcbc+zNuQJHiXlUL:U30Txuyh4CxZWda6YuQJ4UL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647517825, "uuid": "eb7f43cf-0882-4742-b42e-bfab23e60a0b", "value": 1168384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647517825, "uuid": "f1e8d700-d24b-429a-bd37-376f89699fc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517825, "uuid": "34088923-8087-4afe-b303-b2d0b55bc800", "value": "PO 3360.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac61287-a5d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647510731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510731, "uuid": "8340b2ec-ee8b-4ccd-9d35-4086fe3c71e3", "comment": "Malware payload (Mirai)", "value": "f67ce6088b4eb8cb3d1e8da3db91e52e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510731, "uuid": "4f676258-f010-4a2c-a4e6-ca12f5153cd0", "comment": "Malware payload (Mirai)", "value": "520e6ffa1ae367c2fbd679e0ac72c63c1f2c9d5624787ea3c85a7912f3c867d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510731, "uuid": "b8769df5-eba1-43fc-8cff-4e24163575ab", "comment": "Malware payload (Mirai)", "value": "f8690d827bb3cd852e0fc750c9173432d8fe36c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510731, "uuid": "fe9fec08-1144-415c-8aaa-0cfd913e1b77", "comment": "Malware payload (Mirai)", "value": "ba0df3760bb24a3b3e7ec3a031fe27aec1b8f1c7403b809af489c5310dd51c52837f1eb15531c472d3c423b0b40a9465", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510731, "uuid": "33e03f22-bae0-449d-9e4e-d84abc4910b4", "value": "T116E2D0A79375C1FCD06A44F56E2F360A1C21630D82A526FAE4DD656B88A3F393D00666", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510731, "uuid": "9abb37e0-1464-43e7-8188-8e342c482709", "value": "768:IKAOqDGnzK3BvZxt6zFxdi3NH1dEzU81EnbcuyD7UiyqF:gOn+VF6zgvOU8Snouy8ZqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647510731, "uuid": "f89a5b35-66d1-4a3d-96ca-25e0ced02c01", "value": 33392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647510731, "uuid": "b17ba50b-1a3a-494c-b6f2-928527f392a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510731, "uuid": "f5b79312-4976-4d59-bf03-dc42ef35cb37", "value": "f67ce6088b4eb8cb3d1e8da3db91e52e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3392ab5a-a624-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647543495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647543495, "uuid": "2d49a681-7adf-4d01-9ba8-59e91acb036b", "comment": "Malware payload", "value": "ce308ca5422cb8de57d7004911b57c55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647543495, "uuid": "222ac926-a804-4175-9db4-e4df42d8721c", "comment": "Malware payload", "value": "5252765aaf5f954a4fc2ce08e54cbaf01448acf2131796de5323d8d540d4fa18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647543495, "uuid": "2a072075-4b1e-4740-bee8-de25bcb25e84", "comment": "Malware payload", "value": "c26b4b2345d087d15bd073613af0ad926957dfcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647543495, "uuid": "5463edb4-3d40-4afe-a357-73baf73d974c", "comment": "Malware payload", "value": "de31d0d52ec669c83333198012904506fb78b1e3ea9eb28d7b0311af952412045576bb94f8c8bf1c35522fbbdcb74ecb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647543495, "uuid": "be30a69e-1da3-4c4b-998d-df4e0f082825", "value": "T10AC67C61D772C837D4B982FC621E7B69C5CD82B7A64229DB19443EE40633BA35CF8217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647543495, "uuid": "8ae56419-b1ec-46db-8b40-d1b27bf0ee7f", "value": "b521fc70c513454aa06843505654d3aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647543495, "uuid": "c9c93ccc-c9df-4ff2-8e10-66bc44be80f2", "value": "24576:pminVhqEJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJh:xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647543495, "uuid": "85921c94-4026-42be-a7a0-84cf52d8b141", "value": 12227072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647543495, "uuid": "ef57a457-0cec-4820-8db9-f75639234b8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647543495, "uuid": "a741cc37-c16d-4640-a335-3eaa1245eb1c", "value": "5252765aaf5f954a4fc2ce08e54cbaf01448acf2131796de5323d8d540d4fa18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae1b6fc-a594-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647481848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647481848, "uuid": "3eb0ff5a-15c9-4dc6-8a3b-1e7cb727a77a", "comment": "Malware payload (Heodo)", "value": "5ed6c47acc9805a171499cd7b466862b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647481848, "uuid": "539bbc1e-213d-4467-b397-1c3955453b2d", "comment": "Malware payload (Heodo)", "value": "5274b898d9d1c2d82baa0b40cb27f33077d864de08dc26c32b2c33c794eb7432", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647481848, "uuid": "fd61a167-a306-4e1d-8047-b56f6bf42220", "comment": "Malware payload (Heodo)", "value": "677cf23c04bb02dc497c47563c11f218e7e12dea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647481848, "uuid": "f910a9c5-f24f-42f1-ab21-5cdcd0009499", "comment": "Malware payload (Heodo)", "value": "406ed75718a592b697a46677f234249c27905786947de91ac994d4a83d648100491550f3b67de51edda9ae0aecc7b90d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647481848, "uuid": "108150d4-5310-4f88-bf0b-7c920f8baa5c", "value": "T19DE45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339973A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647481848, "uuid": "8a23d752-b3e1-415e-a637-518e36ea7f20", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647481848, "uuid": "a07d3a4f-d9d4-4016-97f5-e29473cd8850", "value": "12288:jc899XKPmN4WMkon6ZPJSFTdtXlcIL9v6O8:7GP7UgFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647481848, "uuid": "fdc9f31f-8272-403c-abc7-eec9a2f0450c", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647481848, "uuid": "0614e20d-664a-4acc-a223-a71dd6958526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647481848, "uuid": "53096826-cde7-4b3b-9b97-de4dbd358976", "value": "5ed6c47acc9805a171499cd7b466862b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f077c78-a648-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647559110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559110, "uuid": "cb69fa70-9fc5-4bed-95b7-0ea32c661503", "comment": "Malware payload", "value": "a5268f108a0b5f89543da97e4629553b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559110, "uuid": "5909f2bd-eddc-4577-8ebf-f62f86a8ba6f", "comment": "Malware payload", "value": "52784d24a0e1cab424617a622012070d6b516dd7437eb8e220fbe85db6b8a706", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559110, "uuid": "d9ec12b9-68a8-4280-be43-b6e36cb95e80", "comment": "Malware payload", "value": "65608d8ce68975ce450623756155f4f4a56559d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559110, "uuid": "d6aa71e2-c1c3-49b7-ba85-e65595107061", "comment": "Malware payload", "value": "968779570ee6ef42b17479b4ed9039187b26a198f4628d79557e8931d3a6cd33e42127b0f10ae41bcb97f1fc4b18d223", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559110, "uuid": "285a5076-e81d-426d-a389-7859960fa984", "value": "T1B8059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559110, "uuid": "2a1933f9-20a3-45e5-988f-4ff75b8b1860", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559110, "uuid": "86287a5d-2dde-4592-89e1-aa4c1e8b1f91", "value": "12288:V20BXOMcVzpWfmmnDDPX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDjX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647559110, "uuid": "2141df9c-b471-44bc-9734-d5d2822aa5c0", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647559110, "uuid": "3040f72d-980a-4fd0-b5a3-b2c5731c5043", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559110, "uuid": "cdf28a1f-18f8-42a5-9d9a-569de2cd9c15", "value": "a5268f108a0b5f89543da97e4629553b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825ab059-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553506, "uuid": "3c50a021-3ba1-40bf-8580-f56aa7243d6d", "comment": "Malware payload", "value": "449dd5bdeb65d221462c1352a7dab892", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553506, "uuid": "3b6c9bd3-17c3-4f2d-b556-15ee5333c382", "comment": "Malware payload", "value": "53345ec7e3caafa332fe77052fbf4cd99a0b1ddd61a5748d70bbca66be435f85", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553506, "uuid": "a3b27079-24f9-4a3f-9852-c590d8b2ee2a", "comment": "Malware payload", "value": "031c5028b4fff05518c0f70894a8c439f3bca5f9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553506, "uuid": "a56161d6-40db-402a-b8a8-28283bfa9451", "comment": "Malware payload", "value": "9ffb8fb787d338764723afd45539d9a752bc4cf412cee1d015d6947b41b91cd0c5978f916b46fe0154b59853d56a22a1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553506, "uuid": "bad1c0b2-5b3d-4c2a-ade8-a522426c4b0d", "value": "T1B8059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553506, "uuid": "30ef925d-5386-4fe1-9751-116241f3be6e", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553506, "uuid": "0a61758a-f11b-423a-a82a-25dbb2e41f1a", "value": "12288:V20BXOMcVzpWfmmnDDdX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDhX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553506, "uuid": "39c97cd6-3ade-4d9b-9277-21d11ab444a0", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553506, "uuid": "0b0f95c7-d034-448f-ab39-dc55183efd56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553506, "uuid": "996ba434-5f2e-41be-a7a0-fc777466a764", "value": "emotet_exe_e5_53345ec7e3caafa332fe77052fbf4cd99a0b1ddd61a5748d70bbca66be435f85_2022-03-17__214458.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb8f2a3-a613-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647536315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536315, "uuid": "82d6b434-fc75-45ce-bf96-9c6fbac5921e", "comment": "Malware payload", "value": "d2e5665d860d5c551df8c287806c7e43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536315, "uuid": "bdaac89e-6ef9-4858-8491-d86f411e76bc", "comment": "Malware payload", "value": "540bf137db63f9f3861f58b1bafa84c132acf634c0f207cd206bc42bd57a76da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536315, "uuid": "aa83ba0f-6cee-4c0b-9dc6-a3e659bb338b", "comment": "Malware payload", "value": "041b26c3b208983382ae80dad2f91d3df7c1a688", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536315, "uuid": "3507eb89-c767-43be-a5df-9f40bd85f41a", "comment": "Malware payload", "value": "4a668bce3e045b40c0b661464628c2903ee6da53b6a31694d6611e2b202dfeae4dbba68f07b17379bfdfa9f467096215", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536315, "uuid": "50faf92b-8c93-4bcb-aafd-ed41ca3c75d3", "value": "T14173B42BD7630D58C5303BFCDEE2D7A50A9C5F8D2C32C7D74AA5FC4070A6A46B8499A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536315, "uuid": "d9e36421-e2d6-4c24-a634-1cfdce0891a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536315, "uuid": "c5792197-b48a-43b4-84c6-e19999fd7775", "value": "1536:/Sv8SMeXJ0HbyfdFmSPwwsV0iOLdlEbaqEYdszM0N/a:/zeEbyFFFPwKlnEbFEYF04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647536315, "uuid": "8f83a526-9ca7-40f3-8a21-9349c02a702f", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647536315, "uuid": "6e55ef7e-3c62-47a1-8e7f-bb76c5010de6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536315, "uuid": "ca572692-3e0f-4506-a78c-c0aa3a96d697", "value": "86503807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93c6647-a63c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647554081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647554081, "uuid": "c0915ffb-c7c4-4675-abda-727ebef5b8ed", "comment": "Malware payload", "value": "4f29e5df1df3d452671af1629091a3bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647554081, "uuid": "1024a9b6-1559-46dc-ac29-1267341e8357", "comment": "Malware payload", "value": "544910dbdbcb5b670dd592eb1913af579ba4bf01c1ae4b57f1fcdbcfc7500f6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647554081, "uuid": "f9a6a8fa-7bf8-4b31-82ba-01fa692f59ef", "comment": "Malware payload", "value": "d974ba0a21d2673e2f1c33e6e6974eb50fcb0086", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647554081, "uuid": "c6240c09-1470-409f-9ae6-206c5000beba", "comment": "Malware payload", "value": "247391403c9666895c40118ddf6bb4d25b1604b9b11a6fd183a1a4accbbac20778bf62eb8066d37fc1b844cd95130586", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647554081, "uuid": "4c08306c-3c6e-4d65-a9a5-b2f77aaa936c", "value": "T1B4D1A512E3E44733DFEF0A345867135122B6FB609D12EF5F0980625A1C267914A65FB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647554081, "uuid": "8c957d25-91b8-4815-a48c-37f5c1015558", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647554081, "uuid": "2848c9bb-5fc8-4e33-9220-8abe531ba53d", "value": "96:AiCAeVpNxNsz70uKeAaHOJ4Ld6xy02uNYwA8gcsj4hzD7:AHRsz71K06cd6Q0JmUgcsj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647554081, "uuid": "f03f2ca4-d576-4f5f-9c60-d0b369d1db3a", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647554081, "uuid": "677803c2-8a97-409b-ad15-3e0dd89ddabc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647554081, "uuid": "663f6ed7-5f72-4e92-83fc-cc4ca86d7f99", "value": "Update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2cd605-a602-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647529093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529093, "uuid": "8526c550-5122-4f36-acf0-7a4283b03027", "comment": "Malware payload (AgentTesla)", "value": "ab03c301fa5f7a3ad31be2389efb1a02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529093, "uuid": "43b029fe-a05f-4ce2-afd2-230adedadf89", "comment": "Malware payload (AgentTesla)", "value": "544bc4dbae845400010b4c77b4def1f8e57b39b4b41958063cc6431d243d9c95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529093, "uuid": "cdcc8e26-a026-49af-81f0-bea1a0526214", "comment": "Malware payload (AgentTesla)", "value": "9d9a77843ed0bc020707f2e466ffd45c617e756f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529093, "uuid": "c3f791d1-171e-4f6a-a5c1-70346caf09a4", "comment": "Malware payload (AgentTesla)", "value": "c16653eb505f0d45407b6900a3f322ccd6805b4f395637ea529bbeabd1b9502fd1190fdf94fc648d4b7827249cad73e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529093, "uuid": "99171bdb-4249-4e75-96bc-53a4ea2255d2", "value": "T120352318A7EA8B23D46453F5F5A0A1EC27F4BC8A6C41D3929D4378CA7E3B700466172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529093, "uuid": "6a0435ea-a2b6-4dfd-9feb-e019cff8b9de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529093, "uuid": "dc9fb712-7778-40e8-991d-d4038f5d8c52", "value": "24576:LX99/UOqkt7f2GJ+5B8DOqebrDgZymuD8ldWmjVvcgygT:LXvmkt5lebrDYymKAZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647529093, "uuid": "366a4f8c-c2d5-4969-96e6-f468048e8fa8", "value": 1090560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647529093, "uuid": "4d03f92a-f161-4fa4-9b61-9aadc2108b7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529093, "uuid": "3852b60d-e6cd-42c0-b6ec-8adbcb71733b", "value": "Quotation offer 1212443.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6b15d7-a5e4-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647516106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516106, "uuid": "c8ed0baa-6901-4918-9594-2bb6e637b02d", "comment": "Malware payload (AgentTesla)", "value": "966f08222ff51a260161d348a564ce11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516106, "uuid": "75826c33-c661-45fd-876f-00747ce8594b", "comment": "Malware payload (AgentTesla)", "value": "54c3f52db188ce657fb27d1b4bd78212caf8c04ed0c7e1e666880a447c08039f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516106, "uuid": "775cf4e6-5bf4-4d7c-ba4d-8dbfe90376e5", "comment": "Malware payload (AgentTesla)", "value": "509e32951984dc884df544701521e12b467c9b2e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516106, "uuid": "e866dc79-c364-472f-aa3f-26694e546a46", "comment": "Malware payload (AgentTesla)", "value": "cabc62e67fb67c42212dc6e06c9275cd9e558ed610924f6c639ab38614eec1a8c1082c697fa5eb0ffddb69e2a9ec40d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516106, "uuid": "40bbd79f-e849-483c-b330-f2752f9f3b37", "value": "T1F135335724C6491762C8009A24EF144EEECB283A495D7F72F708C6FAE2636F8FE59116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516106, "uuid": "c225de26-9648-4ec6-8cda-415900fa716c", "value": "24576:RjWh47/wmc1qvp1L/4dwjLZA27umg2v40N9GDd7Qjodb:RjWh47/c1+vL/4ijLZAGLg2vstfdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647516106, "uuid": "ccafcdc4-d6bd-4f4d-bc7d-520df8ef3543", "value": 1125516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647516106, "uuid": "42dab3a5-4712-4eef-8ea4-48fbed0c99c8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516106, "uuid": "1bf68152-9fb3-42e9-bc79-3fc952af1d2c", "value": "FFQ-2924 N-ANDALUSIA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f5d2ee-a5ad-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647492681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492681, "uuid": "86a1fe13-2696-42e3-b6a6-04460ab7e016", "comment": "Malware payload (Mirai)", "value": "e304a4d5c991141a9ebbcaf8305a8c11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492681, "uuid": "d8ca432d-4dd8-4669-919c-f07949cac6af", "comment": "Malware payload (Mirai)", "value": "55086b87ef30555b994b4db7ff07f91c3482a80015498cdfc68fb27954330e65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492681, "uuid": "8ea40dbb-5f4a-44d9-8763-40c3fbfdf2d9", "comment": "Malware payload (Mirai)", "value": "64674eee9e909bed4bd85bb967bcdd48929d9b76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492681, "uuid": "fa322037-e71d-4b29-b869-f5c951e61263", "comment": "Malware payload (Mirai)", "value": "beed97a383715ffcf1068dc967a2d5bfb0f45fc326258c5f2a22d499d804914d387e9cb1c7d0cbc80285261c18be8172", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492681, "uuid": "373fc64c-d05b-474b-ba51-ac406db369e6", "value": "T10B3339DAB811DE7DF88AE77E40230E09B530722400D307277776FD97BE31268AA56E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492681, "uuid": "0c119593-93ff-4c95-a242-62c9091225ba", "value": "1536:wVOeSaE76Feg1p637+0mpLD6jLEoF88mf:wVOePHFHp6L+xM3xYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647492681, "uuid": "28e51bfb-1af2-46e8-8445-d2b0430a6a0c", "value": 50576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647492681, "uuid": "cb15d2ce-3a71-4551-9e4e-5d2450ddc1f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492681, "uuid": "75f02cbc-e4b1-418f-9f65-dce4b60f33ac", "value": "e304a4d5c991141a9ebbcaf8305a8c11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20dc7c7a-a620-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647541746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541746, "uuid": "67253f9f-69f7-449e-9320-2ce634a020cd", "comment": "Malware payload", "value": "72ccbcdff662fb401c53cc643a4ca255", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541746, "uuid": "3fccd5fb-2962-4f74-b3aa-a79f5bbadc9c", "comment": "Malware payload", "value": "558bdaa12a5cbeb26472ddb962d1db77ae91522eddbf04add584613c62335828", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541746, "uuid": "43a304ca-d17f-4387-852a-a45b2ec0d3f8", "comment": "Malware payload", "value": "f6b3d2d7f7a11b52a9c7d902534b058841920bf1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541746, "uuid": "d489d1bc-5119-442b-b583-cb564bf14b42", "comment": "Malware payload", "value": "1f6c76661d0bcb32dc166edfcf59c4f7e67e1f076fcbd46f3eb33ad68d1dc10976e5b0800c9d40cc6102788b54d8eb83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541746, "uuid": "c7efbb5a-1b48-4a28-84ba-6a3c3eb63866", "value": "T12E058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541746, "uuid": "6f13437e-2b48-4f0e-b258-d826f74fa6e8", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541746, "uuid": "832f1c01-e1c7-481a-9e0a-7b22febdd5d7", "value": "12288:Wvz1CLJyyvmMLSrBgb4ruGbPlVpqb+DlYzv:WJCLJyybLqB64ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647541746, "uuid": "6207add0-9325-4d9e-9a21-0307990d7a6f", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647541746, "uuid": "d2504ed4-5854-49b2-87d6-79c537e97608", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541746, "uuid": "d3329a15-b7b0-4f57-8a88-b7da3d7d0a44", "value": "72ccbcdff662fb401c53cc643a4ca255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09502fbc-a5d8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647510782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510782, "uuid": "ff89bec5-32de-4b2e-af8e-dbb63e4da3a1", "comment": "Malware payload (Mirai)", "value": "bc2c8769b6e582e40830d9c3642bbba1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510782, "uuid": "1514ec27-8c84-46f3-8c87-c07ad042e356", "comment": "Malware payload (Mirai)", "value": "564de7a2d02de0eb4334b7f0748a922210e54f81c2b3f11abb6c0495f65d27aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510782, "uuid": "995fb895-3fd0-4c0a-b459-9da28b0887ef", "comment": "Malware payload (Mirai)", "value": "31a7dd00dd27104da32b6b28fa3b30302e9097ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510782, "uuid": "f7cfb81d-0771-4c00-81c8-36e1b61a4038", "comment": "Malware payload (Mirai)", "value": "1a8c1f62e728fc500882a3bc3b0700866c3b3b08f277cd98f64221273636e588eec32f62321c9afeed9d8f4d688b0eda", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510782, "uuid": "7781ac6f-a312-465c-9a70-8bf6a3f089b4", "value": "T1E273AEB9D0156DE0C1484134A5EACE392F23B18097A26DF51A6587F6240BDFCF90EBF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510782, "uuid": "36aa88c0-3f7e-4f82-bcf7-3010bb47c2de", "value": "1536:C/NfsXK/L9kwtr/VqRt5Yqoo/IhqD7v1eQSVQx3tHZCaCI:CVfJj9kc/4RkqAInKQx3tHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647510782, "uuid": "46bee032-7192-4594-926b-a13a24600b29", "value": 76728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647510782, "uuid": "1a74d051-cfec-48f8-9171-f01f6f4d2ae5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510782, "uuid": "45705d03-3b57-4ce0-a432-cb039d1ccf56", "value": "bc2c8769b6e582e40830d9c3642bbba1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431c3b60-a619-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647538797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538797, "uuid": "f0e5a8e7-9215-47b1-bf01-f986f9a7c18f", "comment": "Malware payload", "value": "5c608092cdfbe646c62d481dfdebc907", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538797, "uuid": "488c7d92-1bc8-4948-a0c9-50be3ebb9f84", "comment": "Malware payload", "value": "5657515230cd46a585a1e937bbbd6c5c305f4f64c21f33e5d368832dcbb02d94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538797, "uuid": "e383fe91-6d6a-494f-8c1c-ea4a4680d763", "comment": "Malware payload", "value": "0b8e0eeb17fff94ce0acb68e3b06dda9deb27444", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538797, "uuid": "b5956c94-de85-4088-a183-b72d2e8f5fa9", "comment": "Malware payload", "value": "63e9dbede022d8bc72c0e09395768f5451abd766b53409289623199a5c1c28d7dda6859a528b0613cf1ee235b748dd21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538797, "uuid": "c680dba9-1fbb-491e-a172-72bf73db758c", "value": "T130058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538797, "uuid": "256368f4-f327-4653-8a02-15a137944bec", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538797, "uuid": "6eec8c9b-93d0-48a0-9b61-cff179b8722c", "value": "12288:Wvz1CLJyyvmMLSrBg94ruGbPlVpqb+DlYzv:WJCLJyybLqBA4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647538797, "uuid": "122d728c-c45e-4ea4-96d2-5b25b9d63cdd", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647538797, "uuid": "c7231ffa-e476-40e5-947c-908fa622cd16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538797, "uuid": "436363e5-949e-4a17-9981-44d70bbaa45d", "value": "5c608092cdfbe646c62d481dfdebc907", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa78ee5-a64e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647561554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561554, "uuid": "861a5c21-5de3-4b45-9e4d-1bcc4885f67e", "comment": "Malware payload", "value": "ab6ad44bb119439e36a7bae03a911734", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561554, "uuid": "85a5fa95-b83c-4f6f-afe4-94a0f8e7925e", "comment": "Malware payload", "value": "56999b46c42e78c41125dccfa694162fdb7256e51fe86e5aed87ed53c6607c40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561554, "uuid": "c73bf351-96dd-4f1c-a524-aba9694a9996", "comment": "Malware payload", "value": "b866e8a4ccf5ce152653af4a881b2dc7e27bea01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561554, "uuid": "e52cf221-2180-4801-94ff-da3994630941", "comment": "Malware payload", "value": "07a7f41406c2993119980b4395946f3f5c424602c2cc1ac9e4913c9c85367a56ccd9589e73350f49d09aaf3dcb79428f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561554, "uuid": "0a5d8242-1f21-4e7c-a242-d24324025655", "value": "T18723F2B63CF269A3E58803B8842ED5F3966208B175F85EAF10C17E149C77CB8731D589", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561554, "uuid": "68fab905-8530-45a8-a0de-fce9b2519df5", "value": "768:BcBW50kV+uvEIsx9GKjMvmysZkNre8rGpAU+DlV1e236odMEOaHQoEgkBDtbyn/M:BcBC0kV+uvYivmZZkreKuAUwV1e2Kodq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647561554, "uuid": "4a143ab4-2013-4e70-8362-65a3a66b7712", "value": 46196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647561554, "uuid": "c5aa3764-3d34-4760-8493-1aec563323fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561554, "uuid": "9bf3b056-7409-4a91-8714-1a6421278a08", "value": "ab6ad44bb119439e36a7bae03a911734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6bfe01-a617-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647538249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538249, "uuid": "01cf4929-3bea-473c-8a9f-23434e22b4ab", "comment": "Malware payload (Mirai)", "value": "f38eb576281c4fd04bbc00a491defc0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538249, "uuid": "91214ab3-8e28-40dc-9239-ba33d835da3a", "comment": "Malware payload (Mirai)", "value": "56b63b0fb8aef67e950b9c818b50f87ad7b82bb35a1e093f60277b68fa1fd78b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538249, "uuid": "d357a818-af46-4cdb-82ef-b593a5807ab0", "comment": "Malware payload (Mirai)", "value": "3dcce1a09f1c34f3704394320c9559755211afbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538249, "uuid": "e9bbfcfc-7f99-43e8-b40c-1c0073b77c9d", "comment": "Malware payload (Mirai)", "value": "0fbe1961d22b4444c976f0de1855a5fa67fab9f7f5f35cb440afcbdd4685d475bde479d10b03bb8691e0682474ed095f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538249, "uuid": "0824d963-eaae-4243-b8ca-dd9ed7908b62", "value": "T1D1B2D060458C9533CAA04936F3EE034D66867EF9F9EE51AABD1C903DD9A2C022FD4113", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538249, "uuid": "c9ba1045-f82f-4af1-bb88-53fda100210c", "value": "384:Zjsi5In08xqzs7W5sL5Z4xnUFygD7xFq4VIXLlv6J13USmdGU5EW:Zwiyn0bXeKUxD7TuK3US3UZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647538249, "uuid": "fec9045e-7546-4440-9999-3f086d46b7a3", "value": 25348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647538249, "uuid": "ef48fdb2-e50c-4381-8ca1-8ce230788dd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538249, "uuid": "67970008-8eb0-40e6-a5a0-896521eeec23", "value": "f38eb576281c4fd04bbc00a491defc0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4028b247-a585-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647475226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475226, "uuid": "a010d3d3-85af-4e82-9d16-01564f70ea16", "comment": "Malware payload (Heodo)", "value": "0faaa8ef6b1c1b857efad451e17e5ca0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475226, "uuid": "cb33ab24-d8ad-4594-afa8-968dbf387aad", "comment": "Malware payload (Heodo)", "value": "57cdad4302a1bcde3167172e2741ef37c2838785365e269b6b67a58b1f98af24", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475226, "uuid": "41d77727-1c63-45ea-85ac-f2d2548fd371", "comment": "Malware payload (Heodo)", "value": "3bf1d39659ff19799fde94492d1ac5885eaf4c79", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475226, "uuid": "3c227a82-871a-4a2f-bbc2-79e42712aa3d", "comment": "Malware payload (Heodo)", "value": "79f7850a85f158bf39d63ae73359aeb0ec0232ad6cb7945bac7cf6fc7e83c242736aea61316ef98b7460e37e2f003824", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475226, "uuid": "69432e23-ef26-4ab7-839b-9a9fdbe2d6d2", "value": "T185F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475226, "uuid": "89e0d184-a6b5-494c-bdd5-ddf9a3f315bf", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475226, "uuid": "ee37cc3f-500a-4747-8016-3d80eeb6bae4", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPKXvkgKtuBdfMAofD:WCBAdKV9Xf0kN3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647475226, "uuid": "fb022e97-bc3e-4371-b9fd-5ce9743074c3", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647475226, "uuid": "0dcc91c0-f6b0-4030-8d41-6d08d2fc40c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475226, "uuid": "20812322-5b0e-4222-8e0f-7f419dff47dc", "value": "emotet_exe_e4_57cdad4302a1bcde3167172e2741ef37c2838785365e269b6b67a58b1f98af24_2022-03-17__000017.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735987e9-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518691, "uuid": "e7e3c6ac-cbf9-4415-9dc4-046137ddc144", "comment": "Malware payload (Quakbot)", "value": "2fc626a984296583a2ac9c855f3e89df", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518691, "uuid": "259ebc42-fc86-4944-9cf6-2ffac5ccc782", "comment": "Malware payload (Quakbot)", "value": "57d5b26dc08991db5bdf30daa55887842d74cdd4977c09eafbf6429b4f3a6db0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518691, "uuid": "061ee27b-a664-431c-abdc-000cfb00ef49", "comment": "Malware payload (Quakbot)", "value": "f5a6460a3694c0ce418188bf95d0439263aad09e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518691, "uuid": "31cba9f5-b623-4f36-99d9-0ef1410791b7", "comment": "Malware payload (Quakbot)", "value": "21140ac58a02c44e414c8a51820fd055a3969f572b03ad5121771bde83d0a9a55156e8651313ae754397f8c03fdcd289", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518691, "uuid": "20b65293-efe5-4202-9da6-0496c56f0252", "value": "T13615BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518691, "uuid": "f2c62b58-f90d-4d00-a726-f3fcc5277974", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518691, "uuid": "e495a4a1-2d8f-47b2-ad1c-5f5cf074ef66", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518691, "uuid": "a9b24ee3-bfe5-4b3d-a6c7-a2d400cb6e80", "value": 933017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518691, "uuid": "651e4243-842b-4868-a963-384c5e727577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518691, "uuid": "d1311135-3c16-48c6-b37d-bbe64c62f0d2", "value": "57d5b26dc08991db5bdf30daa55887842d74cdd4977c09eafbf6429b4f3a6db0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbad84f9-a5e7-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647517524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517524, "uuid": "3d5c00b6-506f-4d08-b5df-af5d91bfb8f5", "comment": "Malware payload (RemcosRAT)", "value": "c9c6ef483fc7bff718305b3c8e6a09f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517524, "uuid": "aeb37999-8a5e-450f-bbdd-a9b7aa152542", "comment": "Malware payload (RemcosRAT)", "value": "58d5e6849f56a08355256394531c49e55e2539e61c56da5ee0594cecd80a0142", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517524, "uuid": "d7850f26-62b5-44b6-a2b0-bf56dd0c1052", "comment": "Malware payload (RemcosRAT)", "value": "97fd6cf4573e9823fb99cf57e913fad2df9ac7ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517524, "uuid": "f84ed582-daaf-48cd-8ab4-cda74ae57066", "comment": "Malware payload (RemcosRAT)", "value": "8230a140449a0b7f4fc12664f4c718cc6604e5aabbb6561c707d7076e40ae91abfd32251a4a3bfd5491412db11ab10e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517524, "uuid": "ee9c882d-67ba-429b-97db-39248015699a", "value": "T15F95E0E0F6508496FD690BB4A837CC2506677D79ACB0D21EB949B3B96F733D3002A50B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517524, "uuid": "1c65c70b-da7a-4054-9127-26c802fe5388", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517524, "uuid": "c1c6409d-c804-4e29-8ed8-3e4044c405bc", "value": "49152:lc3XWYCvZgwabAS3u0Rd20YyGG09XmC2vu:lF/xXuTuuPAF9XmC2vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647517524, "uuid": "6da3d15f-e7fc-49bc-b7f6-e3f015c4b3b3", "value": 1884848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647517524, "uuid": "d674c8f6-4246-43c4-8a9f-08f216d4e3c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517524, "uuid": "fb768ba4-e5ee-48ac-af3a-d7d04b310614", "value": "Payment transfer recipet returned copy.pdf.ex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fdc8f4-a62c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647546962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647546962, "uuid": "c79b17a2-a508-4679-a90b-8795f70d3082", "comment": "Malware payload", "value": "496b747d186728c551b3d25f32b4e2f0", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647546962, "uuid": "43760bf7-c734-4a30-8ded-62b91cbd8889", "comment": "Malware payload", "value": "5913f7bbc13d578b7f4fbbac9590d0636189075ae92cbda62926e9920c3654c5", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647546962, "uuid": "17ae54b8-f66c-4dcf-a4d3-ee6ff6b27a45", "comment": "Malware payload", "value": "7b5f22a8440ba6b05bc8ed76d2f4fa13b069e32b", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647546962, "uuid": "7ba87219-6808-4dc7-a9be-b8905f936cf9", "comment": "Malware payload", "value": "406cff279e61304df1590cbb391f9ad30ebd86067da64af4779ae27d6c172b5506d3e0bd655a1b907e31c949a452bb66", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647546962, "uuid": "e7d6b0c6-338a-4c7a-9aa4-17a4cd34ef27", "value": "T156A2BF3FD131A828E77FA87C920440F6E7071C4A1007AA9D2C55F75E65776BA038F66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647546962, "uuid": "a22851b8-edc4-4b03-88c1-c64b63912789", "value": "384:TA2Y5Vb1GNj20o4CGzPd6ZIwLJKb5CzgObff9kC+xbX7k7aU2d:U2EINro4FLAOCBn9kC+xbLkWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647546962, "uuid": "3404a217-5fd4-44c0-b4f3-74dc996f7c09", "value": 21452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647546962, "uuid": "c066e073-dd26-4ea7-b19c-6de4fbf5c7eb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647546962, "uuid": "93fbe0dd-279c-47a1-8a89-52e4d73b7415", "value": "SDM-010322 ZUFO-170322.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008320c3-a5ec-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647519358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519358, "uuid": "6ace68ef-5358-4787-a009-1912589a181f", "comment": "Malware payload (RedLineStealer)", "value": "bffc363b062b6fff7769928c1e94466d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519358, "uuid": "e28b94f7-91de-4189-ae8c-3875f1cb8325", "comment": "Malware payload (RedLineStealer)", "value": "5968ab7ccbd79f7d150dc5ddc50336183d6249d0539213b575ae7b5f11bca322", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519358, "uuid": "4645b476-554a-4144-8a5f-eefafd4384d0", "comment": "Malware payload (RedLineStealer)", "value": "15e0056d53f9bb8178fe0e9bf40f69503b38fb4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519358, "uuid": "6eae40c2-f470-4dbb-b499-737a03fcb79d", "comment": "Malware payload (RedLineStealer)", "value": "acb05374f697afca50378df5ca15d0046c9f9cabe75c6ac769a163af1b817242c6f75ddcfc3b582c12fadc85c20bb47b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519358, "uuid": "a7b4a11a-a4b1-4968-ac68-82bdbb90aad3", "value": "T19184BE40FBA0D038E1B716F8797983BCB92E3D605B2465CB22D62ADE15356E0ECB5347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519358, "uuid": "1393b9cd-0582-4cd6-9308-f584b08584b9", "value": "09ea47ee23ad099538cfa93d9453f9e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519358, "uuid": "bf4aaba0-c394-4928-aefe-b6ca3d060d00", "value": "6144:8lXqcZ7Z92UAuD52bsOfwvAxRJF9R80WRGClYFTD4httz0DR:8lNZ7L6cwbsHYx3WgC2DItw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647519358, "uuid": "0b3fd53a-3e7d-4f03-933b-0df46c22f26a", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647519358, "uuid": "a7ae3e4b-81fa-4a21-80bd-4728b18eb23f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519358, "uuid": "2cdce404-ad88-483f-a17d-52ed972d3128", "value": "bffc363b062b6fff7769928c1e94466d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a23b65-a5e4-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647515932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515932, "uuid": "ea99d7cb-5d54-40b1-bec4-7f0423ab1357", "comment": "Malware payload (Formbook)", "value": "b559f1ecb21ab9ce5eb9244d754649b2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515932, "uuid": "f8ba777b-e923-494a-ae19-04e7f7b7145e", "comment": "Malware payload (Formbook)", "value": "599cda43bb4a5ea8c717986ed7219661314ab7dba0d6a946d40742790aaf5688", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515932, "uuid": "5bbcc4df-562d-4e0e-8c20-82bf1d21fb21", "comment": "Malware payload (Formbook)", "value": "36d251a088de972003dcdebebad7928efc81024b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515932, "uuid": "e2276ad7-2b10-4218-a20c-bdb0a2f6ff20", "comment": "Malware payload (Formbook)", "value": "77aa031eba39f6d7125fb78f1e22ee33b1cfa4dc6d4e78e9e03c530a53f7ca81c49967dae281a3cc690766fc2f42843e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515932, "uuid": "052886ee-69f3-451f-91f6-26792e128ff7", "value": "T17984239AEA4158C907FCED3600257766F523088E072C7AC9BEE42E7673946DCEFD1056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515932, "uuid": "791b33ba-3122-404a-a410-04a1806fdefe", "value": "6144:/jaJZj738zuBFtwURx5Beud3s48upahW09B9kcBekwsk3CWnBlr/w8yTdTllP7Lt:/jY0Kis5Beud3SupKW09twsyBp/LyNTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515932, "uuid": "d6a5b150-91ce-413a-baeb-33576f841b70", "value": 378277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515932, "uuid": "5aad9d6a-bd8f-4a35-9ceb-996714436832", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515932, "uuid": "c7aa6736-28ae-41f4-be40-5fb3cd87b6d6", "value": "statement of account.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca5f434-a5e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647515808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515808, "uuid": "830add51-52b0-4e1f-9866-a1ba7bf37344", "comment": "Malware payload (Heodo)", "value": "7c6c4b0154c2f8d40e663ffe3849a0be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515808, "uuid": "fb8d31dd-1bda-4a2e-a92f-648a8cb5239e", "comment": "Malware payload (Heodo)", "value": "59e113d9b2dd24d7d165483a4441020809883d907bfe1783594fe81ec21cfbdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515808, "uuid": "39a19234-c788-4ded-ae42-02716fd64a77", "comment": "Malware payload (Heodo)", "value": "41947f60b75f6efb3b4a1c119ab86ea191598fb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515808, "uuid": "48337191-415a-46d7-94a9-127c2a2da040", "comment": "Malware payload (Heodo)", "value": "22fd631844720823ef6a706bcb313a6ec43ea937c005bbdedc794df265d43e0163c4470e4211ae9f529f9d433d324909", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515808, "uuid": "837db252-0af7-446a-b1e2-dbaf949ae21f", "value": "T1E7058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515808, "uuid": "e8f2025b-4ef4-4295-9a49-c7356ed172e2", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515808, "uuid": "54a49feb-e94a-42ca-a4e5-4b1a24e520ec", "value": "12288:Wvz1CLJyyvmMLSrBgc4ruGbPlVpqb+DlYzv:WJCLJyybLqB14ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515808, "uuid": "bb4e06d7-7ed7-4605-8e4b-69f8d584c83a", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515808, "uuid": "1c9adbe5-61e7-41e9-9f63-0c39f86966d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515808, "uuid": "394e1c48-dec6-48be-af2b-7da68362ed38", "value": "7c6c4b0154c2f8d40e663ffe3849a0be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b617cc-a648-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647559117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559117, "uuid": "23b22315-03e0-4ca2-b083-ea321feea359", "comment": "Malware payload", "value": "511480db6e062c1d6a42e53e1184f7ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559117, "uuid": "17fcc0bb-88a5-4de7-b174-4325623a1594", "comment": "Malware payload", "value": "5a77a0de04767908eb8b3ea61f9943b0fda1c913805ebd9af1c5c989253c45f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559117, "uuid": "a82c022c-a9a1-489c-b0f3-3603e9c63d4e", "comment": "Malware payload", "value": "8ed79cb09b8f98994842422773daba7726cd22ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559117, "uuid": "f17fbc2c-4931-406f-b427-d99b10644989", "comment": "Malware payload", "value": "d64f25de3958368bbf1cde9d839b6c1ebe99d981066ab74137f86120cc8389f10367f479eb416e666a210cd0ea3006c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559117, "uuid": "54c2dadf-c4e3-4e7a-b2b0-a21dc113fc84", "value": "T134059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559117, "uuid": "df271ffe-3a55-4f83-8119-c777a7c50222", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559117, "uuid": "c6e25e69-98b9-4bc5-b8c7-af09b53b4cbb", "value": "12288:V20BXOMcVzpWfmmnDDgX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDsX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647559117, "uuid": "f82a23e0-e010-430c-aead-528020dd74c9", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647559117, "uuid": "cf99e2c2-e267-4cd2-bd03-c774bdbfb903", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559117, "uuid": "f074c301-a65a-4432-8425-b1b4cbb0e1f1", "value": "511480db6e062c1d6a42e53e1184f7ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b74a2c-a603-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647529272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529272, "uuid": "33955443-cf4d-42a8-ab36-e6297f2f0e24", "comment": "Malware payload", "value": "2bd0af9ef4ada36b27dd19b5306b16f1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529272, "uuid": "845a2822-5a68-4530-8c74-3dd9bd2ef5e3", "comment": "Malware payload", "value": "5ac5ea703b5335704e9f555e97a22387e9ca9cb97ac0d08759a3d831e9592462", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529272, "uuid": "239d85db-30da-4f0a-ac69-d594d6cf0658", "comment": "Malware payload", "value": "73f3ad8ff775bea8cca0b9aaf992d42f1745603c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529272, "uuid": "4edc39b7-7302-4dbc-ab92-6e201347baf7", "comment": "Malware payload", "value": "4a6ed70ba9d4535d728d027b364e91b167efd0218d7d4b264e8d41af39a3a29f7cc244b025fa4e9508b24cd787cdac41", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529272, "uuid": "37b305d5-f540-4cbf-b340-292e32f8e31e", "value": "T16E652393D7A51196ECFB5033599303986F3A2C253151E97BB7C2B62D28F3B943F21A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529272, "uuid": "0066487e-e0e4-4ce5-bcb4-279a602a9581", "value": "24576:kBXAhLnAAM0dGSxj+bkty/kFG/xbnXo5ANWm0gwUj7kwwTD0FHRaQPNchw8:iAhLNJtZ60cxTXoKWmTwVRWsSNchw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647529272, "uuid": "7a4c30fe-d1d9-4dab-8c3b-a1f09b7ad0eb", "value": 1509333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647529272, "uuid": "4837e978-bd52-4401-8ddb-db636aaf09d6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529272, "uuid": "1461fcd2-fcf0-480a-8285-1152c2bfeafa", "value": "5ac5ea703b5335704e9f555e97a22387e9ca9cb97ac0d08759a3d831e9592462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599392cb-a5c6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647503186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503186, "uuid": "433bae31-8db8-4f0c-aced-072aa32b5d8b", "comment": "Malware payload (Heodo)", "value": "a320dbbaa0910b17553afa3dbf4a7ab9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503186, "uuid": "7214ae15-a595-40cb-a4e9-ecdbc255ad67", "comment": "Malware payload (Heodo)", "value": "5c136d31700365c4dc9f3591f9557f2092217d44714fc0ddaf5628f2b71dfb20", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503186, "uuid": "2b8104cc-33e7-49aa-962e-bf99265bab9d", "comment": "Malware payload (Heodo)", "value": "9f1ae0269503ae8ff8334c0476611fc738b907c1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503186, "uuid": "ebd89dbe-304b-4bc2-8256-0c0515ba81a3", "comment": "Malware payload (Heodo)", "value": "bb3c7e4f74b843b57b0f0e7348c8052e551f604a559b315208093a2e9deccecec77cef1249778cfe0fb381b2b8ec097c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647503186, "uuid": "98155e88-53a6-4f26-8ee6-a59c573612a1", "value": "T182A29E2CE921744DE3BB683C420650FA924A1C022147B5ED3991F77D6B73697068FEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647503186, "uuid": "49f65333-4493-4224-82a7-66a9362f8bb4", "value": "384:X3uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:rsNs/zXtFCBn9kC+xbL42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647503186, "uuid": "f6d4d28c-b3c9-4c14-b3a7-50b8c23b559b", "value": 21657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647503186, "uuid": "a9eefb8d-a647-45f8-b746-34d4c2132af0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647503186, "uuid": "e7c84044-ff85-46a6-9dcf-4ab5e4442d4c", "value": "2022-03-17_1645.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76bbbf68-a5df-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513972, "uuid": "d7618a3e-a0ca-49a5-acef-f4a53fb1fe2a", "comment": "Malware payload (Heodo)", "value": "63242c09e5ffd2a398bc1d188e29c13c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513972, "uuid": "4b566646-088b-472d-978d-aae5625cf061", "comment": "Malware payload (Heodo)", "value": "5c6fd68416011ce492add47e910baf202094b9004ade93e3a0624ec825c36790", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513972, "uuid": "16ffdfc2-2fe1-43af-95ae-5a0525039c47", "comment": "Malware payload (Heodo)", "value": "e0be6e165b09e1eecf8d0b5d1325cced6c18feb5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513972, "uuid": "de4eb72c-ca24-4514-b819-526bda0dfd74", "comment": "Malware payload (Heodo)", "value": "ae94b3f08b96975eb9f0f22396c48cfe7edb20f2b9bac5efabb3af7c9d94e48b8c1d5eaf97e708e059b9d2931b7f68b6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513972, "uuid": "6b228e81-22af-4095-9c8a-264826860bdb", "value": "T1FF058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513972, "uuid": "56fb9a2c-c7d0-4aba-8ef6-b6ada8cc59a3", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513972, "uuid": "ab24b509-5b0b-4938-ba39-57f9089b298e", "value": "12288:Wvz1CLJyyvmMLSrBgy4ruGbPlVpqb+DlYzv:WJCLJyybLqB34ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513972, "uuid": "103987b2-5c5f-4756-8785-c64cb131ec8c", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513972, "uuid": "2c07718c-cf5d-4650-b3d2-0fe430e22a81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513972, "uuid": "7647c8b9-4c9b-48df-b46b-de555054cc26", "value": "emotet_exe_e5_5c6fd68416011ce492add47e910baf202094b9004ade93e3a0624ec825c36790_2022-03-17__104607.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a865a3cd-a632-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647549704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549704, "uuid": "d8955770-cbda-4e6b-83f5-5bbaa1c875d3", "comment": "Malware payload", "value": "f3d58879abe501bf1aecaee2427ed309", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549704, "uuid": "67af0a0a-c902-4a3a-af5d-dbe6834b3353", "comment": "Malware payload", "value": "5dd859259ff593cc8b1f0bf11467c44e15d97150adac56b08e2f10013ac076b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549704, "uuid": "733d9fab-4e57-41e2-8715-e030ee8c1841", "comment": "Malware payload", "value": "747efd7e59f948562eece32e3c45fc8c4efae3db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549704, "uuid": "23d02b16-0e60-4b70-87ef-0b721c66b457", "comment": "Malware payload", "value": "50209ab7c395f22be72b3aae1fba6577cfeb6f46f286bd495bb73618f0654d54f5bfb85f19e97cb52e77eded4c49a86e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549704, "uuid": "d2c8541f-284c-4815-b63a-72fae1277ce6", "value": "T1DEC42B017896603CDFDA363601F7EB2531E75CB0677CB52E6EC168EC9B2628A051D63E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549704, "uuid": "b8b52ffd-dc5e-4b43-9eb7-4f9258c1f48c", "value": "fe91b35dbbcef6d3f3836ad3e8b836df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549704, "uuid": "a725a27d-6766-4262-b33d-f7eaded19d77", "value": "6144:xe4HnxyzcUzcUin5jBd4hp3CBj6O7O7OOuw/RRRI7E7E7E7Z94kx8888rLCkxEZK:56Kv+tEgqAdov6eimJEeTN+sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647549704, "uuid": "99a3f5ed-cf26-4cc5-8b66-a0bc0c6bc386", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647549704, "uuid": "97a591ac-41b3-4a4b-902f-f5a82d1a0020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549704, "uuid": "2c2a1e32-6c1a-4e3f-be5d-64efcfd52c19", "value": "f3d58879abe501bf1aecaee2427ed309", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af5d0dc-a5ed-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647519966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519966, "uuid": "62b59aa2-c7e8-49f4-a43b-b3ba99ff1990", "comment": "Malware payload (RedLineStealer)", "value": "9063f13c7af4d083dc9fd1e8f4c00b74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519966, "uuid": "b91ca374-d2ed-479d-bb7e-1d20763461d9", "comment": "Malware payload (RedLineStealer)", "value": "5dff2d96d80a1afa41f53607b42c45a3ea0484f01b4226b21f00e29ec53bd45a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519966, "uuid": "7e7a86ae-a5a4-4f84-b299-ebda87e7385b", "comment": "Malware payload (RedLineStealer)", "value": "3985d6f57bb1e950fc5179e05308f124b8986958", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519966, "uuid": "4a0d0a4a-133f-45f2-97ea-6054d89f3b40", "comment": "Malware payload (RedLineStealer)", "value": "30f38491e01b669bd583d3d23dedc82aad8664dedb2b45270c832d9a4dbb4b67ad30105c6966a5f9e19d56317bccb84f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519966, "uuid": "4f1ea8eb-1f37-44a1-9674-d593dfeb11cb", "value": "T19784CF40B7A0D03DE5B341F8797A93AC653E7DA14B2560CB62D61BDE1A346E0ECB530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519966, "uuid": "35948cbb-12ca-430e-b49f-5b64ae4c715a", "value": "f1731ed7afe55cfc124203197b72d3ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519966, "uuid": "1118aa2f-616a-40d4-95a2-5794877c6bfa", "value": "6144:ugS5tftIsIkod51Bwv6SZfdO9Zxw7EGADbJBYrUqVKvOaRaY:ugSftIsIkG5oSSZf0JwRADbJShol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647519966, "uuid": "8e4467a2-096e-4534-ad64-9bd41bb56f68", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647519966, "uuid": "f71f3ad3-4a47-4353-b3ca-3be1aa8ee3e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519966, "uuid": "6fed9fce-73a8-4d75-b04c-abacd7d0b860", "value": "9063f13c7af4d083dc9fd1e8f4c00b74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b43e0c0-a601-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647528395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528395, "uuid": "36e6344f-d9bb-4c30-8c12-bde9cec79f95", "comment": "Malware payload", "value": "662cf5d1eaee03c3b96200346bd66178", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528395, "uuid": "24a62d34-1222-41b3-b0a8-1e64cf565a0e", "comment": "Malware payload", "value": "5e4ca454634824d3b1e6a358d07b65d75d3ee67e2ca8e662cc87daffabd678f1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528395, "uuid": "5792486a-6627-4fae-bf40-95176637b566", "comment": "Malware payload", "value": "c4751fc1a586eb4455f96e3e0b09e7893dc079cf", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528395, "uuid": "e10a2b7e-9948-4d2f-9f58-ad7df418542a", "comment": "Malware payload", "value": "042acd3cbac7f653e1c2af786ebb71597273990444e6216a20ac87057a7876437ade7a2434de55eaa65982933ca07085", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528395, "uuid": "cf0dcf0b-b185-4924-be0a-dedfda4da393", "value": "T1B9061281E3E8942FC97781334ABB073612468D468896D7575B68F23C5DBBAC04F9AFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528395, "uuid": "107c4017-06ac-48a2-9109-0b88395ce7df", "value": "98304:dX7tmV5JN9XYiUPoWnW8xq92/IUJOCfu26PPPV:dXuJN9XYi0rnWEqU/JRAHPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647528395, "uuid": "9d97e8d1-0f0a-4990-820e-03f566e7b30a", "value": 3799337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647528395, "uuid": "1b5a888d-44c8-4396-a5ae-8a6ada773801", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528395, "uuid": "2f670aa6-4972-409f-82f0-fc97d9c0c170", "value": "bancasicura(1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344fb97c-a5ca-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647504842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647504842, "uuid": "3d2e272d-517e-4e38-bfef-1607f19a1446", "comment": "Malware payload (Formbook)", "value": "e4a233d9cc7493a207981b6944007ded", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647504842, "uuid": "3fd04dc9-4f8a-492b-a9d3-08770e67b986", "comment": "Malware payload (Formbook)", "value": "5f01025a3581c559ba0e0d95616b38fbf069240a5e4dcca369c1d79c3b9d4fc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647504842, "uuid": "08a420ac-2535-44f9-b8b2-d50920963cf4", "comment": "Malware payload (Formbook)", "value": "3a81dfebe656592e7f8b9b2c5787201df43a6f01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647504842, "uuid": "0d2557ee-1ec4-4bff-b3ed-271455682624", "comment": "Malware payload (Formbook)", "value": "1a5532f244a754cd807e9a2a5987873e600af76e40f9db488718b88cd9a9813b22fcf835986c8814aa29e953749650d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647504842, "uuid": "8bfc34eb-2ec5-42d2-86a1-153937955b50", "value": "T109B412321ED5FC93C251CDB5AAB0E3FB12BA81843F4A5613CB500DAE9D389E8FB45185", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647504842, "uuid": "0a7aabc2-31b2-4b53-ae21-b7f1867ddc19", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647504842, "uuid": "c48c3c13-632b-400b-8cc8-87f86ddcc28c", "value": "12288:ivQJ6PFvqTUYXcXSPPTe225N4MFVsZmwQYYCmQnAi:iv46PFvkgXQyB5yYzQAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647504842, "uuid": "b8932480-ee4e-46a7-8a11-c7703bb50a35", "value": 538861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647504842, "uuid": "ee9e4fe8-f10a-4289-9701-771c66cc11c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647504842, "uuid": "bf2fca32-3781-4133-8f3e-c88c6a4a5a50", "value": "DHL20203865.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a7da7e-a5c9-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647504575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647504575, "uuid": "ef0b3517-b9a1-4a21-86ab-d70caa59462b", "comment": "Malware payload (AgentTesla)", "value": "d285e2a2392ac41e01797fe70a989f60", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647504575, "uuid": "0b0d3630-9bae-4655-a14a-10ed3153f552", "comment": "Malware payload (AgentTesla)", "value": "5f10e10f2dee7ba6262a34e1fc5c3111d796111c92fe0883f2e4f3d36ed298bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647504575, "uuid": "8fd98547-446a-4527-a784-23c1ea796fb7", "comment": "Malware payload (AgentTesla)", "value": "d25677028c946e2ede00075ef853d848a8fa870c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647504575, "uuid": "773358fa-b4b3-4c4b-99fd-31cccf761040", "comment": "Malware payload (AgentTesla)", "value": "a33626c46ebf1a879f129951a43dd8cc6dc1b5404a13d0c2f2a379f1e9583227963cc0ea485e50905cd076b4c7e1d688", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647504575, "uuid": "93d969a3-2581-4f2b-a0af-caff4b6d3ea5", "value": "T18525F1A03F596FC1F5395BF4415B566EC3F329662F03E9791EB02ACB081EF025169A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647504575, "uuid": "00b21b1b-5e0d-4b7f-8742-30ca65fbb302", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647504575, "uuid": "708b0b32-a62c-4d25-9da4-98a6c642938f", "value": "12288:+SBMQmqD7EQ5qeb4YXbD0vr83QxsjuTo9ITIEsuT6V3y4n2kdiCdiVJiwQpFjvP8:+SBCXipD+Qj1IEErmV/ddi8ivMFChzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647504575, "uuid": "339260fc-4e53-42bd-8f48-f6335f0990ba", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647504575, "uuid": "71d1058e-0fee-49e9-863b-35c7a4ef6274", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647504575, "uuid": "65747c4b-6d52-4be4-8359-fc178bbe3604", "value": "Invoice#1062324.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf1b788-a62e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647547725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547725, "uuid": "08ae00df-a209-4e2c-b522-e830fbd35e5a", "comment": "Malware payload", "value": "2fff04110904c512c6eaaf5dac98fac6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547725, "uuid": "20edf414-faee-45d1-82fb-36a229aa8a89", "comment": "Malware payload", "value": "5f1d33751de8d8f3cec2866561b66f89cbe0b66580aed61ecae768e506c0531e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547725, "uuid": "2956aa48-17b1-4126-8561-4ccda34f53e3", "comment": "Malware payload", "value": "852c6c51edba1bb267c08a6bb284cc53ee9a12ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547725, "uuid": "15a49e4a-2a5c-4d0a-9014-17a802c99647", "comment": "Malware payload", "value": "006c11a97d8ef4a00f1f6a44754f7d82fb396e65122aa5d476b6a2ee43794034819f9b7bee1a7613a4e3134d99341187", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547725, "uuid": "bd098360-be46-4bf9-8533-2d380c69dab8", "value": "T19183BE80BB1B9D52C63867B0C1DB91981B71538B4023E99F2EED90C467677C987D2F8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547725, "uuid": "e58314ff-e270-46fb-a7ae-3b3e1bc20874", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547725, "uuid": "53d422c5-deb7-4caa-9846-be0e91795ea7", "value": "1536:o6p8zqaJ5jAlx5ZMUi58O1n9yYGCSXKzNwFsFIJp3LKLqekn9F+Pszo:m12O9yucdaFSKdkn9o0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647547725, "uuid": "601e2273-8dc1-41a8-99fc-66e979ac2ba1", "value": 88328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647547725, "uuid": "02e6e4a9-0b5e-42fa-b668-8af5664dd7cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547725, "uuid": "28beb25d-82c4-4d56-9fab-ac3ebcaf29d6", "value": "Order SpecificationQuantity__1243536203-15-2022#A201223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22747d96-a58c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647478183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647478183, "uuid": "3b89b77a-c21f-4b62-86ef-e5e9dfb8936d", "comment": "Malware payload (Heodo)", "value": "35211e1256078a590b47c7f2c52682fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647478183, "uuid": "57fce434-83ae-4457-9583-57f7283ce17c", "comment": "Malware payload (Heodo)", "value": "5fda965b85da648464778fdfb242a1150b227424dcecf585b711c7055244645a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647478183, "uuid": "141f71f6-be22-48e4-97a9-5499b1c1bd84", "comment": "Malware payload (Heodo)", "value": "18fbf88303d38570242c32879c022c084b30f5bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647478183, "uuid": "4463ab86-7704-4640-b1a7-d8fa8bf00bb6", "comment": "Malware payload (Heodo)", "value": "0600347e2fc2938dbdf0e8d9b8c6f1b10829fc61aeac9dc6e88ee0fca3fc7b9a3f41224c75a998c9b00c4f5a7df9ed88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647478183, "uuid": "5eea2f29-4a18-4fe4-b938-d9ad075e4c9c", "value": "T1D6F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647478183, "uuid": "e1a5a675-a091-49ff-98c7-e1906282f4c6", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647478183, "uuid": "e00ca909-f035-490f-95a2-3931b55c620f", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPJXvkgKtuBdfMAofD:WCBAdKV9Xf0k63KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647478183, "uuid": "6ab9bfdd-a257-4aa0-ae9a-c008fe08e124", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647478183, "uuid": "0b0de150-1345-4a5d-bd42-ecdabe06ff34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647478183, "uuid": "cd4f9d44-cccc-489d-b934-9a3a396c2d69", "value": "35211e1256078a590b47c7f2c52682fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19525bf3-a600-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647527989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647527989, "uuid": "43de2864-fc2b-4f98-8ea1-41d4cc0dfbd5", "comment": "Malware payload (Formbook)", "value": "dfa97206a23d6dae7a5c466e0f5aa03a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647527989, "uuid": "ea70dc01-4f43-475f-9d2a-23821bc7a781", "comment": "Malware payload (Formbook)", "value": "5fee13cfc6691c621a8ce44148cc9f7beb3eca64092b429bde7d8d9a71ceb096", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647527989, "uuid": "9f8c9675-f910-4a13-9f66-8cca4bcea93e", "comment": "Malware payload (Formbook)", "value": "e6880fe50acf468127b21da35bec8546d5aac3af", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647527989, "uuid": "76185675-783a-4db4-8c7e-c28757b97cdf", "comment": "Malware payload (Formbook)", "value": "7b89f337fbd019ba1ccbd82f0a6b2e2a8f01612e02e67cea559f6b6ec911c99711d86ff6df18cc028614cc139a32afb6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647527989, "uuid": "a728b02c-9209-4f6d-94f1-fcfc2cbb55f0", "value": "T11435330ED75BD1CF895805CA80BD65CDFCB2FE7AAA323582C470B519AE078D474E6C4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647527989, "uuid": "9ff90cf6-9884-4035-a71d-84e1587294ce", "value": "24576:DuaY+CyWXdT9+uzs1cMQx+Vy6rs9X3TjDbMzJYGi6EIR5kynT:DuJ+nWXdT9+uH+qX3TzMJYGiGRCyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647527989, "uuid": "c6c8fb4c-ca66-4a6a-bce9-1b85eca758ec", "value": 1089638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647527989, "uuid": "8d03db4b-4fa8-4363-bbfd-6df202fa53e5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647527989, "uuid": "8e794aca-05e7-4a49-9546-66802df13f8f", "value": "Payment Receipt_EURO_38474.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa7dca4-a585-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647475271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475271, "uuid": "ad2b166a-6b9e-40d7-807b-2c1b1e115879", "comment": "Malware payload (Heodo)", "value": "295308b5331d43d13307fe56a0840d9d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475271, "uuid": "0b3089e4-147b-4b23-9df1-6f9fbe3d7f07", "comment": "Malware payload (Heodo)", "value": "60b7195b995bde9bf87597acef035ef2091df22d3618c1ae1bb2596605fdfe7c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475271, "uuid": "d9a3ea28-396f-4f55-b8b1-87c3487c2771", "comment": "Malware payload (Heodo)", "value": "2946053467dc623eb459a0f7eac0b356d696043a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475271, "uuid": "913ec844-875e-4a12-860e-1f8e79c7417a", "comment": "Malware payload (Heodo)", "value": "7f141bbbd97a890fcbac577c43ddf807689e08215af123480151016117210d8b483226c7018f3ae195aca6d608d5d93d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475271, "uuid": "424c5062-2887-407c-afd7-49e41622d221", "value": "T109F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475271, "uuid": "d287c79e-6089-4eb6-ac0e-78ea530b04c7", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475271, "uuid": "3effd275-60b2-403a-8d02-c660482dce92", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hk8rLneTfABCJoWRWwfpW:BeCCF88j+Xh8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647475271, "uuid": "43d6db36-ed9d-481b-93c0-35d56d6cefbf", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647475271, "uuid": "c0bfbfe4-b4b3-418d-8072-3da40092b4da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475271, "uuid": "dfff58c5-17ae-41c8-a8fb-4a49d0746522", "value": "emotet_exe_e5_60b7195b995bde9bf87597acef035ef2091df22d3618c1ae1bb2596605fdfe7c_2022-03-17__000100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb2922a-a628-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647545287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545287, "uuid": "b2252b27-0ea5-40d1-9a28-1c5089b8b2a2", "comment": "Malware payload (RedLineStealer)", "value": "3cf82750fa70ad199c3082be27aeb8d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545287, "uuid": "1943bc8b-e79b-4ff8-8934-d9a31bfb2191", "comment": "Malware payload (RedLineStealer)", "value": "61c0e131adc2250a9081f693af7c3ebb6df3db558bdd7fd30aa0cbb086d7d8e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545287, "uuid": "7947a346-9b80-4db3-8fd2-87c99a2d744a", "comment": "Malware payload (RedLineStealer)", "value": "bc711a15eb9c27c0916a267fd33c6c1aec5fc089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545287, "uuid": "74afaf98-3d71-4696-91dc-7baa20903ce4", "comment": "Malware payload (RedLineStealer)", "value": "bdf010a680c1a80e6258e406ba75b4a2be136a0f41a26ebd579624310347b9db2657921c6687711f62a6cce7e6e19b16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545287, "uuid": "da1eb15e-37a8-49a8-9c8e-9d15937b3c7d", "value": "T146B4B53439FB902AF1B3EF75DAD87596DF5EB7632607E84D204103864A03B42DE9163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545287, "uuid": "4c7e2e43-5aea-4bce-a616-a5ce15750bdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545287, "uuid": "7475ae1e-498b-43d7-a308-e0fe53cbd5b4", "value": "6144:6Nq9n89a2wKZPPdd6e9Ht5Nxkqjoqbj7wIcEZvtqWdPr:iM89a2wePfT9rN+qjxoIcEBAyPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647545287, "uuid": "754cf554-5830-453b-809d-6bd0d07d6d7b", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647545287, "uuid": "84d1278d-2152-457d-8340-3d698c12b767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545287, "uuid": "401875e5-848f-4a02-adce-f9e24e094036", "value": "12029392.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cebe18c8-a63f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647555352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555352, "uuid": "e5605ba6-aff3-452e-847d-8989e4076301", "comment": "Malware payload", "value": "e4359db4127cb1c3085f9f343f47e18c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555352, "uuid": "d917152d-8d22-410e-ac3a-ff173eae1745", "comment": "Malware payload", "value": "62122ba0463f1de1fc63236ab9affbb95ce40ff5bef629f6ed91f357a6199587", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555352, "uuid": "6fd1a44d-9931-4bd6-b9f0-ab87f0504c50", "comment": "Malware payload", "value": "da215a9f6ad806c2f37f196bee2adf9258282301", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555352, "uuid": "2b2ffe7e-5cc6-4ad5-b1c8-6a1b08405f50", "comment": "Malware payload", "value": "cafd60d64ac3a8f017aa006bf675c569f9662f155f11a254b4c398b852c9ac9aede64a72f29ac0a43bef5ccb7f304752", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555352, "uuid": "46f2494f-6209-45ed-8b94-b646369d8d72", "value": "T1BC059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555352, "uuid": "3d229aa0-398b-421e-8d8f-709db04cde29", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555352, "uuid": "68a44e27-90fb-4bb7-954f-48ed69ebe19b", "value": "12288:V20BXOMcVzpWfmmnDDdX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDhX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647555352, "uuid": "ecbf9099-1065-4497-b408-5fba311579a6", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647555352, "uuid": "b42323e7-802a-4b5c-887e-2e7703143ba2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555352, "uuid": "870d7a2a-64e3-4b5d-8b7b-6a9e72c71335", "value": "e4359db4127cb1c3085f9f343f47e18c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62478a80-a60b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647532836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532836, "uuid": "2a2f14ef-935c-412f-aa24-e721f87e35c0", "comment": "Malware payload (Heodo)", "value": "a5d7b8b6a59988899987c1cf802cd5ba", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532836, "uuid": "ccef4dd7-e0fb-48e7-a448-a543ae5e5b3b", "comment": "Malware payload (Heodo)", "value": "62eb74cbfd6a9885bd5f8c1b3eeef57a5f96d31fdd8644afdadb275f1ba32409", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532836, "uuid": "ff9a3245-a17e-4968-adbc-7ebb7f19bd24", "comment": "Malware payload (Heodo)", "value": "91d61af8b33e7c187c038b72a6b8a1c2e4bfc8f0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532836, "uuid": "1f36515b-7e2e-4843-b4b1-d3c7df50e19a", "comment": "Malware payload (Heodo)", "value": "f5c22c27c1f94638ac79abcc5b9812e56ad6af33b7ce1c9c5401ca4141606c42e84256847c99e49514b299bc8a1db5ad", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532836, "uuid": "ecac32c5-8c8c-4659-a913-66ac478e8d5d", "value": "T198A2AF3ED221E818D67B987C830580F6E70B2C561007A9ED2D51F25D66726F7138FABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532836, "uuid": "29e993d0-15c7-4577-aab5-bc78d2494511", "value": "384:WQZAVb1GNjJITo4CGzPd6ZIwVKb5CzgObff9kC+xbX7zL0crX:WTINqTo4FL3CBn9kC+xbLHjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647532836, "uuid": "bf935190-08bc-47b0-abd5-61a5315dded0", "value": 21461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647532836, "uuid": "f28d6d31-bac8-438b-ab5b-800eb86184e7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532836, "uuid": "609b823c-a2c8-4f60-94e4-f1d0b70ce88a", "value": "N.254 DXU 17.03.2022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de82f719-a628-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1647545500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545500, "uuid": "6f564b3f-65bf-4f3f-a233-1a956d26c774", "comment": "Malware payload (ArkeiStealer)", "value": "5aefee6589b3b44b761b4b7628bb5663", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545500, "uuid": "935231ff-cf13-47b5-9324-e8b8fc95c79d", "comment": "Malware payload (ArkeiStealer)", "value": "646ba90ef3bc19841913544efa1ec3dbf9766e03554eb9f5fb7542e497e7ca70", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545500, "uuid": "f71af393-0754-4dfc-a6db-d7c24a86d6b3", "comment": "Malware payload (ArkeiStealer)", "value": "ca2d4e2b2346852c3031416921ac436c2f6ed368", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545500, "uuid": "40b09a83-521d-40ad-857d-634633abdb71", "comment": "Malware payload (ArkeiStealer)", "value": "135d8ba94b4b62c7851e350490eadf2bd7c4e9af34dfa3f43b45a455a70e8c1cce5d843f590a3a0318efc622b9dc244c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545500, "uuid": "1921026b-e827-46e9-9b9c-02e390ba7b66", "value": "T1B8E402227A52C937E3760E309825C7B4863FBC711A215197FB857B5F1E323A29E66343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545500, "uuid": "1fdf0dc4-2136-4b8f-b901-4ad31256d364", "value": "2f5d1db7984b20617136f1fc1ee9f46f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545500, "uuid": "82dfd774-3a41-4929-9f77-3220573153ed", "value": "6144:KlObwHptAqC7aSXuJFrKdKIRLaMT6oaGm9jpzytYrOqqxPoLbY43JKnVf2cATYCg:ibHSvkMmocbykqWbYmJ+Jjq8+vLfN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647545500, "uuid": "edc0f2b1-813b-477b-86a9-d803fcb0ae50", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647545500, "uuid": "65508cf3-cbfb-4853-9a5e-ac11544bd8c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545500, "uuid": "0480cb16-42c4-490e-b0c3-2b911e7cc1a5", "value": "13557107.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad586d0-a60a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647532528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532528, "uuid": "1cb6967d-682d-4180-8e5e-56cccb16bcbe", "comment": "Malware payload (Heodo)", "value": "db03380035c919de1da5780726075169", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532528, "uuid": "6ec08556-1625-43f2-a683-cdb066421087", "comment": "Malware payload (Heodo)", "value": "65cf27cae88a4d60c232b2ce07d8599fec49cda44eef5e93377e72ad45fb5766", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532528, "uuid": "54bf8837-5182-4fc0-8064-bcd03489ee0c", "comment": "Malware payload (Heodo)", "value": "5502c1d131eacc97bc3a5c5bd7ff21aebb4dc53b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532528, "uuid": "8cb1cd92-3667-4779-aede-b7c7a030d187", "comment": "Malware payload (Heodo)", "value": "106f5aa70ef8cb4932043c59e3ee34c54bd1107eb78949b5fa76644d6cdaaac70d2d10f914685eba0cb7e70a7b5edd49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532528, "uuid": "607cf43d-0f57-4b33-af6c-577e8e97e854", "value": "T18B059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532528, "uuid": "257edaeb-a499-4bc6-b637-1c672f1d19a0", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532528, "uuid": "582f16d4-77b4-410a-8ff4-7c24d568739d", "value": "12288:KVHML2QJe6XxhqCWhQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqZQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647532528, "uuid": "044189df-3ebb-4540-b4a4-d70473ccb362", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647532528, "uuid": "f49c8186-5134-42c3-9973-f95ccd3de914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532528, "uuid": "353d8be8-fcee-4eda-aac4-d9ecf8e48912", "value": "db03380035c919de1da5780726075169", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e734cea-a5eb-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1647519139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519139, "uuid": "4d32fb09-fc71-4fb7-b725-ceb24da949df", "comment": "Malware payload (Gozi)", "value": "671da918751383986a15d19be9ada7c0", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519139, "uuid": "85764210-4979-46ee-b1f8-40b987a9b035", "comment": "Malware payload (Gozi)", "value": "6714c68120dcc163342da7e1d753b37d89e7bd790a79212a7b2efe1bcc9dd571", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519139, "uuid": "c2e3e36a-feaf-43ce-8174-5dc7e7ed438e", "comment": "Malware payload (Gozi)", "value": "b330216625b5cb05ca5f4decfbff5db1d915dc5b", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519139, "uuid": "222c1bed-6f15-43b0-8865-9be29cd9f3eb", "comment": "Malware payload (Gozi)", "value": "766d4241b27af8d242277e4f268656956cf71a6fa703c5b2a38e78eac757716ae8ac0045def7269081b6ec56be8c01d4", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519139, "uuid": "cafc9a88-e6af-458f-be94-9c24e46e7eec", "value": "T122917B69034FCAFDA7537DC885C95583EBA94227462CD6C4CFB0BDFA3400078E4E1588", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519139, "uuid": "7158a521-289e-4144-bec2-3939ffed8051", "value": "96:edRGYCeTATVYZ2ncestMHf/dGkmZ3Y/n+NGSuJFKunglFEu8gN:ORPTgvkM//dGkm9un+ojJFbnej8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647519139, "uuid": "2bcb8e0c-2a30-40cf-9c04-09c1c032cc21", "value": 4285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647519139, "uuid": "f83cb6f9-94e4-4763-9d33-9ce594ba2bbb", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519139, "uuid": "5e36a180-c79f-4b76-b67d-ca38eb65560b", "value": "mise_169.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a61066d-a626-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647544285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544285, "uuid": "86b97a82-4d73-4164-b775-c8ebe58b186c", "comment": "Malware payload", "value": "5121b74e31607e31270c1f0933dc6b9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544285, "uuid": "fe012c0f-28fc-42b2-ae01-21e1a2eb091a", "comment": "Malware payload", "value": "683c62d4c5badf77eb3f548042e6a129a1b5673e53a4d4c60792eeb2864b6ce7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544285, "uuid": "9388aba1-a781-4ec6-991d-091778fbbe42", "comment": "Malware payload", "value": "7d588946d89e91386d6f3ea5104d6a76a663d814", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544285, "uuid": "04199449-6104-41d3-af0d-b1ca1051e3ef", "comment": "Malware payload", "value": "e8450211f4155e58c7f78581ba239c096f3a7b68704c803a9b6d37c4b6d9732848feca418d57a9308d623d515ec5eed8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544285, "uuid": "26c728be-edca-4cb7-be12-e4c747491566", "value": "T153058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544285, "uuid": "72966ded-ebb8-47ee-8671-dbb53e138e83", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544285, "uuid": "d2dc2888-44d8-4ddf-a4f4-7351a9bc4b31", "value": "12288:Wvz1CLJyyvmMLSrBgr4ruGbPlVpqb+DlYzv:WJCLJyybLqBO4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647544285, "uuid": "be11eb60-346b-40fb-954a-c4325ceabf50", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647544285, "uuid": "018e0534-ced7-4e74-9e80-47cd081ddaa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544285, "uuid": "14260a08-cd1a-40f7-bd98-dfbadcb63cb3", "value": "5121b74e31607e31270c1f0933dc6b9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82165979-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "fd31a89c-7a81-4701-b4ab-7e3885bf051e", "comment": "Malware payload", "value": "35c7c30a0d63516f1fd805a7135bae26", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "4bf2a654-b2dd-4a4b-8b5a-47401c594d16", "comment": "Malware payload", "value": "68869cfea77cadb7e5795bd4ec8dba6db7ece2fac6604bf56521a62e468b6ba5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "55d5342f-12bd-47e1-8e9a-ce9b15dc934b", "comment": "Malware payload", "value": "b98d4458ba9875179c449df860eb8c933f180524", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "e369c91b-4211-45f2-ac15-02b6fc3d2a02", "comment": "Malware payload", "value": "eecd5c33b9075de29cbc782ac57cca9a228d59e4d0f737a5bf77d4b29f0530efccf985bbd415c1b493d51d521da55c2a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "14d179cd-25ba-452b-b7a9-f3d46c58821c", "value": "T11E059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "b2d2f04a-9097-4cdb-ad54-5e8c13ddfd98", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "3988286c-b6e1-4331-9fe2-f337feb05f1f", "value": "12288:V20BXOMcVzpWfmmnDDTX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDXX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553505, "uuid": "d9769ded-95c4-4be0-9103-0a0fc8e495b5", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553505, "uuid": "04c8b0ca-4ed0-40bf-8fc8-c04eee53f52c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "f7e610ea-e7e4-4ce9-8bd2-65e383dc70c2", "value": "emotet_exe_e5_68869cfea77cadb7e5795bd4ec8dba6db7ece2fac6604bf56521a62e468b6ba5_2022-03-17__214457.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7880bf25-a5df-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513975, "uuid": "e772bb56-e23a-44b1-82ae-8d3564293ed2", "comment": "Malware payload (Heodo)", "value": "9756375ebb149f1cce8339e09ec0f8c6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513975, "uuid": "4ba6cba2-659d-4b25-8e6c-084741d1d331", "comment": "Malware payload (Heodo)", "value": "689c567ffa588d329569818dd7237cc210b90f173e17d51e84c7fccb488dc08a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513975, "uuid": "d3a91dc9-9ab4-4d0c-94d2-685a2e0eeaae", "comment": "Malware payload (Heodo)", "value": "8043e98638b77703aceac39a18344ad77e7127a6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513975, "uuid": "5c2e089e-8f44-4937-b91e-813f2fc49038", "comment": "Malware payload (Heodo)", "value": "a10fb2a09e424814093544c730908fc21ffea169e62e1ba56346b2b77a97bf623d2884573ea4d981a6f3e6e982763101", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513975, "uuid": "32916869-2ce4-4c2a-9640-90d7650dc9bd", "value": "T1C8058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513975, "uuid": "46f76222-6497-42da-b950-79d6d4d56b26", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513975, "uuid": "6d368473-9aca-44f7-9bef-7e6f01d71553", "value": "12288:Wvz1CLJyyvmMLSrBg74ruGbPlVpqb+DlYzv:WJCLJyybLqB24ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513975, "uuid": "071e4cdf-1170-4dd0-a460-7a9aea788216", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513975, "uuid": "37b86b3f-626e-4e98-b29e-56454b2f57c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513975, "uuid": "4579ee4f-0038-456b-84cf-07c5b978d343", "value": "emotet_exe_e5_689c567ffa588d329569818dd7237cc210b90f173e17d51e84c7fccb488dc08a_2022-03-17__104610.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cfd5129-a64e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647561577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561577, "uuid": "9a73a923-e3fd-4a9d-b1f4-886143fd0823", "comment": "Malware payload", "value": "de2c3c4b405cbdbccf0b6b0113757de1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561577, "uuid": "2ec45235-a9b5-4590-affb-14946b0f93ec", "comment": "Malware payload", "value": "6991991410767ade887b4eefdc703862e5ff052cbb3ebc89d66146d279267f24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561577, "uuid": "1134d1ec-3891-4c21-ad53-32172f58176c", "comment": "Malware payload", "value": "4649e55c5892e673aedbde358f9f80b12f7cd97d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561577, "uuid": "8da804da-2b9b-477f-8dec-a544a4a6a92d", "comment": "Malware payload", "value": "936080060c70c7a90e3cbee40cf71fd1b77e301802fbc0ac2c534f75aa8bbd58950afc06f6fdeb81d45f021b529fac70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561577, "uuid": "afca2f8c-3c3a-4136-955b-85b657729772", "value": "T1EB059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561577, "uuid": "eb9651a9-492d-4037-bdec-ce4fbdd33c9e", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561577, "uuid": "982ee7d3-ad1e-4a08-a929-74b324860816", "value": "12288:V20BXOMcVzpWfmmnDD6X5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDmX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647561577, "uuid": "a9d7f950-b05e-403b-8ce3-fcc0a789d3a4", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647561577, "uuid": "1405c0b4-11dc-4ebe-bcfd-850a17a4009c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561577, "uuid": "c9ee3bdf-e898-448d-a8bd-d519bb776c88", "value": "de2c3c4b405cbdbccf0b6b0113757de1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25dbc0a8-a626-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647544331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544331, "uuid": "718b8846-34ee-499a-9cc6-e6a13f58ecac", "comment": "Malware payload", "value": "433614b2c23c89c976676b9c7bb15622", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544331, "uuid": "6a26714a-2237-4f39-a68f-809997eaa4bb", "comment": "Malware payload", "value": "69adc0c0c43b035ec488daf413c965583cee3db4e62dd55d8c5412f98fc066b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544331, "uuid": "ec4ee6da-0de8-4f06-aa64-8f3b0f0a1399", "comment": "Malware payload", "value": "6bf9db7050df03f888a366b3912be243900e1cf3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544331, "uuid": "0a1912e3-ef8e-4859-821a-c615454442f1", "comment": "Malware payload", "value": "580ed2ae1dd609721195b3df50b9c09d3f18ab6811e8642d0d50bff5236ef155a3e6c31e9e3769abab27b051a67a9c20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544331, "uuid": "45862a59-52b3-4611-b190-d34d8d751ed8", "value": "T10AC42B017896603CDFDA363601F7EB2531E75CB0677CB52E6EC168EC9B2628A051D63E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544331, "uuid": "f7722df0-7c91-491d-ae11-77c2b6f21bfb", "value": "fe91b35dbbcef6d3f3836ad3e8b836df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544331, "uuid": "1649ff6a-17f3-44c0-8f17-e087a8c6cc69", "value": "6144:xe4HnxyzcUzcUin5jBd4hp3CBj6O7O7OOuw/RRRI7E7E7E7Z94kx8888rLCkxEZ5:56Kv+tEgqzdov6eimJEeTN+sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647544331, "uuid": "26350f28-cc13-4d6f-8611-885156ace500", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647544331, "uuid": "16220a78-3ea7-4e7b-870e-955f6c8b1102", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544331, "uuid": "8b31b8b1-2aff-4c56-aa5c-2405450c4424", "value": "433614b2c23c89c976676b9c7bb15622", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbdf49a6-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647518920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518920, "uuid": "7a3906fd-3ddb-4eb0-89ed-4b59d4602694", "comment": "Malware payload (Formbook)", "value": "4ba27d867353ac0c936a9079bc92ddb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518920, "uuid": "93abe339-954d-4166-b3fd-b8e2a830b6ba", "comment": "Malware payload (Formbook)", "value": "6ad7f99fc894da684e1ca13e427c11d5f3656e4687cf1c9a9748196463913826", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518920, "uuid": "3a5a8866-5881-4483-9bf2-8407e6aca11a", "comment": "Malware payload (Formbook)", "value": "cceb49c7976c6e2809a2fa5ca686a44d0be9da2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518920, "uuid": "25c7b4b7-029c-4a09-9242-84c762d37039", "comment": "Malware payload (Formbook)", "value": "902e42d44d3e6c016f841d1e36be5d1cfaf03c49b2e157e29b777b60ac8962fd43dff20c39d0faf3a67a4609c28c723b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518920, "uuid": "03ee2ae6-ec88-464f-8964-65e1c0de46f7", "value": "T1DD355BF2E2508832D02236784D5F5EB9B42A7D01EDE5A546BAE03F0D3F3D5B1EC21A56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518920, "uuid": "1f21fb2b-d2ad-4d27-9d4f-36e29fb21b22", "value": "066f2adf6884c84166ea572f3442e2f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518920, "uuid": "886de870-e33e-494a-9227-69833b06ba91", "value": "12288:RbojJKNbgMwT2NRAvS/yqenMbJjRsBp8oziAO8Iz2sVW3MFqI6F3HAhcAszeVQ18:elKiCRAvS6qOMZGBNgzvqTHAhU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518920, "uuid": "38579150-84cb-4247-9884-ff3a10a62b25", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518920, "uuid": "33e2980a-cdbd-4fcc-a4ea-ca1bcd7dc4c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518920, "uuid": "af3507cb-5643-4e6d-8e6b-27ef41d5df2b", "value": "UPS SHIPMENT CONFIRMATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4085c7b-a5d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647510693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510693, "uuid": "210938a3-d265-4fef-b3d7-86426fcab82e", "comment": "Malware payload (Heodo)", "value": "88e6dde5e03da6a889feae1525551ab2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510693, "uuid": "ccfdf788-40ae-4466-adba-72ba08fd0eaf", "comment": "Malware payload (Heodo)", "value": "6adf75ae4502208cb1d295a95bc3f7263b14a2568c0108554e7ea30cec2fa1c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510693, "uuid": "14e06aef-a08b-4200-b828-19df872d0323", "comment": "Malware payload (Heodo)", "value": "7fea33a150140c9d2c98eed11b553a2c6d120c14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510693, "uuid": "658a7455-a199-463e-8f30-9d70223065cb", "comment": "Malware payload (Heodo)", "value": "9faac31fa37906dc1700104e10c71ff8b88f407bfd7c2730b849072fbb8e98790102af271fb5736f8cc2b838fc72d0c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510693, "uuid": "5e39deb1-5851-4094-97c2-0dc1301a27d7", "value": "T134059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510693, "uuid": "1861c57e-34e7-4072-b799-e0e4703e6360", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510693, "uuid": "7dfe38d3-eef5-4245-9b11-c563ff584409", "value": "12288:KVHML2QJe6XxhqCWzQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqLQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647510693, "uuid": "2f65ff16-ce41-46b5-8240-d3423cc153ad", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647510693, "uuid": "f20388d7-03b2-4d37-a336-7ccb34d8ed86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510693, "uuid": "db89d60a-99b1-4140-8b3e-83288f40676c", "value": "88e6dde5e03da6a889feae1525551ab2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0810f148-a5c1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647500902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647500902, "uuid": "682956f5-854d-4a23-b593-fe87b9ae88de", "comment": "Malware payload (Heodo)", "value": "02758ec54b57f9d5dc1aa99cc979d70d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647500902, "uuid": "e4a4cff7-b2f9-40d0-a135-7b07d7d8d6b6", "comment": "Malware payload (Heodo)", "value": "6aff08ea23ead4d7cba6da50317d42ab2649a89e6cba61cfdc07d8d9f9d9faf6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647500902, "uuid": "305520f4-4457-4dc3-9a6f-01b26c1d220a", "comment": "Malware payload (Heodo)", "value": "82e9927b7181165362538fba0f3170e29cc736fd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647500902, "uuid": "a5384a67-00ce-4017-996b-f68a60ee75d6", "comment": "Malware payload (Heodo)", "value": "ed6982fc48c557d0086e6bc90d7feb9a3fe6cb39a34841433c90c3ff232e5bda058c93573462c4e62434e21e650e0401", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647500902, "uuid": "8c9170d1-3f7c-4eb4-8344-85ac50a2d4ab", "value": "T1EFA29E2CE921744DE3BB683C420650FA924A1C022147B5ED3991F77D6B73697068FEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647500902, "uuid": "0a85a1f4-5c6d-4f95-841b-efc44df58838", "value": "384:T3uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:3sNs/zXtFCBn9kC+xbL42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647500902, "uuid": "d345743f-e323-4b58-8ebf-2952514b0e8b", "value": 21657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647500902, "uuid": "e103c849-1d50-477f-bfc2-07ca6b00d70c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647500902, "uuid": "eb53c84a-33c1-4ab3-8ba7-3afba402e380", "value": "Rech 2022.17.03_0800.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f272dd63-a617-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647538232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538232, "uuid": "9ff78588-3ea0-4a16-8a58-826ad4545b6c", "comment": "Malware payload (Mirai)", "value": "c6c7b2b9cb832d492d2a03b02a7710ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538232, "uuid": "7454d6a8-061d-4b0c-9f33-50a49cfc1904", "comment": "Malware payload (Mirai)", "value": "6b1304319f33f47837e6a9c8eeb56008014b4fac0d9d8fe7ef12d9c8e6138e45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538232, "uuid": "90bba338-3169-45f7-86d8-f6788264be94", "comment": "Malware payload (Mirai)", "value": "487abc27bef03c375af03877e91050916c781f6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538232, "uuid": "b06ac2ff-7357-4d5e-b2b2-a85b5e5da733", "comment": "Malware payload (Mirai)", "value": "38cbc756715abe4ceaea88e31e45d93e6bfe6b5d3583fafb0af911efe71153ab3737a3adee1ecf3a51b847a62929d10c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538232, "uuid": "156c8600-437a-4211-ae74-18847c46bb76", "value": "T15AC2C0B12741D4AAF861C1FB43E943D21E361E79E0638C5B2AA1E5F59D034A434ABFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538232, "uuid": "b5ad640f-da4d-4ce4-98ef-123e5c31d0e8", "value": "768:8bExE+caukqMsw11zSBlGNQOzUUp/wdR+UrPwojhkJgGlzDpUYsQ:OkE+R1zmOzUUp/wdRnrooGVqYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647538232, "uuid": "48082617-f332-46dc-8353-467c3cc74156", "value": 27452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647538232, "uuid": "2ba0ff94-23b6-4e30-86e4-31ad0c0155fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538232, "uuid": "30eaa9a3-7aa3-42ca-898f-dc915a09d6ff", "value": "c6c7b2b9cb832d492d2a03b02a7710ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b2514c-a58c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647478165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647478165, "uuid": "ab068a5c-80ca-43f2-8ea4-297e04459d0b", "comment": "Malware payload (Heodo)", "value": "3d6fe76df25103001917e6cc69839c57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647478165, "uuid": "4bede5e8-4841-47aa-b4f5-41cbec356125", "comment": "Malware payload (Heodo)", "value": "6b4b6cf5625f228b3a8220d8f9e0906b4a028392e31f8450ed96f91d6eb6fea7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647478165, "uuid": "2377e7e9-934b-4f5a-8f98-05675282cccb", "comment": "Malware payload (Heodo)", "value": "877b9e64743a7bf7b17b9488491ee85ede5a575d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647478165, "uuid": "fb24dcb5-f876-40ca-b81c-50d3e06e24b2", "comment": "Malware payload (Heodo)", "value": "0898efaeea2a081071939221593a3481f65e5e192b1edbd8014821ec7d789dcd7e83eb106b2f7188cbf13813776c13bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647478165, "uuid": "cbd9a5d9-f28b-4934-b800-b18476f826c0", "value": "T195F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647478165, "uuid": "b14eb334-df7e-4947-b9d3-4dd04220a6ed", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647478165, "uuid": "032902e6-8368-46f0-bc2c-02c9bb0f042d", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPDXvkgKtuBdfMAofD:WCBAdKV9Xf0kc3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647478165, "uuid": "123313fc-d5a1-4811-ae71-255aaa0f01e2", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647478165, "uuid": "96fc028f-4fb3-4baf-9232-f1fef3ee2cb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647478165, "uuid": "fd7ee54a-b4fd-47cd-9e61-204827af2f36", "value": "3d6fe76df25103001917e6cc69839c57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64d63cc-a5e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518455, "uuid": "701b1769-292c-4092-b63a-d237b682f905", "comment": "Malware payload (Quakbot)", "value": "4da6cc4dfd2e558a0ef8f22e79746a52", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518455, "uuid": "251ed04e-4cae-43c5-ab0a-383e69c5b2af", "comment": "Malware payload (Quakbot)", "value": "6be62273420e620d1f8f504de7386e659ce85e5b23ff8d6bbff39294040ecc2c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518455, "uuid": "8ec114b4-679c-4616-baf8-a8b213455fb7", "comment": "Malware payload (Quakbot)", "value": "7c7d81ddcdfdbc854802029599a082762197a214", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518455, "uuid": "cf994cb7-b8e7-4194-8f83-746dcd77be44", "comment": "Malware payload (Quakbot)", "value": "23139bbd6766104151734afe189ae224a881e4c4c5d444d87fe241dacff7b344bf72b92b9c660fdb51116036a55ccb98", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518455, "uuid": "f030439e-f8f3-4ebc-a2af-78a4c1b740e1", "value": "T13C15BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518455, "uuid": "bc137c38-89fe-4b2a-ba40-ed5817153698", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518455, "uuid": "f0a24c67-723e-40ee-a51b-2bf10b21fe15", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518455, "uuid": "f5b017ea-8477-4c9a-9748-a2fbc4a41277", "value": 961862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518455, "uuid": "350bb511-37a1-4da7-bb5f-369335a03af4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518455, "uuid": "564ed020-b53a-4704-bc3e-911f76526ee1", "value": "6be62273420e620d1f8f504de7386e659ce85e5b23ff8d6bbff39294040ecc2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3291a48-a603-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647529509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529509, "uuid": "5de61591-c586-4e21-be2c-c15c977094ed", "comment": "Malware payload (Heodo)", "value": "e7f8cef91cac8ace61925b138c1b2e39", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529509, "uuid": "f7f298e3-0cd5-488d-96fd-3a0e2f6c1986", "comment": "Malware payload (Heodo)", "value": "6cd0fc47cc24f176d5cfa4e7e90cf4c0726050a68a089432ed884e1ba5768e75", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529509, "uuid": "87e09c6b-79fa-4b54-ba65-197a47ad8ab9", "comment": "Malware payload (Heodo)", "value": "9c76b81d0fc7c18dd47649418cd2d2bbb31fbc2d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529509, "uuid": "4968732f-a591-4541-831e-6c0db72ff7a5", "comment": "Malware payload (Heodo)", "value": "fa9a54fbf6d49befe85f4a4cd7239792bab411993a16f55b6a719fcd538a03066f18d4b6a497392dffd0661a3c0208e5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529509, "uuid": "aee41de7-0c45-41c0-8d88-389955cb67d9", "value": "T10FA2AF3ED221E818D67B987C830580F6E70B2C561007A9ED2D51F25D66726F7138FABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529509, "uuid": "4fe12b95-d367-482c-a71b-df62ba6e6280", "value": "384:GQZAVb1GNjJITo4CGzPd6ZIwVKb5CzgObff9kC+xbX7zL0crX:GTINqTo4FL3CBn9kC+xbLHjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647529509, "uuid": "78c41828-6d43-42fa-a0e8-8ed8910bf88f", "value": 21461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647529509, "uuid": "e976e8ac-d2a5-458c-8901-40b5482898df", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529509, "uuid": "5c561b7b-c078-402b-a8f7-eebc596a6755", "value": "N.921 EDO 17.03.2022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6abc44-a60b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647533041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533041, "uuid": "39186655-6254-4f69-9117-4eaa795bbb26", "comment": "Malware payload (Heodo)", "value": "6718ce702c99fb49c186d14299438dcb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533041, "uuid": "75c6fb67-f975-4f6a-b27d-26a264380972", "comment": "Malware payload (Heodo)", "value": "6ce156ac1310ad2d280ecdd53ba5d00bc43102373ebc02bdd08c419f1913a071", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533041, "uuid": "562776ca-6964-4c23-8a71-d043e30bff0e", "comment": "Malware payload (Heodo)", "value": "4ee893d2998b99acf27c5b77cb72f47686a3014c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533041, "uuid": "8332f73a-88a0-46a0-93be-5c186bdae6b4", "comment": "Malware payload (Heodo)", "value": "b2ccb867f7212d612747898dd4303c0975ae052033cf39ec458be832f75f198d500c707ff2dee0b8df7d505d0430a8d2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533041, "uuid": "2bc98792-ae0b-4835-b475-0464caf9e6cf", "value": "T1CAA2AF3ED221E818D67B987C830580F6E70B2C561007A9ED2D51F25D66726F7138FABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533041, "uuid": "a1159c56-05dc-4dfb-b7a2-39d9184da015", "value": "384:WQZAVb1GNjJITo4CGzPd6ZIwVKb5CzgObff9kC+xbX7zL0crX:WTINqTo4FL3CBn9kC+xbLHjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647533041, "uuid": "a8f96692-b875-4d99-83fa-e54d188c8771", "value": 21461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647533041, "uuid": "9be3cf07-07d0-4d0d-b039-37e036380328", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533041, "uuid": "e74385ec-6d1f-4439-b182-aa725bca9884", "value": "gescanntes-Dokument.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f175f9-a5f1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647521563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521563, "uuid": "8d46155d-b93c-4d9a-9f51-63dbf8cc627d", "comment": "Malware payload (Heodo)", "value": "c3fc10498e699546ac977afc15f89dd5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521563, "uuid": "f38ad835-188a-4206-b030-6ea133fb1116", "comment": "Malware payload (Heodo)", "value": "6d76c4679688d1ded568a15127d3cdf3a6e8d557e0fc853a7476465d102373a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521563, "uuid": "6bc35cae-8486-473b-871f-0d7811c5e232", "comment": "Malware payload (Heodo)", "value": "09da85e69c0e0ab12572ab3981b8cc9931222151", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521563, "uuid": "191ade00-026d-43c0-9d0d-bf00204fd2d8", "comment": "Malware payload (Heodo)", "value": "7b8467a6c1dc81e05de0104897644ecc6a90cc5adbefac25dc32146397002bb4781ba2456a5c936a1aa33bec24b57fba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521563, "uuid": "dbfa9142-c080-4b23-8d8a-25a33a3199ab", "value": "T128058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521563, "uuid": "ffa68746-c097-4695-9a7d-a140413bd974", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521563, "uuid": "818720f2-d43d-4780-928b-ebb7c9382819", "value": "12288:Wvz1CLJyyvmMLSrBga4ruGbPlVpqb+DlYzv:WJCLJyybLqBr4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647521563, "uuid": "6167d11c-cb26-4b1e-9bf4-d5010ceb81ed", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647521563, "uuid": "be933d54-eb36-422c-bf60-561f36080fef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521563, "uuid": "27a130b2-b0ec-4253-b6f8-6331f0d18277", "value": "c3fc10498e699546ac977afc15f89dd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f0bab5-a62c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647546908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647546908, "uuid": "3df76125-cfd5-4a4b-870d-e055bfe6494c", "comment": "Malware payload", "value": "de085869bb164eb72f8e08aaae7fc2c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647546908, "uuid": "409e7fa8-d04b-4eb0-9612-aeb527d4b9e1", "comment": "Malware payload", "value": "6d9e5c0371c0c2493a0807d827304899bcde9cb41d667a1d6f6494c8e02f011a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647546908, "uuid": "faedc8b0-684d-4e84-a91e-d2276de142a3", "comment": "Malware payload", "value": "80b361d5720895f2afd3b683b9fc314a3f3d6c55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647546908, "uuid": "0b7f8d97-dba6-4c37-8b5e-72ae147febd4", "comment": "Malware payload", "value": "a677fd88890d0229e62cbf62a86f1947be9e172501f2e192053099cbb08e5c27000acb16b6e98ea549f62d2f5f82797b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647546908, "uuid": "b1c3e213-fde2-46ac-9f4d-9251dfad08c1", "value": "T17AC42B017896603CDFDA363601F7EB2531E75CB0677CB52E6EC168EC9B2628A051D63E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647546908, "uuid": "ca04af98-73e6-4783-8681-3d7d4e5b94ce", "value": "fe91b35dbbcef6d3f3836ad3e8b836df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647546908, "uuid": "22327f33-677e-466f-a1c6-94895bd6b550", "value": "6144:xe4HnxyzcUzcUin5jBd4hp3CBj6O7O7OOuw/RRRI7E7E7E7Z94kx8888rLCkxEZh:56Kv+tEgqPdov6eimJEeTN+sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647546908, "uuid": "16181833-b484-4468-b0da-4ef5859aed30", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647546908, "uuid": "0c72c74f-e8fa-4bb7-ac44-28fb4dffeb8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647546908, "uuid": "90a29955-a29f-4b39-a070-5e3c216aacc3", "value": "de085869bb164eb72f8e08aaae7fc2c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c171aedd-a5c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647503790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503790, "uuid": "36cdfcf9-1668-4d4c-b7f9-c40de16722d9", "comment": "Malware payload (Heodo)", "value": "2f6f787cfcbd97b713f5dbc4a45ed112", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503790, "uuid": "bbe32407-5c4c-437b-a278-0ff3d55df030", "comment": "Malware payload (Heodo)", "value": "6df68dbeac32b06d0df9aebf4840803325e855d11b9d3eb26f028149a51bd944", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503790, "uuid": "da19d2aa-f895-40a0-a696-a705aa06ca3b", "comment": "Malware payload (Heodo)", "value": "7ff6003265b0d8dade79e7e37d0f862ec1791ae0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503790, "uuid": "e00cbef9-8b23-43de-8941-8f0e6af1b46e", "comment": "Malware payload (Heodo)", "value": "0a3a93d5d0dcc292c0627785a8a3b4346e1829be89519f27cd1de83b76ff188499ff7e8a27e637b92de6ddf3a6d45ec1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647503790, "uuid": "7acbb3aa-08d5-4b7f-95ad-bb26bfad2040", "value": "T163A29E2CE921744DE3BB683C420650FA924A1C022147B5ED3991F77D6B73697068FEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647503790, "uuid": "1e7b4b3c-7196-4f2e-8733-7df371dea1c7", "value": "384:n3uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:7sNs/zXtFCBn9kC+xbL42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647503790, "uuid": "ef705fed-6dd0-4fcc-a382-6ca9e6f8777a", "value": 21657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647503790, "uuid": "43b35717-9e40-4147-8783-8c9a146c1a7c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647503790, "uuid": "4d5a2f85-2853-4689-b8b8-8bfdc4591fa1", "value": "RP8469313740431135892.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827513a2-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553506, "uuid": "68033994-8ae4-4b57-b864-5d11422e7403", "comment": "Malware payload", "value": "cf62f400c4597ec73fd0fb6da4b83b51", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553506, "uuid": "401df99d-54ce-4359-b4ce-d0257b53b9b4", "comment": "Malware payload", "value": "6f55e59d4d7924d2758874d2d9f689d5a136755d0aee5dc305e81b3d715fcf14", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553506, "uuid": "08206655-b68f-4a58-b287-0734eed3418d", "comment": "Malware payload", "value": "e0b16080fb6115b2ad45a11919ecfaba0e0298d5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553506, "uuid": "5fefd01e-407e-4ca4-965a-509aba5fc02a", "comment": "Malware payload", "value": "38266b804d3a7aa85959e2ef95d46feb0ad5fef1f7d3d1faaf509e0b5f711d85a8aaa5191831e4291920e0ead8ea5fa1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553506, "uuid": "6660df50-c10b-4a2f-97a3-9f6323e99566", "value": "T1CC059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553506, "uuid": "cb3d49bb-1373-4425-9d14-d5a117dac883", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553506, "uuid": "ac0db30e-9675-443c-acd0-347eb9cb0bd8", "value": "12288:V20BXOMcVzpWfmmnDDkX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDYX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553506, "uuid": "7040380f-200a-49a3-9637-4ddbb8d34f76", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553506, "uuid": "0a0147f2-0e34-42bc-b261-663d002dbcbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553506, "uuid": "3768afca-bef2-40bf-bbff-3b19c0f78c57", "value": "emotet_exe_e5_6f55e59d4d7924d2758874d2d9f689d5a136755d0aee5dc305e81b3d715fcf14_2022-03-17__214458.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0943f7-a632-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647549708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549708, "uuid": "c04fa387-b01f-4028-bec3-bbfdacf7bca2", "comment": "Malware payload", "value": "6e769da49f990798d7e0b679bd82fa45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549708, "uuid": "2ff409b9-3c0d-4a0f-8626-62ed9a7d923c", "comment": "Malware payload", "value": "6f604a564722e787f32b390f3b079536d98c8787e62c83afa8f7dcfd55b03b33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549708, "uuid": "2d88ccda-727c-439d-abc0-588810efc2b9", "comment": "Malware payload", "value": "e0bf3a10dc0414708f1b99ac06992f25bf18b91c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549708, "uuid": "8b3fe31a-31b9-441c-9af0-d7926d3a351a", "comment": "Malware payload", "value": "729e76be762d77c8110c6a3208d1d8955bf040e1ecc01ee4fd1f0db527b3aa6c8973b6727a785067cfe120e08b579ea5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549708, "uuid": "a5af2f72-838c-4cf7-883e-4a467ceb063a", "value": "T10FC42B017896603CDFDA363601F7EB2531E75CB0677CB52E6EC168EC9B2628A051D63E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549708, "uuid": "ea252bea-25b8-4113-97a9-c947a7cbb953", "value": "fe91b35dbbcef6d3f3836ad3e8b836df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549708, "uuid": "7abc0edc-eba9-41a2-973e-63fbf083e640", "value": "6144:xe4HnxyzcUzcUin5jBd4hp3CBj6O7O7OOuw/RRRI7E7E7E7Z94kx8888rLCkxEZ2:56Kv+tEgq4dov6eimJEeTN+sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647549708, "uuid": "4b6b25c7-a6fa-4ba7-925d-7e06452de1ce", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647549708, "uuid": "3c98257a-a70c-4450-8fa2-45a93df18ae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549708, "uuid": "9f0009e9-f901-4978-ae48-2af34302491b", "value": "6e769da49f990798d7e0b679bd82fa45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db0485f-a61e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647541069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541069, "uuid": "70a4d535-9a71-40d4-90ba-837537679e01", "comment": "Malware payload", "value": "0c463b35a0c3ca6112f76309820321fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541069, "uuid": "ec6dda57-aff0-409c-a162-42351d28de5f", "comment": "Malware payload", "value": "6fa4d4b94094da2fb400be4f5fb106b9fece7b4a9dc434b4d8ba7283a01225b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541069, "uuid": "42e0a7a4-45ac-4f39-9c3c-f63d1f4e4d66", "comment": "Malware payload", "value": "317fa187045e205c33754d9dad0b1ac264bbf3cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541069, "uuid": "77b2ab3a-e9de-4581-ad08-e7fe89488959", "comment": "Malware payload", "value": "c8daaff31e679e4d1280eaacb1a5132962902b4c9c5af7b3d9314acda818b4e388b86275ec56aee02c5568326acb47fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541069, "uuid": "d3f35624-f698-44bf-90da-2757a672f2f5", "value": "T15D058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541069, "uuid": "a19948f4-04d6-46da-8d6b-8116d77cf595", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541069, "uuid": "7f59a4be-ae39-4ba3-998e-807bf70b1140", "value": "12288:Wvz1CLJyyvmMLSrBgb4ruGbPlVpqb+DlYzv:WJCLJyybLqBi4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647541069, "uuid": "11bdac5c-3ab2-49f8-bb10-d537cf7b10db", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647541069, "uuid": "63585cf0-d57b-49dc-b251-fa6cb387e911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541069, "uuid": "574f1563-b4f3-493f-a56a-ecfe7e98b840", "value": "0c463b35a0c3ca6112f76309820321fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e847dca-a586-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647475626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475626, "uuid": "56713fa5-e7fc-4005-9d09-89cb3c76cda4", "comment": "Malware payload (Heodo)", "value": "9641193079792268a929f9c95d2144f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475626, "uuid": "39e40f89-0b43-45dd-8a8b-7fb5447b172b", "comment": "Malware payload (Heodo)", "value": "6fd92ec639472fa7c93bea29ca73e86939762b1892f6560c0f892febc1a84590", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475626, "uuid": "1f75d7c2-74df-48f2-a3b7-168b7a40b2f5", "comment": "Malware payload (Heodo)", "value": "875edbf80e08abfa788a66ae11524d28299120f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475626, "uuid": "82c8591a-101c-4131-a3c1-e40e554f286d", "comment": "Malware payload (Heodo)", "value": "a9285ab48dc6f04860d02812fc919a41bf972b49c380324ae6b5c33e811aec6acffa8b5918e6d51f82d366777346d568", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475626, "uuid": "23786dbc-f16b-4de1-aa70-87be566d5153", "value": "T12DF4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475626, "uuid": "886b9afa-7aee-4775-9ab5-9abc5b13f322", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475626, "uuid": "d47bafd4-11b5-452c-bbc9-78367469d6fe", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPSXvkgKtuBdfMAofD:WCBAdKV9Xf0kF3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647475626, "uuid": "4d136c6c-8cee-4143-8ef2-c159cb1cc057", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647475626, "uuid": "7fa8f141-db13-490a-9021-2894303637c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475626, "uuid": "8f4c42d8-fcc9-468d-9515-9e8ccc83d432", "value": "9641193079792268a929f9c95d2144f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "322951e3-a5e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647518152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518152, "uuid": "1db0c905-ec42-4bc1-a82c-1d8d3e4b7bee", "comment": "Malware payload (Heodo)", "value": "582d0547335eb328badf9e15a0a86df3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518152, "uuid": "b676d465-a1c8-4e6e-a633-a8b5a0d4be9f", "comment": "Malware payload (Heodo)", "value": "70292aa230d08bd3af7a87341612b523845a94c4507900211330d7abbe86f8a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518152, "uuid": "2c4df539-fe54-412b-afec-82b672581fa9", "comment": "Malware payload (Heodo)", "value": "4406046ad37173618bab0256c13e6935e5552638", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518152, "uuid": "90027074-30c6-4a8d-86e8-1d690d2d3b78", "comment": "Malware payload (Heodo)", "value": "b808e11cd832d323cd980bf21668c4521f10a1b7e6bfec105cc6008ca765530bec861b478314719ef237629759454710", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518152, "uuid": "db8ad0fc-988c-4a72-9427-51f206ba4c48", "value": "T15C058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518152, "uuid": "60224335-5b09-4b04-8298-ef5c602d3ec3", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518152, "uuid": "a7b4e1f3-78bf-4ee2-8ae0-c19f46574788", "value": "12288:Wvz1CLJyyvmMLSrBgT4ruGbPlVpqb+DlYzv:WJCLJyybLqBy4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518152, "uuid": "70fc3698-4623-41ce-96ef-86dd71f022cc", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518152, "uuid": "a67c0679-69aa-413b-a123-01710809d778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518152, "uuid": "9b18a1b1-4a35-4b7c-97d9-9e974cdaefa7", "value": "582d0547335eb328badf9e15a0a86df3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b16d756-a615-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647537173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "bf547990-311d-45f3-a7ec-d6a3de65c830", "comment": "Malware payload (Heodo)", "value": "30a7631eddcfbdf15715eef703a04f3e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "4366eb5e-4d43-44a0-9c67-6106a997913b", "comment": "Malware payload (Heodo)", "value": "72c9fe35bd274d0354c8b07c88da76adfb46946fd0777a9200c996dd571abf4e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "434f8ed8-15ce-48a8-bdfb-989c5603800a", "comment": "Malware payload (Heodo)", "value": "ff60cc0e4fb98fc0638e2e6aae7f3b3f437227ff", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "bb985c57-5f29-413f-8694-25ac81f5fbc5", "comment": "Malware payload (Heodo)", "value": "79185d02cb9e1861dce0c5d3d2dc66168d03bdccb62d4cc85479cdf4a87a1e182a1948c95dfbe0c769b029a87f6bc577", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "e4eeab5c-3212-4448-9fca-6c57762845ab", "value": "T102057C5037818037E7AA58740601BA783D797BE38BBF72925E80957DEE704C3C768B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "c30de79e-6fcf-44b0-ad55-8875c6da46f9", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "37838a87-e89d-4fff-b5ba-04546e2e1fb2", "value": "24576:xJjq8sc5JGxNNNNI+++++h3/UQUQi6j5URW2AeF+99V3kW5Qk45:xJq8s4uNNNNI+++++h3/UQUQXv2AeEB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647537173, "uuid": "710b7845-6b82-4cb6-9861-d1cb2e772201", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647537173, "uuid": "f00c451f-3549-4d1c-a806-e096c93d9353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "bf617069-f270-4f85-b284-b3bdeed1ce69", "value": "emotet_exe_e4_72c9fe35bd274d0354c8b07c88da76adfb46946fd0777a9200c996dd571abf4e_2022-03-17__171246.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e1365b-a5f9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647525306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525306, "uuid": "e7f13fa2-e085-4d32-bd78-efffa3b88e74", "comment": "Malware payload", "value": "4931e28f298dce8158aa993a7f4bb964", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525306, "uuid": "f3f57f04-32f5-4485-9e43-979c5857cf9b", "comment": "Malware payload", "value": "739e94a41234bd028fae27705c6d0ff5d8d9925068384bcdfe4cdecc1fb36e4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525306, "uuid": "474fdeca-329e-4173-ab1d-05b70c491bd2", "comment": "Malware payload", "value": "9c907a51a50d145410ec5ed57c0dcd19f852d089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525306, "uuid": "345f8cb8-3565-4afe-b3fe-c64426f8cd35", "comment": "Malware payload", "value": "cd0b5074b2ae70621b64173ec69f229be3a292d390367f557a43f7d90cc268a0c55fbeb0ccc614d7d541dae4aaac53f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525306, "uuid": "0e5a05a0-59ee-4f65-ba0e-d81f1df3a10b", "value": "T115946B7E18A95337CE7BD2728650141AF691D1EB3902AD29FEC31B810D176CA3FC692D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525306, "uuid": "a32f4560-b2ad-403a-b41b-7e8ea6733122", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525306, "uuid": "4d08b0a2-ef9f-4b15-ac00-4dd4180ad372", "value": "12288:MvVkYTOY/Vw/bi29qYfLVceFXhpO1VPH:u/tQW29qYjVcOTOvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647525306, "uuid": "8cbc18f7-ffcf-4fde-a5a1-1b06c35d650a", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647525306, "uuid": "216d3a04-3359-46c2-8799-2d2bb7234c37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525306, "uuid": "069073fc-72d7-46bb-868f-ff94c879e035", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d26c4d-a586-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647475608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475608, "uuid": "6d8f7b9c-96e6-4381-a256-6ea082beaf95", "comment": "Malware payload (Heodo)", "value": "101627604c0b95f872ef888ee4e7d94d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475608, "uuid": "c196593d-5b61-499f-bb4e-b34ac194dc9b", "comment": "Malware payload (Heodo)", "value": "747841b732950cce2311fedc64a8e141f5b7e4cb24acae61dd22a9976a75f732", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475608, "uuid": "befad758-17bc-4c26-8fc0-9f9eecadb9be", "comment": "Malware payload (Heodo)", "value": "dffb2d31ef56996551459b73088f5e750e1d0745", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475608, "uuid": "ea45a6c9-a3c1-4e56-a532-38d83ec1ff96", "comment": "Malware payload (Heodo)", "value": "215735c6585101637dd4bb143db17e4afbb37a954a5385706fd740f92a44198f60cec35c5e41275cfe8e79753e9237a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475608, "uuid": "80b6f12c-ce81-42a4-bdd8-177c3080a81e", "value": "T1D1F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475608, "uuid": "4e41f494-172e-4fd2-86b5-6998905b36b9", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475608, "uuid": "05623b9e-d7d2-4b63-b60a-b66db8cb2cb0", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPMXvkgKtuBdfMAofD:WCBAdKV9Xf0kf3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647475608, "uuid": "5d1c8211-3bd9-41a8-a8df-e82912ffcddc", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647475608, "uuid": "85bff618-379a-41da-acdb-f5d3289ed049", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475608, "uuid": "431f3f6f-a2ed-42a6-a8fc-c8ffc4372add", "value": "101627604c0b95f872ef888ee4e7d94d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d35739-a5d5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647509701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509701, "uuid": "3d0e0c3f-84e6-4db9-bd75-7e95cb85c3fd", "comment": "Malware payload (Mirai)", "value": "6923e15b0e60f1e20fda740e71f2af16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509701, "uuid": "cb017a0b-6a7c-461a-819c-77f8aaef39c0", "comment": "Malware payload (Mirai)", "value": "7561d5d9f16d280f6d48a362bd5fc0e7ca8ba9590ed4d0f2e7e1c2d9afb2f1d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509701, "uuid": "329eebe7-2c6c-4243-a3f6-6b5ae22bee33", "comment": "Malware payload (Mirai)", "value": "e0cef35248fa0be55e36b14d0be60f410d8730c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509701, "uuid": "f0db0fb3-ee77-49dd-8162-3f0ec19312de", "comment": "Malware payload (Mirai)", "value": "af115e0949f3369536e3021fa04b9fb183cd31397556158093abd81dd53e7c2d62ddbc1356f6a44e8881960e9c806e9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509701, "uuid": "68d5509d-b10c-4632-aae0-b94dbe1c06b1", "value": "T18ED2E1425D8CD8B2E0F00AB5DDEC18C323175771EA8634A635C1CB685DD6662EFE88A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509701, "uuid": "c0e7f671-7a91-42a8-8f70-087fb16cac0b", "value": "384:llGpycID8FjeanIL1RlSNPro+ADfAIW6LQ72fxoiiGQkNZ9lMZmdGU5EaM:7QID8j8L1+ZreDfNJk70JiGQHZ3U1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647509701, "uuid": "d99960d4-e165-40d7-90f5-c3f0f88d8250", "value": 29764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647509701, "uuid": "5e5135a5-58c4-49d4-b69b-5d31b7f223bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509701, "uuid": "4ee88a30-31ac-489d-91ca-ba27da667d53", "value": "6923e15b0e60f1e20fda740e71f2af16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8295cbf-a5e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647515800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515800, "uuid": "833aa60d-603d-4689-ad67-d767c60558b8", "comment": "Malware payload (Heodo)", "value": "4884ee5778be8a256ab63d332fb44c17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515800, "uuid": "38f4e93a-37aa-49da-a675-3a00d4797594", "comment": "Malware payload (Heodo)", "value": "75c4db8192f35be14a47a8092561103b6309e341e38b2f85a98ef03f0da60521", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515800, "uuid": "2ae68fe1-cc5a-4953-8fc1-3c691199a6ce", "comment": "Malware payload (Heodo)", "value": "bcccc7e883cae733261185dce5d8a941a495d515", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515800, "uuid": "5570da96-ca72-4c82-8c51-a27bbe096639", "comment": "Malware payload (Heodo)", "value": "bca14900be769c7eda515d1f235971077d9a5d13eb2db00a5645bc48fa0c9fd072aa225f249dd69ce24ab0010f4d6a0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515800, "uuid": "bbe31122-dcb0-4886-a19b-4c0189be591d", "value": "T172058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515800, "uuid": "4bbb8338-4f1c-41d8-8d77-e5c55f087253", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515800, "uuid": "7cbcc96a-cc33-4207-8589-2137d06f2ee4", "value": "12288:Wvz1CLJyyvmMLSrBgE4ruGbPlVpqb+DlYzv:WJCLJyybLqB94ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515800, "uuid": "e80cbf8e-7d7f-4748-943c-7aba8353d792", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515800, "uuid": "9d2f5a8a-5bb7-4950-bad9-d2b5d4dd3be0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515800, "uuid": "92e13be8-db25-4e5f-bf1d-469f2074eba1", "value": "4884ee5778be8a256ab63d332fb44c17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9016ecf3-a61e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647541073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541073, "uuid": "0498a87e-153b-4ae5-ad66-556f728dcdc8", "comment": "Malware payload", "value": "9edeb60a9abe9f4e1078379e9fab4039", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541073, "uuid": "5ae8ad63-1f5a-43ca-93e3-8dda8cbd5ab0", "comment": "Malware payload", "value": "75f3a3d6409247016950e78e8bf9a9544e160077ffe3c85d7ac5225a274d4b41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541073, "uuid": "79fda86d-9d7b-4650-b52f-508645d8cd92", "comment": "Malware payload", "value": "67ccef0515934f6325c12e4ee0970253ec8f6db2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541073, "uuid": "57da5863-ebe5-4eda-904d-e2587b9b8f2d", "comment": "Malware payload", "value": "50cfb7d7f53b48053003ae56a61bafb5d24f30f73e1055f2eabf0b18f81747ca7d63b64b0d983114ac1625e1b1766904", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541073, "uuid": "4a50022d-37dc-4328-9e61-082bb45e2b4e", "value": "T152058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90117EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541073, "uuid": "aa4bbdf1-5108-4346-8179-ed25241c9506", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541073, "uuid": "7ad5eb23-4e23-41d5-899c-52632df2c03b", "value": "12288:Wvz1CLJyyvmMLSrBgI4ruGbPlVpqb+DlYzv:WJCLJyybLqBF4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647541073, "uuid": "37648eae-e470-47f2-95b5-8054ce63b1b0", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647541073, "uuid": "a820b6b5-e340-4987-ad89-aa5661f0652b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541073, "uuid": "f8bc312c-b9cd-47c9-822b-3bfe883f88d8", "value": "9edeb60a9abe9f4e1078379e9fab4039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674eff6f-a5e8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647517812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517812, "uuid": "4ec5a4d8-d1fd-4e22-9f14-6296f133ed33", "comment": "Malware payload (AgentTesla)", "value": "ba64d8ad2976c77d8e404f4bef43fa40", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517812, "uuid": "04627eaf-ea4e-4e7f-8408-bee15eb6ffe9", "comment": "Malware payload (AgentTesla)", "value": "75fa58985426fb647cf5030e7b4b0324f7716a0a6948699093fdbeb7a70bce7f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517812, "uuid": "56edfbbd-d882-4ed4-9229-c964c5b87856", "comment": "Malware payload (AgentTesla)", "value": "a431e000cd821316f2d4a103d5c0af0b41a4976e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517812, "uuid": "8ed0e29d-ee6f-46c1-b11d-d62852e86e18", "comment": "Malware payload (AgentTesla)", "value": "7f70059559d37db62b442f3ded77dca1e6a8a9928eb87fc84306aeb69c425e0ced69cdc9b0bace8a3e503c7316f796e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517812, "uuid": "d1a6e1c2-8af4-44be-9810-72020cfe36d5", "value": "T19F3533D76D8DF19398AFF5048AE7D9ED98B1C309F3A4A870B8D2401FE8664127C340E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517812, "uuid": "6fd4ab19-c815-45b1-8f6c-147ebec05ef8", "value": "24576:Wnm3WaXjtupIjY38QxJ8QJ9KP8TVUxARY+79CWzB8XtoED:WqvZupIs38INJQP6gGCWzmoED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647517812, "uuid": "47859c85-1c80-482c-af85-38f70baf2d42", "value": 1081068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647517812, "uuid": "fd65285a-2d06-43ef-8ec8-895e361831df", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517812, "uuid": "020d09f8-c2b8-4b2d-91dc-dc9dd64a0252", "value": "PO 3360.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d79f79-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "5f3ad7f9-a0cf-4cb8-811f-46d8b6050ad2", "comment": "Malware payload", "value": "e5b06a1d288b1715a679c4b47618694a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "d9303b3a-f8e2-470e-95ec-ad4ebd1850b6", "comment": "Malware payload", "value": "7643dcfe7d700c37966f828459ac066179581ecc7ef2d629624567f370d8fad2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "d5f74be4-dc28-44f4-86f2-4455e92e16b5", "comment": "Malware payload", "value": "6acfcf730d98fd455412f256c1a83abfe734b1e7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "6d72e49e-b2af-4dcd-95ad-459faf45439b", "comment": "Malware payload", "value": "9b985fe7b31f969d462ab08b6e4a443e9100792f2a4060f4ec59a9d834a24c55d8296fc819f3d884e1f2c69c2364bdad", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "16b755e2-484a-44a0-8a96-1903d1862650", "value": "T1EA059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "4d355d40-63a9-4beb-a0ab-f6cee33d742b", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "9b4a9586-2bea-4cb7-861f-a6baf8f30f6d", "value": "12288:V20BXOMcVzpWfmmnDDGX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDCX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553507, "uuid": "13a7a718-c4df-4dc2-8aeb-9ac847964672", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553507, "uuid": "a73ceef0-e89a-4593-8510-41dd651d87fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "afa46d07-0d61-488d-839f-72710981a16f", "value": "emotet_exe_e5_7643dcfe7d700c37966f828459ac066179581ecc7ef2d629624567f370d8fad2_2022-03-17__214457.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a502ba7-a5d5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647509710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509710, "uuid": "1b4af595-c612-49a5-80dc-60f81f1e63ea", "comment": "Malware payload (Mirai)", "value": "d3c6059ff8b7585a5c2fa0b5956def58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509710, "uuid": "c267b43e-6689-41ea-932c-579b8ac96605", "comment": "Malware payload (Mirai)", "value": "76912d19c65ed7a942f1974a5ca6559e61aed11e4f2a1f5ac7a63eacd8a94bed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509710, "uuid": "210074d3-a735-45d7-bcbd-c7c08f96db85", "comment": "Malware payload (Mirai)", "value": "f4be78bd903ffe0ceb57b8411e3001e338060912", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509710, "uuid": "9c1476bd-1c86-4103-8921-4eb31f6dbba1", "comment": "Malware payload (Mirai)", "value": "2153420b98a2f801f980e387088bbcaac5acf282ce621367e6931198733a912b07773eac427e06c94c8806a6a773edd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509710, "uuid": "1a71d9a8-973a-4acc-b9f7-67e78ff5442b", "value": "T19DF2E19FD9795488D6890E3E817C1F1077C0A9E3E24D6E8D27885C49C37A842B8DB47E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509710, "uuid": "abd1d563-bd05-45f6-8217-2601c7fabdbd", "value": "768:2HHRe0gibn/9m6U7gvJ2q3O50SoZCQjwBC3MJWM4:oe03rlWSJ275/oZB1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647509710, "uuid": "8f7bb76f-6c82-495a-a81d-af082a8330ba", "value": 36544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647509710, "uuid": "e035da73-9da3-4338-b7a3-af4fc4daf949", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509710, "uuid": "754dcce3-0851-442c-8467-0c17ec8a38b8", "value": "d3c6059ff8b7585a5c2fa0b5956def58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a92893d8-a5e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647515775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515775, "uuid": "97be173d-b170-4ed6-828e-3301396d4833", "comment": "Malware payload (Heodo)", "value": "dae20c93d4a0a7204420f5bf7be827af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515775, "uuid": "40b037de-871a-4135-864c-bbb73ceba193", "comment": "Malware payload (Heodo)", "value": "76dbb59e5bb2822cb43280fc732f323a27ea8af7feb2e3778d382d66675bfa5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515775, "uuid": "24e93637-0d65-4c0e-934c-0c96d027b970", "comment": "Malware payload (Heodo)", "value": "fb2ac35578755753db962c2ae0c4aaa6d3778f98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515775, "uuid": "e90ff93b-b9ee-427e-8ca2-0a6d875c13c0", "comment": "Malware payload (Heodo)", "value": "d47251e1949d1ab3b815a5ea4dace208644b1670b15b77ee5e5647178c8b05eda848af998a99eb00a1b9152da2de9ac4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515775, "uuid": "c3f7a81c-be0b-421c-8d06-5d31d0de46e7", "value": "T1AF058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515775, "uuid": "8f8da916-b2e7-467f-8ac7-9bf9193b7c86", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515775, "uuid": "ddbff575-c764-45b8-b412-f841ec3f539d", "value": "12288:Wvz1CLJyyvmMLSrBg54ruGbPlVpqb+DlYzv:WJCLJyybLqBM4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515775, "uuid": "6dd48a47-4fac-4639-8d74-0bbcc05cf8ad", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515775, "uuid": "a546866a-659e-4952-8281-83d8e7a30c6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515775, "uuid": "c67383a2-78bd-4db6-8e50-afc6a4845551", "value": "dae20c93d4a0a7204420f5bf7be827af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef512b64-a60b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647533073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533073, "uuid": "4be5fb60-2e6d-4923-b04c-f61e1b7592bc", "comment": "Malware payload (Heodo)", "value": "67f47f628ba4520b6a5b753ba141fa2a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533073, "uuid": "7676df06-2bd6-452b-9cd6-b48faa2062fe", "comment": "Malware payload (Heodo)", "value": "771a08419e115c018c3b1098c7da72345646f85163cc19d7a32babe0d48086ed", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533073, "uuid": "417c0e73-1f20-40f6-9d91-f537e5b01152", "comment": "Malware payload (Heodo)", "value": "b787bfbd133a142301da3f44a5706b2ca735c4f7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533073, "uuid": "532df03b-2290-4b3c-b628-68e26e076f8f", "comment": "Malware payload (Heodo)", "value": "87d6736203502a6c2c365cf344a1f00a87d0a01b3fd4b362035858b7b0bbc4525c25120727ca48164b25c2a32b2b84e9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533073, "uuid": "8cc317a8-28b4-4879-b612-c2f2406fe11d", "value": "T1B0A2AF3ED221E818D67B987C830580F6E70B2C561007A9ED2D51F25D66726F7138FABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533073, "uuid": "7205e452-8180-49f0-b36b-65cce4af68b2", "value": "384:iQZAVb1GNjJITo4CGzPd6ZIwVKb5CzgObff9kC+xbX7zL0crX:iTINqTo4FL3CBn9kC+xbLHjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647533073, "uuid": "0811bcb5-075f-4fac-a40b-b7b2e3f20399", "value": 21461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647533073, "uuid": "04da25a1-49c7-43c9-aae1-1c948cc99f89", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533073, "uuid": "5bc8cd15-0d16-4e85-8ead-d2e0cd4d6a02", "value": "Rech 2022.17.03_1641.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c73244-a626-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647544279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544279, "uuid": "94550b6c-b97a-43ef-be5b-c710fe7f6d61", "comment": "Malware payload", "value": "c8c03a37313f9f1465715fcd63d6a6ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544279, "uuid": "836e9022-326d-4f0e-8076-a5452d7a98f0", "comment": "Malware payload", "value": "773985f4185c804d5ac710b5575cd7601aec4bd622340bc4c39a692a6f209049", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544279, "uuid": "e5e9ee7e-6b0e-49d5-a97c-89a24c7de1b2", "comment": "Malware payload", "value": "4fe5514d98f58330654a02d8b487012f67742359", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544279, "uuid": "a57adc78-b321-4388-bce5-764c57279f6f", "comment": "Malware payload", "value": "cfbb48d28e96e7d48878ec3552c209859e810f52779f05a240e75c2bfbb887f2e4a657d73a20b9d97697cd111066ef98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544279, "uuid": "c119ed76-826e-41b2-8b96-aba2d21e4391", "value": "T1B6058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544279, "uuid": "e8429dbf-0a71-4471-9f5f-0941cb9a1a2b", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544279, "uuid": "0f5bd1c0-33c5-45c0-8c8e-b9c6dc28ba2e", "value": "12288:Wvz1CLJyyvmMLSrBgQ4ruGbPlVpqb+DlYzv:WJCLJyybLqBB4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647544279, "uuid": "75108c4a-437e-4a6c-816e-39075ddfca6c", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647544279, "uuid": "76bb08cb-95e3-493a-b2c2-8eeb40e214ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544279, "uuid": "4c808c65-49a3-4628-988c-e6f5071933b5", "value": "c8c03a37313f9f1465715fcd63d6a6ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775ddc76-a5df-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513974, "uuid": "d828d5e3-04c3-441c-8855-a29b501f28f4", "comment": "Malware payload (Heodo)", "value": "0438c41b641d114292ec565b58d04ec8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513974, "uuid": "b6f099f7-a991-4e67-95a5-311fb1732068", "comment": "Malware payload (Heodo)", "value": "7787e49599bbd5f9f8dd82ad684f6e6828f3268fa671fbdf1c68f98cbb00a7bc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513974, "uuid": "e7c41ee3-1769-4913-baf8-f5fab02341a7", "comment": "Malware payload (Heodo)", "value": "acd6458bc5a9a3e25b55bb5f2c00e118b59c4109", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513974, "uuid": "3280d42d-0ece-4c12-8e60-1f1edcf831ca", "comment": "Malware payload (Heodo)", "value": "aeb1150f0513fca07ba7e0027d03f6f0473ad29ef860e203d62c4af055433e1e96a8c2503d8331643bda16d587106661", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513974, "uuid": "6f930d3a-f010-458c-8ce7-483b920e0931", "value": "T12F058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90117EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513974, "uuid": "a2300e81-e4e3-4f62-976c-68a1263df3c6", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513974, "uuid": "6e41524f-b492-477d-b323-b511a0340da0", "value": "12288:Wvz1CLJyyvmMLSrBgB4ruGbPlVpqb+DlYzv:WJCLJyybLqB84ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513974, "uuid": "6a1591d3-3217-474e-9fbc-2ca747ae41b4", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513974, "uuid": "0ffc4f8b-7935-4a45-be78-e851c6996b1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513974, "uuid": "cc5bcf1b-0320-4666-89bd-a62146b8cd0c", "value": "emotet_exe_e5_7787e49599bbd5f9f8dd82ad684f6e6828f3268fa671fbdf1c68f98cbb00a7bc_2022-03-17__104607.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa672f3-a603-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647529548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529548, "uuid": "cae0cb30-7832-492a-a39f-be8216f176b3", "comment": "Malware payload (RedLineStealer)", "value": "d8607542e0ede5f78054e2fa60fdee35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529548, "uuid": "60bfaf4f-6b0b-4565-bd78-f4b36e8d8143", "comment": "Malware payload (RedLineStealer)", "value": "7812f862a22c201df9d457e1fb874c95eec727fc3c09e7b7b4e63ee3e4019b05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529548, "uuid": "c4bc94cd-6508-43a6-be74-96be427578c5", "comment": "Malware payload (RedLineStealer)", "value": "07bc256c2549d24766281d1603596b9f4a40ccbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529548, "uuid": "508f007d-0e9c-4711-bccb-aa09ffd7b86d", "comment": "Malware payload (RedLineStealer)", "value": "f2f45a563e087d2d0f0fa9b86f46e5cfa61a9b5a3ca045b144a053c91b17b2dd6f1ea9ba039b6a59bdefc94f5725a0d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529548, "uuid": "4d85073e-030f-48f9-a08f-335559317bcd", "value": "T1BC84C040B7A0D03DE4B351F8797993ACB52E7EA05B2060CB62E62BEB16346E4DD75307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529548, "uuid": "2821d59e-de37-41c5-a6ff-cd5ef36e72ca", "value": "f1731ed7afe55cfc124203197b72d3ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529548, "uuid": "88af608d-5361-4826-b79d-d4914cbcfdc5", "value": "6144:3LNyPsDh4ayFQoa7VkBhvVSqQpnHgo2IDNXxXBd19cacLcdw9BVboaBC9:3ZBDhhyFQP7VitSqQB4IBfd19cEd7F9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647529548, "uuid": "c4f9f16e-755d-4318-89e3-02ef92eacbab", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647529548, "uuid": "4fb2a52e-6fbe-4d3b-b709-fc34e81b2051", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529548, "uuid": "614c4599-984c-4d4f-8517-23130e47a6cf", "value": "d8607542e0ede5f78054e2fa60fdee35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccdffe67-a5c3-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647502091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647502091, "uuid": "dc771f47-e9a2-499c-8415-f50821c6d223", "comment": "Malware payload (AgentTesla)", "value": "d341fd503ad91b2fa13e5a73f83fb9a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647502091, "uuid": "1bbd9033-eedd-49d9-bb96-6224c3f70f27", "comment": "Malware payload (AgentTesla)", "value": "78c9ea16454a75507dfa2e73a4b5497da842719bc99a6d4441dc31fe4bf7c772", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647502091, "uuid": "6f8d4e60-9bf5-47bc-a4ca-d2850e9a031b", "comment": "Malware payload (AgentTesla)", "value": "2b93a6a5e975e670d25298320c9a5f1a50e6a038", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647502091, "uuid": "2502d4b8-d388-4645-b599-6060e2656c89", "comment": "Malware payload (AgentTesla)", "value": "b431b5b80c24ecb374c134485c02cf87555e31cc46c61c3e5d33c70132efc7a5f0d3533a20f52fb87e7755c6eda02c09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647502091, "uuid": "eeb512ad-fcfa-407d-89eb-91c79899a034", "value": "T10745024373498F12C55B113782DF88D003F59FD22923CB45FCD8FB9A2A12376E91A69A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647502091, "uuid": "b8fa5d2b-3c6b-43ad-822b-1f7e0c631447", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647502091, "uuid": "29d82773-2e7a-496f-854c-5ced47845f0d", "value": "24576:C9Sq4wOHqSMc1/JQYtReVtN0mk6OoiTFsZtT:C9SxfEkxtReZOmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647502091, "uuid": "2439ff07-bdbb-4cde-a028-778f04d7a989", "value": 1213952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647502091, "uuid": "623e9f36-3ac3-43ee-9804-757999de0476", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647502091, "uuid": "3071883b-a2b3-47bf-906c-fe085d52de34", "value": "GXhJpwju4TDiBao.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32489f03-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518582, "uuid": "2e8358ef-8a53-4814-8edf-82058977b940", "comment": "Malware payload (Quakbot)", "value": "2204e75619877bcb0ec2bd9cca037692", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518582, "uuid": "6b685669-207b-4253-ad5d-b0f0b6bbacd3", "comment": "Malware payload (Quakbot)", "value": "78ff0eb104d17a409021f5586e5c44457f95e3d682921216d774c3eb5ac643b1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518582, "uuid": "a97affbb-a4db-4e49-8c93-8a186c5c7f49", "comment": "Malware payload (Quakbot)", "value": "54f0a3b8312db8e81d6a9e7535a71a5aad07659c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518582, "uuid": "86211627-34a9-4097-b830-9f4d7964435e", "comment": "Malware payload (Quakbot)", "value": "ac78bf4b7b6b6df049b270229341a0af95e04d6ee7aafb586e7c66bc3f2c871c7054936365369e0182f98cdf1fedbc12", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518582, "uuid": "455e1044-f696-4da7-9278-a9df23f65ef2", "value": "T1E715BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518582, "uuid": "51b27f40-5637-48e8-a45a-36dcb853aca8", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518582, "uuid": "e39c7163-f329-4c51-ad56-b3f20cf8dc4e", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518582, "uuid": "1fcc1008-8968-4f60-b158-f4466e938f7f", "value": 946364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518582, "uuid": "db1dae76-63b6-4524-855b-4d9a9aeb84f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518582, "uuid": "b4b49de7-f68b-4a73-856d-aa993cb07574", "value": "78ff0eb104d17a409021f5586e5c44457f95e3d682921216d774c3eb5ac643b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c5ff4b-a5d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647510751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510751, "uuid": "6b05e9be-e3ac-4fd4-b475-c62ba73ab9d5", "comment": "Malware payload (Mirai)", "value": "ad91166de3505d40e0fddf90d059ac0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510751, "uuid": "df0d9ccc-a1cf-4c93-b277-c58e50affba3", "comment": "Malware payload (Mirai)", "value": "7917d69e4ea3b93dafaf4cbe585cb48fe8f622dc8975b50e1bc372f1676aa97e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510751, "uuid": "df99af06-37ef-4873-9190-29684af53c44", "comment": "Malware payload (Mirai)", "value": "16bd32af2c4f652bea56eda655f8fe1073edd16a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510751, "uuid": "035c782a-87bc-4aba-8401-8ed92b69647d", "comment": "Malware payload (Mirai)", "value": "faff41057247ed6cf4ce8ca65dacf3d3ea7d38d9bedf69c18d1515cde9d50a54c88e6937feee25d92988db88be3cdef3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510751, "uuid": "0c9c6b4a-df89-46a9-b7be-5162445e34d5", "value": "T1EA430133BD5681F424C61E315928030777582FB5C962A43C601358299FB6B97AABFF83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510751, "uuid": "9e595940-c8ef-4d91-a2ce-c00ef06dad86", "value": "768:Pn9FH0l+aB7efJ5VkMlASswOymMYVnqX1k/E1Yzcq3UIK9fL9mu3cZq/Y4gjx0sN:Pn9FUrCuSRnDX16E1YzTGfF/tyNGvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647510751, "uuid": "ef53f600-36b7-4d1b-b93e-54bb17725c0b", "value": 58308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647510751, "uuid": "85c03135-1dfb-4b9f-8755-bb19fc97a230", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510751, "uuid": "f1dc331b-7954-47cc-82d6-2eea3a272f40", "value": "ad91166de3505d40e0fddf90d059ac0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa726f2-a628-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647545305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545305, "uuid": "5e68e39d-60c4-40d5-96cc-f594b71a4773", "comment": "Malware payload", "value": "153263496914132fdd400b55a8731c18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545305, "uuid": "6b663083-d95b-4fbb-8e02-5fbf51005958", "comment": "Malware payload", "value": "79fae5d417c01f48c2cfcfee25a1ef9834f2f392a7d0a6fc4296c0abec4299f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545305, "uuid": "d5539ea4-5c59-4daa-a792-a92311c77bef", "comment": "Malware payload", "value": "78026676a881b43cf8fa1588649e017095a7d7fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545305, "uuid": "7a0410e7-ac6f-4812-9a28-1325b347137d", "comment": "Malware payload", "value": "9f5a924943119e949cdc49a8750783a594eaa67a96a5835e7e3085a95ed740431a7155dd7923212501a121e5775dc90a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545305, "uuid": "28def277-ba32-4253-8903-e0eca0d49c12", "value": "T172C423B336D0B68BC34E27F04A785746641719DC9BD8B62259BE8B87132C0B9E54E2F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545305, "uuid": "15d4ebed-7bb5-4870-9cd4-3845ec5e860b", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545305, "uuid": "71a34d0c-8cef-4044-91ca-2b9afd4f4567", "value": "12288:QpV24oak2NHgT9CQS03ULaHNqrxlKIQNoLcd/BlZk8g46YR:QpVF9kEaHNYK3Wcd5lg4nR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647545305, "uuid": "1236f14f-891f-479c-a9a1-d64e734a2f94", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647545305, "uuid": "aa2cd809-5054-4e40-b14e-5f95114318f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545305, "uuid": "c8d97682-45ad-4937-9a26-4081ef707219", "value": "12331865.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02501993-a5ef-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647520649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520649, "uuid": "c4d0f7ff-c7f4-4c02-b4ac-bee46feaf3eb", "comment": "Malware payload (Heodo)", "value": "c996beee86d98c499ccd4e1acb4242e2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520649, "uuid": "c3f48850-c9a6-4850-be6d-30e78ff44715", "comment": "Malware payload (Heodo)", "value": "7adf927eff46fe806641a4d369b778cdfac31b76814ebfff28cf764975200774", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520649, "uuid": "5fb31c6b-4da7-4d1a-815e-38f1abfc72cb", "comment": "Malware payload (Heodo)", "value": "7b6a98d3d89fe06a9235deb55194702c1507f31f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520649, "uuid": "97a26b44-4e8c-4d5f-b1e5-4130819417f8", "comment": "Malware payload (Heodo)", "value": "3581182eb1fabdba7054e723334215021c47827d257b6eb4a81d87f331dab03080e30ec6224832bcf1da2fad7357880f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520649, "uuid": "061da9d2-616c-406f-93a7-8828673da73f", "value": "T153A2BF3FD132981CE67F987C430440F6E70A1D86600765EE2C45F26E66726B6038FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520649, "uuid": "4c7a4b40-596d-43e6-9e9e-048e4752283b", "value": "384:EHTyVb1GNjyo4CGzPd6ZIwGdKb5CzgObff9kC+xbX7zUSA:wuIN+o4FLYCBn9kC+xbLzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647520649, "uuid": "414c9355-bf9a-471c-9004-ab7a7ad8cdd6", "value": 21444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647520649, "uuid": "a7b90380-25f2-44df-a460-e690ed6a4c35", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520649, "uuid": "de8029ea-16a1-4547-b3b1-75bf07a781be", "value": "Rech 2022.17.03_1332.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f70dd287-a61e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647541246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541246, "uuid": "a5106f77-0d53-4987-9459-b0857fe8faf1", "comment": "Malware payload (RedLineStealer)", "value": "0df8578cf1a41ef9f7906b4f0adda943", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541246, "uuid": "ead02cd4-14ce-4609-99b1-926bb2c67576", "comment": "Malware payload (RedLineStealer)", "value": "7d0dfc5e14b09702207137702438f449f19d53e7df021175c7b76c2e31d373d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541246, "uuid": "aace5238-86a7-4ee7-b114-d63e9841c3ea", "comment": "Malware payload (RedLineStealer)", "value": "ad52dfbd0dbe798804c8885bc2cf662e00592db7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541246, "uuid": "cb95697a-28ca-46d8-b0fc-ade7adaddd99", "comment": "Malware payload (RedLineStealer)", "value": "adb4efade491d2a917a8858a7d1fc2420adec7ce301452edc542374f6abf550d7eba15e284cb9a2964213454ad078b23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541246, "uuid": "e26ec237-d039-48b6-9a92-45a02c736fba", "value": "T14C84DF40B7A0C03DE4B341F8BD699368353E7DA15B2551CF62DA6AEE16346E0ECB530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541246, "uuid": "d9c78b3e-3463-4ef8-aeef-baaae702995c", "value": "f74322b8ce790933ead3642821199a05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541246, "uuid": "e207c79e-5215-4287-9c13-7246ee4acf19", "value": "6144:HWwl9kv8tlEyRzAA6LXglyfYfUjYCQvb/K2uKp5FhdC5nMsXg:HWw0v8bEkzAAogyuTCiumFhw5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647541246, "uuid": "ef5662c1-f196-400d-83ce-27711d74267c", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647541246, "uuid": "860cf854-d0f9-4445-bc1f-a3d2a2c635d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541246, "uuid": "81566236-b47b-4ac7-8fc9-d232916191d2", "value": "0df8578cf1a41ef9f7906b4f0adda943.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d787fe3-a5c1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647501126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647501126, "uuid": "8d79660a-8dfc-4277-8271-9feea45325a7", "comment": "Malware payload", "value": "662cebf7479df32edd848b531eff7f90", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647501126, "uuid": "943d3054-6931-4681-8fb6-143ac7967f27", "comment": "Malware payload", "value": "7d7cd5ac1e179ef1b5aff7899e88714bd03a04f78d7cf24c8c9d119bc25051e8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647501126, "uuid": "6158df2f-601c-4c31-a96e-59b9a9a84800", "comment": "Malware payload", "value": "8e70191fc4119afca002df68296806f454187d05", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647501126, "uuid": "603945a4-359d-4715-9e6a-9eba212b4064", "comment": "Malware payload", "value": "8c14d05567d807b37ef71d776fbb8f09e64e53d03000434f4cf71be8448abebc7fd8844028cbaea336388b11fd6765ff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647501126, "uuid": "f68398cd-0702-47d8-b994-57bf01da8475", "value": "T17F454CF6D502E1D0E82B4674383658737D476D2FA8BCB5192E15F21126F30BAB62BC4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647501126, "uuid": "92cd178d-a2e5-4431-b774-463da6db023c", "value": "6144:qbE/HUEFIJZ02R1lXk5woq3gX3TxB2z6Abj9EaETbwQO:qbCIZ911k5qgzc5aaEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647501126, "uuid": "f15d702d-45e5-488b-8828-feebee3a9613", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647501126, "uuid": "638ebbb2-1965-462d-b981-51cd6e2d04aa", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647501126, "uuid": "ea243ba8-c209-4895-b7f3-67f0abedd3b5", "value": "Pepsico LLC RFQ Information.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dfe2a2f-a5cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647507032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507032, "uuid": "f1ae445c-2671-4958-b654-1e11227a16e2", "comment": "Malware payload (Heodo)", "value": "827557fb1abefcb910cca82e810c868f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507032, "uuid": "459c9b91-7434-476d-ba71-f34615d8a2de", "comment": "Malware payload (Heodo)", "value": "7da6ff113e7093fa1a608493f0ca00fca9b8e2d76804f953ac03393efca04969", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507032, "uuid": "c1e0f5a8-883f-4ca8-a11e-9551e2d92848", "comment": "Malware payload (Heodo)", "value": "534bbe0bde5ca101ac5198c83ffc678e4aac67cf", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507032, "uuid": "5a1c1f1f-62a0-4f96-b667-463682d5981c", "comment": "Malware payload (Heodo)", "value": "9cdb296bd0239384b8a956adcc0b3f4e59b253d9411f5b204745a66de2a77e75b7a3dd9e0d3789bd511ca43408cbc51a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507032, "uuid": "2ebb56c1-c627-478e-889f-80251f3a2ef8", "value": "T178A29E2CE921744DE3BB683C420650FA924A1C022147B5ED3991F77D6B73697068FEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507032, "uuid": "f7852baa-4908-455a-a2ec-dfcb740304aa", "value": "384:j3uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:HsNs/zXtFCBn9kC+xbL42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647507032, "uuid": "529703ca-0c9e-4517-917f-9abfb2aec7ea", "value": 21657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647507032, "uuid": "e3685356-d1fa-412c-8b81-c5d001cda90d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507032, "uuid": "c4affb5f-d5db-4e9d-99cc-b8a443316ff2", "value": "Invoice.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b2c614-a5df-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513974, "uuid": "d6d9fbf4-95e8-4c00-94a4-9b9fe2e5fb37", "comment": "Malware payload (Heodo)", "value": "30fe39535d4abd65fc925261fa770ebb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513974, "uuid": "d49c59d8-cc85-454b-8d7f-1d7e5c9e9b36", "comment": "Malware payload (Heodo)", "value": "7e33a777976cdbda31c9630deba61fbd06ef2ebdddba029377a5429abaa137aa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513974, "uuid": "0ee9ec6a-07d1-42fa-802a-58cb05e06847", "comment": "Malware payload (Heodo)", "value": "1fe71b36c34c8bbf0ba9758db101dbc6909ade37", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513974, "uuid": "ecfa4641-eafb-4b6b-b324-0123f684776b", "comment": "Malware payload (Heodo)", "value": "df78d7930def75c9da3ada8e79a954bc6315c6e38cefc8cf6ac023d2cf5e72a6d7d6981a7a6be15656d020a39316e5ca", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513974, "uuid": "8281c308-9b77-4284-8f8c-3bec8c39ab39", "value": "T1B4058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513974, "uuid": "97664811-fd57-487e-9093-1afad1b96632", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513974, "uuid": "15a5dec1-280d-4821-ab9f-f7af4cd4a791", "value": "12288:Wvz1CLJyyvmMLSrBgE4ruGbPlVpqb+DlYzv:WJCLJyybLqBN4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513974, "uuid": "4b9fe370-1b36-48dc-94b5-b7f33fdc0fc4", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513974, "uuid": "967728ee-910c-4f37-8f57-00ba2d0fc4b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513974, "uuid": "ec43a401-dc77-4676-bbf0-b084bcd08532", "value": "emotet_exe_e5_7e33a777976cdbda31c9630deba61fbd06ef2ebdddba029377a5429abaa137aa_2022-03-17__104608.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171a8898-a626-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647544306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544306, "uuid": "b596bfa5-961d-4a03-b8f6-78762bbf9310", "comment": "Malware payload", "value": "c4cc0725eb5385145eada7aca9d63573", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544306, "uuid": "350044ab-2189-48e2-9819-29e7cda9a51b", "comment": "Malware payload", "value": "7e44a6f38ba3fa7bc266d83fe53f97f45d374fe1921729c2546bec45888e11e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544306, "uuid": "9edb92b6-f6a1-48a1-84bd-93f6b55f8352", "comment": "Malware payload", "value": "223c5efaa2913710a7c2730ff9670105e4383037", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544306, "uuid": "1fda4be5-96b5-4815-82da-65c92f4a69e5", "comment": "Malware payload", "value": "ede1bab3865ecf658915a6f46643a63d417991ca417645adcfb951f4e3c90c1c8b5003d9b00b9561e491d2f5c741e7df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544306, "uuid": "fd4345c8-a21a-4297-b529-201242c3567d", "value": "T12A058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544306, "uuid": "ddf0816a-c4b7-4d1c-8846-1451ae4ccc77", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544306, "uuid": "1b38ca83-2594-4502-abcb-ed5f16663fac", "value": "12288:Wvz1CLJyyvmMLSrBgq4ruGbPlVpqb+DlYzv:WJCLJyybLqBL4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647544306, "uuid": "9d4fe941-e3e8-436b-9f56-4838d923a34e", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647544306, "uuid": "d5cf4d64-d301-4659-bc9b-95fce9fb9d01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544306, "uuid": "d73a4dca-14b7-4f1e-9f04-d4dddb4ef0f3", "value": "c4cc0725eb5385145eada7aca9d63573", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b42ec61-a613-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647536287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536287, "uuid": "11a9bd0f-3580-4920-84fa-7162f33661d7", "comment": "Malware payload (RaccoonStealer)", "value": "08c9ec65603fb31a898decf840affd93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536287, "uuid": "5aed07d6-db8a-41cb-9478-85ee549795ba", "comment": "Malware payload (RaccoonStealer)", "value": "7e76a42bd019793da6fa51f565d3f67b86fafe236c2b053b2483762c5ab70bcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536287, "uuid": "c8238f88-9aef-49a8-8671-77a1325a37b9", "comment": "Malware payload (RaccoonStealer)", "value": "e9195379ec47d60d51302215bf2c4400d84c2f15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536287, "uuid": "31894e04-2208-496a-b720-e5e4eec03842", "comment": "Malware payload (RaccoonStealer)", "value": "e3650ca97c1acdc40cd2fcdda8e9cf687568fde7eb305d9e70685607f0b548ebbfbe0b932fcc91d7832960087e928099", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536287, "uuid": "0551ae57-6bb7-4e00-ba68-8c04454020a5", "value": "T1AE563343F4828572D1961834698D9F51EE3DFD502A398ADF43F8BD69AE302C3F235992", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536287, "uuid": "5204b470-9a16-4193-a558-a5ceb3ea4670", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536287, "uuid": "ee0ca347-665f-4884-b197-9bea6f0f24ad", "value": "98304:JIYg/moeYaGJpLCAtGD64s8okb9iLEantsMvT+1bzj9+B:/gvrJa6n8Vb9i4mt+Fvi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647536287, "uuid": "74e27a8f-b381-4411-86d3-3d377a604871", "value": 6000815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647536287, "uuid": "44d2dd54-6e5e-4259-a9ce-6c9d0bc5203a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536287, "uuid": "c5783238-ce76-443f-b853-6662c39e0526", "value": "20722264.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5293ccbd-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518636, "uuid": "3bcbbdbf-8b00-40ec-aed1-1c72bfa88f97", "comment": "Malware payload (Quakbot)", "value": "bb4e1793a4122e3fab34788e9aeb20a6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518636, "uuid": "9b0e3de1-b0d4-427e-bf91-bbc66874aa79", "comment": "Malware payload (Quakbot)", "value": "7e7bfb9e743be81fed87222e08cb0aa1d69391cd93dc5321285a08b463b78b32", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518636, "uuid": "06585cef-ea2c-4ddc-805c-21d46cdcd114", "comment": "Malware payload (Quakbot)", "value": "9a8e0332f6cad8c45f2d0b29e77e62323b226d39", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518636, "uuid": "b4d7c008-6832-469e-968d-98b0ab6cddb5", "comment": "Malware payload (Quakbot)", "value": "fd362ac9a5d0c4b8d8ef11576029a0e253270f7032b4db5e230480f91d61f4c0306688412be2b04bf4b88d60ee6328bb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518636, "uuid": "5be38797-94af-48bc-8520-de019e1cb8d1", "value": "T1C415BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518636, "uuid": "030ae8fa-40db-4e7c-bd94-b1b5c05d0d98", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518636, "uuid": "6427f96c-a6af-48f5-9320-7d599c5e2274", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518636, "uuid": "9e617ce9-3e8e-401d-a480-562937cf090b", "value": 941855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518636, "uuid": "ff15d2ff-7c0c-4b6f-9193-05750077b7ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518636, "uuid": "2cdf2565-f145-4003-8359-1573b91f28ee", "value": "7e7bfb9e743be81fed87222e08cb0aa1d69391cd93dc5321285a08b463b78b32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd125d4-a62d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647547703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547703, "uuid": "90c284e9-bf69-4bf1-8b1c-74c62283d7d7", "comment": "Malware payload", "value": "2e809cef8e292370c3942f37bda91d30", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547703, "uuid": "a18e9e51-8af8-4711-b05c-f5c29742206e", "comment": "Malware payload", "value": "7f055f033143c339064cc376894873f2e2c7554d97110ce4fc5f459d14efd0a9", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547703, "uuid": "1bda43dc-7ad4-4dd4-b3d8-ad314a1877df", "comment": "Malware payload", "value": "db54fd2457d1c7d50b837bd3eed2e789cab2ce10", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547703, "uuid": "da51b2b9-8525-4a76-b5cc-0ec3f0842f9b", "comment": "Malware payload", "value": "ba816153c8887630e1e4d163d56fd94da6622d392954c13989aeb72e9a333e49ea65649bf88baaf4b163f4825ce97ed8", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547703, "uuid": "41ef1f2e-9643-4b5e-80b5-adc66e19d0cf", "value": "T1BA853368068F40EEEB703432AE675583E88DF3FE45FE235D21D67345A91B17B806097A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547703, "uuid": "b8f249b7-8571-4930-aedf-b6e17a89559d", "value": "24576:8I29T51DUzPZ0Ubl4XU5AJxOdWOczxPD7PKKLLQdY5fJfJiTYptDZVlGj+JG8FXX:N2Rbch/l2i8/zxHP7L0M52YpxEKJTJRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647547703, "uuid": "42ffe026-456c-4407-88dd-5d81582d2e60", "value": 1817043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647547703, "uuid": "1d62bc9b-6fb0-4ea6-bbfd-ec33a94f3710", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547703, "uuid": "952361a2-a25c-419f-b881-b2a8552e028f", "value": "2-OFFER-WESMAN_1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7958b95-a63f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647555340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555340, "uuid": "6df604c9-de3a-46e4-9ba2-2ad623b5d326", "comment": "Malware payload", "value": "0e23302cffd4103d4e27ccf563a2b42b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555340, "uuid": "f25c982a-b2e5-4b68-9ec8-53781263b913", "comment": "Malware payload", "value": "7f56b046e4a91bb9fdf2b069321db8302585f12f37bc1a542098b54aeaa5b98d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555340, "uuid": "3aa863bb-4d9f-4b42-a5f2-7b6595ff32f0", "comment": "Malware payload", "value": "5f86f3d05b8256298a81596e1fbbea348f040f93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555340, "uuid": "665c1e03-ff14-4d8a-8d6a-a219a9d8447b", "comment": "Malware payload", "value": "3af9d60a417ab272460339cc734ce22ef95afc7f8bfbc0e791b0c3f85f27414d3303a61a330a4dbc159f1fdf2c053403", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555340, "uuid": "f498d87b-0f59-4b0d-b34d-ca4e2aa60341", "value": "T1AF059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555340, "uuid": "567ce9ec-363b-4956-a0f2-9b12d8b2d6c9", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555340, "uuid": "6852f980-10cf-4d36-a1c7-72e076220117", "value": "12288:V20BXOMcVzpWfmmnDDMX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDoX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647555340, "uuid": "773d18e5-90c1-49fb-8d88-0145fa42add4", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647555340, "uuid": "60554390-341c-4ef1-987c-53ded9c3b33d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555340, "uuid": "c2b594e1-e531-40ba-a544-385867ac1578", "value": "0e23302cffd4103d4e27ccf563a2b42b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a81a702-a62e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647547721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547721, "uuid": "8635c8b5-ef67-4574-a665-26820741602a", "comment": "Malware payload (Heodo)", "value": "ae09e5e84fcedbc66a5e801a186a282e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547721, "uuid": "3a2d5605-2b09-4950-84e9-b73242e6b6f5", "comment": "Malware payload (Heodo)", "value": "7fcd3b99a2be8816211f218c02e1a3fd333faf037b3bf30bdd04a958ce953398", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547721, "uuid": "bcb23dfa-a004-4369-a3c4-18326489f5d5", "comment": "Malware payload (Heodo)", "value": "7cad4e322dca00b6bdbde3ddb3373dadb23d484f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547721, "uuid": "f89d097e-997f-4438-9062-0da7fade9545", "comment": "Malware payload (Heodo)", "value": "95f6b40e5e84f010981cfee67ce1ab03fef933ff8a7de64790d3cd752ef3c35f444f502c728895ce9f15dfe960d37b24", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547721, "uuid": "6d218916-78aa-4cf1-bf99-dac4d56e19b1", "value": "T144A2BF3FD131DC29EB7B9C7C820980F5E60A1D46200769DD2C51F75D6AB26BB038B9AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547721, "uuid": "4742f2ed-fd6f-4e83-b2b6-6318375f162f", "value": "384:OHM0Vb1GNjDo4CGzPd6ZIwA1hKb5CzgObff9kC+xbX7qE7h:z0INfo4FLH2CBn9kC+xbLq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647547721, "uuid": "7c50e193-53c6-4166-9910-632279879211", "value": 21440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647547721, "uuid": "4ad68b7c-d8f4-4526-8a26-957604d96273", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547721, "uuid": "818b889d-3507-4941-9403-519cd3130e05", "value": "lista_9.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d531909c-a60c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647533458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533458, "uuid": "195351f2-35a0-43b2-954c-acab250c0fe5", "comment": "Malware payload (Mirai)", "value": "6bb210c0cffb8a6a9523013d88e3dd13", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533458, "uuid": "c1d2bf71-c458-4785-a2c8-53cd33727836", "comment": "Malware payload (Mirai)", "value": "80119b12d76f0f08a9f5b274d1fb80e7fff0f3f0d971b599b9c587a55dc77b88", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533458, "uuid": "7778e16d-f1f0-4974-843a-43900025f204", "comment": "Malware payload (Mirai)", "value": "db9f56922e44285f9f00212f330900bcabec77ad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533458, "uuid": "d9e6c9ee-99ae-4553-93d9-370d3c26a31f", "comment": "Malware payload (Mirai)", "value": "3018a9983363e02863eb75b1fe6cb7fa15b8b4f4e77783993807827bcdfc919d80f16bc04cce22eb94a68d0e71090327", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533458, "uuid": "14109116-58da-41f1-a40a-6699fba8334a", "value": "T15943E817BF554D6BE46BCC3B5FAB0F05289CE48721687B362970D028B14644B49EFEE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533458, "uuid": "7685c311-089a-410e-9562-bdc2c8fa6c7a", "value": "768:k2x9QJjU05CUo6Pt25ipjePoenL+6XXiihplOVSNlUZy9W1pocPXxlmaoC9BPm:+G/UoK2cJWokLjFljlUA0scPXDmaNPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647533458, "uuid": "d9094dd7-1a09-4628-afb6-9f1c0400632e", "value": 56460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647533458, "uuid": "55ab1606-c661-4084-857e-3d405d533460", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533458, "uuid": "f16609db-49b2-464c-aa55-f1d8ab63945b", "value": "mpsl-20220317-1610", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c118c6-a603-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647529277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529277, "uuid": "b1313392-ccab-4f31-acd2-d23fb1a494fa", "comment": "Malware payload", "value": "d9ff3bb2d0a1345229ee2f302b728bb5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529277, "uuid": "0c06de4a-bf40-4b8e-845f-41fac9f736aa", "comment": "Malware payload", "value": "80f54004ee33704a308c30ee282b512abbd12dcc20766d9a23def57fe2a6c1ab", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529277, "uuid": "452a5d15-d6b4-4327-9364-101bffe8cb8e", "comment": "Malware payload", "value": "6d0160cda2b992ff340ddd6aeecd319d5e532244", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529277, "uuid": "ebf508d8-170c-4c29-babd-22851e2f1268", "comment": "Malware payload", "value": "1de3f686f3bfae14130e8ea68bba876f9b5ac6f9757222daf13772db0ebe8b6128386c58853a8904752293f9e5ac6ad3", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529277, "uuid": "04b91348-2f5f-4174-a7ca-85ef0b0cc091", "value": "T1B3552303FB119A52EE772433C59B1323913BBD896E921E073BCCB6057BBA395671B508", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529277, "uuid": "8794eda6-65a9-4457-a15d-74f50f28eb99", "value": "24576:IrRfj7mX9LIUHlgx2qVAslH/llRBZzVjaC37LnhwRp2vScYMYifWveIKdrImJWW3:yRr7mNLHe8qPfllRBZhjaCvhwRp2vSBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647529277, "uuid": "943918cb-34ab-4b5b-8440-ee525dded79a", "value": 1398905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647529277, "uuid": "6685797a-be4e-4ba1-a038-3860d409ea5c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529277, "uuid": "178b9936-a2f1-4ea6-8c57-2482547ab99e", "value": "80f54004ee33704a308c30ee282b512abbd12dcc20766d9a23def57fe2a6c1ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8343bda8-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "a83022f1-ac97-44c0-be0e-dd474ca720f7", "comment": "Malware payload", "value": "a78a2d33f350278a73746a57eb4fe536", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "27b8258e-53ef-4fe3-8f32-afe0e3011e49", "comment": "Malware payload", "value": "81f6147ab8add9af4fc94d661ff926e2adc0ecee15436b489a618eb8d03c17ff", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "6cc52c5b-a909-4c1d-8b83-70eeff15cc5f", "comment": "Malware payload", "value": "a561555f5de7804527643f23b7382180813172e0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "d5b8fed9-64c5-4b85-b87a-ad35799ea616", "comment": "Malware payload", "value": "a833e4e1102940f4903a839d64080350a33c925858e0a08eb0044fc93b93ecf65ca1a2bb7a3bb3e3b7ccf8f9fa43d546", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "4484fe9f-52af-4d53-ba90-428dfd8e9ee6", "value": "T181059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "c7746890-cddd-4283-bb6a-0f40c099e82a", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "b240940e-c816-4367-b72a-2aca05301709", "value": "12288:V20BXOMcVzpWfmmnDDwX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDkX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553507, "uuid": "3ac876ff-2f2a-40af-98f3-625eef73757c", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553507, "uuid": "67d5e4ec-e0c0-4fbc-8da1-783d810ef0a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "fbd426bd-1e7c-47f5-86b6-9bf238fa790f", "value": "emotet_exe_e5_81f6147ab8add9af4fc94d661ff926e2adc0ecee15436b489a618eb8d03c17ff_2022-03-17__214456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18825327-a64d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647561059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561059, "uuid": "aa3c336f-88ee-4876-a565-f9d6c55697c1", "comment": "Malware payload", "value": "0b6703ffbff6eaa9cdff7576064ebf2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561059, "uuid": "5d94f1aa-772d-4ec8-baaa-bc0373a4e8b3", "comment": "Malware payload", "value": "82846009c92bb95c04f42724f0bf6e40e2e0d6b2784937e585864583b5bdc273", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561059, "uuid": "62fe8c50-b8f9-46ca-b6a0-716aefcb274b", "comment": "Malware payload", "value": "576f23fad3dc93b872d7b6c617f0905b81a8348e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561059, "uuid": "0296fb80-2003-42cf-8388-4ba4865a37e1", "comment": "Malware payload", "value": "d899812c8c6fd0bbde6a251bd1686e224983e20d3b2853d0f25663383c194d8aa55fc91c64fbb96f83b0c3e337d237e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561059, "uuid": "5af62a95-e180-4e6f-a365-fbdc96da4b41", "value": "T1A23302C5E86916A2D6256A79296214C00F3C7C7C0066A6BB2B18DEFD8B31BF12530FD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561059, "uuid": "1c0efeba-6da3-49c0-a8e2-41ebdf194997", "value": "1536:WIJ17HUxZdo7wS2vZTK5PnIu/TUZy9V95QjkprjYgPSnUW5gtz8:F1oho7w1ZTgAubUZy9pQjmj4UWmtz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647561059, "uuid": "7b72cb34-3833-436a-bf4b-e6437102e1cd", "value": 54256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647561059, "uuid": "abb3833d-94f5-4eeb-a3f2-dc05dbc420f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561059, "uuid": "d356a64f-67a9-4e79-8844-c7ad55e6ad67", "value": "0b6703ffbff6eaa9cdff7576064ebf2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ede8af8-a604-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647529797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529797, "uuid": "47664482-eeca-4c75-be66-c48d74eb21e2", "comment": "Malware payload", "value": "0016d6917c6c210e59db5036afba4bf5", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529797, "uuid": "04d8acd6-d31d-49de-b533-813d503466dc", "comment": "Malware payload", "value": "837de7dfba48982ef050a2ae57d96daea069de8f87f63e2d34c4035ec7281a28", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529797, "uuid": "ec169c5f-75d1-48b9-8764-3fb886497d54", "comment": "Malware payload", "value": "ebf7a52a37dc9ff2905a1cdc1eebf58f1ae8f44a", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529797, "uuid": "b1bcea87-86e4-4f94-8f7a-26debec99ce9", "comment": "Malware payload", "value": "98e84e7c16603c20498723ce53da1a9715fa17ff4b010379d839103bbd4a0eb47a071547dd294c0cb4f47b944fe43c30", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529797, "uuid": "a7b0e567-dbb6-41b9-9526-6f0566198e99", "value": "T18EA2AF3ED221E818D67B987C830580F6E70B2C561007A9ED2D51F25D66726F7138FABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529797, "uuid": "4291fe36-4dbb-4096-8ef2-344d0ba3e05c", "value": "384:mQZAVb1GNjJITo4CGzPd6ZIwVKb5CzgObff9kC+xbX7zL0crX:mTINqTo4FL3CBn9kC+xbLHjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647529797, "uuid": "35c501a6-ed38-4222-8c7f-327e3544a781", "value": 21461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647529797, "uuid": "ec3e40d6-2af1-45b8-8bab-e6052b4746ea", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529797, "uuid": "62975450-fea9-4aa7-87b9-4b364da690a1", "value": "SCAN459_0001.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f901679-a5ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647527704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647527704, "uuid": "7e7fbc49-78cb-4414-8959-df0249633a03", "comment": "Malware payload (Heodo)", "value": "3ad5159b60a13fd45081b4a1d10e2a95", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647527704, "uuid": "4e6131a1-392d-4db8-9c1d-a599d13443e5", "comment": "Malware payload (Heodo)", "value": "84ad53ab801329181d59b139709c0b92b52cc5e097373ac9c347cee936bbb571", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647527704, "uuid": "e2cefe81-fd03-406e-af34-5b8824a02b14", "comment": "Malware payload (Heodo)", "value": "d896e0b6ea68cc08efbfddd81c4e7c7e1fbfde13", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647527704, "uuid": "4a78ef56-d9f8-4d53-a9f4-15b0a119d19e", "comment": "Malware payload (Heodo)", "value": "728fff1c1f755687da2fc1ef0cbded049ad4f04b79fe46420f8093f75b12caf13ba2cc07356de2ad061c6f9238e9131c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647527704, "uuid": "b2b612fe-18e7-435d-950e-22921be4704e", "value": "T122A2AF3ED221E818D67B987C830580F6E70B2C561007A9ED2D51F25D66726F7138FABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647527704, "uuid": "1ce178da-5372-490f-a29b-6d6b4c4768bc", "value": "384:yQZAVb1GNjJITo4CGzPd6ZIwVKb5CzgObff9kC+xbX7zL0crX:yTINqTo4FL3CBn9kC+xbLHjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647527704, "uuid": "a9168e2a-2346-490c-af87-05f6cc19979f", "value": 21461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647527704, "uuid": "dfe691a3-be12-4c5f-bded-b1631ffae960", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647527704, "uuid": "88f6ea70-e24b-4914-959d-4e7b42bffa6d", "value": "2022OU000059689.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7799ecc0-a5df-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513974, "uuid": "56f3a860-7c53-4e07-bc6c-fc62328cdf52", "comment": "Malware payload (Heodo)", "value": "1844f552e682034115ddc1b79a7337a9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513974, "uuid": "5aabb767-869c-452e-b1e8-3ece62d2ee36", "comment": "Malware payload (Heodo)", "value": "84add8bfa098fecf59ca318a9f22b227fcb6335e551dcf16c2e5de5b690b4e44", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513974, "uuid": "73882cb9-a7cc-4b2a-bf50-132d09ea84fe", "comment": "Malware payload (Heodo)", "value": "9e163f071c2e3276899e335caf371e7be92c9bb6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513974, "uuid": "9dcd18a3-6bcd-4413-a94d-5fb746ca302b", "comment": "Malware payload (Heodo)", "value": "a94c3e0515ca0bd5e912b0a6c260c0afc95c79b495da48e2c49ff47becc27f3ffa9323d500e9f0fff4ca646d5fee60c2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513974, "uuid": "b02043b4-b8a4-48fe-9847-8ae27635b3c8", "value": "T1E0058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513974, "uuid": "acaa6f44-e938-4012-b358-d45320697b6d", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513974, "uuid": "8329f786-d1bc-4d42-9c21-d7c7643eb817", "value": "12288:Wvz1CLJyyvmMLSrBgF4ruGbPlVpqb+DlYzv:WJCLJyybLqBo4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513974, "uuid": "c061fa01-cc71-4fae-bd45-b376395bbeab", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513974, "uuid": "7ceb348d-1487-4f73-8de0-df60133c2c65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513974, "uuid": "14892f8e-00cc-40f8-8d17-2b47e6e9e3e2", "value": "emotet_exe_e5_84add8bfa098fecf59ca318a9f22b227fcb6335e551dcf16c2e5de5b690b4e44_2022-03-17__104609.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85609374-a614-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647536760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536760, "uuid": "2f4b0ba5-6f27-425a-abf4-e156e5a52505", "comment": "Malware payload (RedLineStealer)", "value": "7a59e3ceb314d6f22bd5ff4088dd45fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536760, "uuid": "f091df16-1c83-4461-971f-2e32c0af4920", "comment": "Malware payload (RedLineStealer)", "value": "84fe5eec5cae6c7d05f4d1feae203ab73de01a9dc445836fca4cda4d496e4357", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536760, "uuid": "68265cac-9ef6-423b-ac0a-d21e2a942367", "comment": "Malware payload (RedLineStealer)", "value": "6ec14afd34023d9ee85f0185f688835dd59ec970", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536760, "uuid": "7b5db847-9666-4f9a-985f-98fce7614a2e", "comment": "Malware payload (RedLineStealer)", "value": "6d68cb02dbb4ae82e4575dbff149a5120b666892f8a333329139116dcca6a0b4aeda16b055210d86b8028dd892fbd01b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536760, "uuid": "d5b7b4a5-8b69-4778-9e9d-1af4e15d1297", "value": "T130A35D20679C9F19EAFD1B74B4B2012043F1E08A9091FB4B4DC1A4E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536760, "uuid": "919482bc-079e-4f34-ab4b-ac81bd9dbd43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536760, "uuid": "74474094-a91d-486c-b60a-7ab9fab923d2", "value": "1536:9qsINqLGlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2z3teulgS6pY:rAMOY3+zi0ZbYe1g0ujyzd/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647536760, "uuid": "04851185-33c5-406a-95e0-74462421d838", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647536760, "uuid": "ce56eef0-1381-4ae7-a7cf-18e2517876d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536760, "uuid": "8c77e5f8-5873-4abf-b07c-6d0ade75556f", "value": "61701813.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a10dc0-a5ed-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1647520084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520084, "uuid": "3d4244f0-f1ea-42db-8441-b18f1b9786e2", "comment": "Malware payload (Gozi)", "value": "1e734b20e60e79d2d04b00ff54c0d991", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520084, "uuid": "31d34411-0714-4d7f-a57f-d4191fea8564", "comment": "Malware payload (Gozi)", "value": "857cf00c7268f598e89a94462fb82895ef220926078466917356f7b2e46ee94b", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520084, "uuid": "04053677-d806-41b5-a694-75d10f70772e", "comment": "Malware payload (Gozi)", "value": "f9a829717a09810a8058b4533bccb981910712d5", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520084, "uuid": "e944bb18-18dc-4967-b9f1-92f57c3b04b2", "comment": "Malware payload (Gozi)", "value": "cd4d20f35e23be3742d2cc9618db04044b10a9b4fd13e551f711db897bccfca53d63352b85bb2e355f02663cbe73401b", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520084, "uuid": "d55c6707-3899-4514-a4c3-43f9b28675fa", "value": "T112225C2D7AE7D448431B60FBE8BA1E1B9120CFD5CFE680D4B10957812E6CF9A19206DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520084, "uuid": "4b77555d-7acc-406b-adda-72a13a3fe59b", "value": "192:1YX1viAMZeVnYKcwq16vjIpD5vCHG5ndi5pbus1BvjY+orvQa:1YXRJY7R4jIfOLbuujArN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647520084, "uuid": "3ee132d9-5c3f-423a-b87b-b5538de958b1", "value": 10332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647520084, "uuid": "d6912745-2503-4385-a450-cdd1689fefd2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520084, "uuid": "fceb1d06-f18d-4704-b67c-8fa6288fa59a", "value": "comun197.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de04c728-a5cc-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647505985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647505985, "uuid": "416a8c0e-a15b-4729-884a-f4560d9bd3c9", "comment": "Malware payload (Formbook)", "value": "0da62563c65f103dc4b38d5e9ddae569", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647505985, "uuid": "4ba3bb5f-0419-4a46-9278-fc54c20b167d", "comment": "Malware payload (Formbook)", "value": "8609b523be1b22061f1c01a8587f04874836d490196cfa09e8c1eed005f298a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647505985, "uuid": "745884ae-c8b0-4d43-9a55-ed54e0183ba3", "comment": "Malware payload (Formbook)", "value": "95b0d5688c53f0ec35cb760a9939d9abed7151ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647505985, "uuid": "51f71909-22c6-4100-8ebd-e31a61616d25", "comment": "Malware payload (Formbook)", "value": "fb3773e460023dac0ddf2375f7a2ca02f35bb726d713246541925b335bcd7784c7ea10135f222f2d626e76da3fe7aea6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647505985, "uuid": "1b79a88b-d3e2-405c-8674-2478cf8b4c8f", "value": "T18405DF983650B5DFC857C9768D981D60EA20B9BB530FD343A09722EDAE0E59BDF011F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647505985, "uuid": "f4dc2847-8f00-4a1d-88b5-fd7d6a5b8284", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647505985, "uuid": "6ed3ba6e-eef1-4f4b-a7fc-a761a7cb7ee9", "value": "12288:W40F7IoVheICJbtIBbpcsdi3wUZF8brx3/Zxr+mlGQE7furb8ZwpjT4mJfJE8hKK:WhFaIc2BNOwi2d3/E7e4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647505985, "uuid": "78884fb3-efb6-4f8e-94ed-07eb79321511", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647505985, "uuid": "87042d06-9261-482f-b69f-3275cdb9c21e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647505985, "uuid": "3d0dcf69-9450-4408-81e3-34ac8f53d497", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64cc6aa7-a606-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647530693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647530693, "uuid": "c14fd188-040d-4565-99d7-4934e57f4350", "comment": "Malware payload (Formbook)", "value": "7e99011bfd02e5681a7fb6a526872a58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647530693, "uuid": "e28c2411-5e30-4fb9-8405-429bfdb9c4f4", "comment": "Malware payload (Formbook)", "value": "8693f77ce4f72e78f7635949a2cf836c06779be7cc07909e5d134d6d3089ed43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647530693, "uuid": "dce4c6e7-720a-45b2-929c-ee7af916f7d6", "comment": "Malware payload (Formbook)", "value": "c15a6db265720b0f9f20e5011a40cc9fa5dc745f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647530693, "uuid": "f76e14dc-2839-4a50-a31d-725321106608", "comment": "Malware payload (Formbook)", "value": "00182311c74decf875c2cf61e5f82480bba1aedcea5837c4f971a82129cea0ab6882cd7aa9c4a83e13758cd726ffe1de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647530693, "uuid": "eea08b92-da6e-445e-aae8-5c10d291ead4", "value": "T115C48B7E156D6377CA7BD7398650042AF690D1EF7802AC19EE931B810D231CA7FC662E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647530693, "uuid": "1e0a7955-cc4c-48e9-b967-ed8fc0adeab9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647530693, "uuid": "94cd950b-72cc-4108-a780-859d52640cb4", "value": "12288:ykyjI1931ueZXVY+L7BSruOdiaHn2TbECHPbZ:yS19ZZlaub42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647530693, "uuid": "5283713e-9588-44f0-8f01-5d36c9f47dce", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647530693, "uuid": "c390443d-49f4-4e6d-83bb-2ad4d03d9f71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647530693, "uuid": "6867878d-4a41-4dd6-aafb-5457d6aa369a", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b07462a-a615-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647537173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "cabf7542-a23f-40ae-b372-0bf9207a655c", "comment": "Malware payload", "value": "e16e812ef76c0854a68ff29c36dcf9c4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "a0abd78c-67b9-40c6-b5bc-a2d233cd947c", "comment": "Malware payload", "value": "86c60e90f3a3f38cbce1080d4c34615684f305f10a096a0338f09b37436d4977", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "c7262e8e-ce4e-443d-8123-c388a27252eb", "comment": "Malware payload", "value": "a89a97bbdf18094ce40ebd17d2bcdc6929c27e78", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "15100713-86e0-4146-9227-1851b3f4997c", "comment": "Malware payload", "value": "fdb09e4fcad9380497c7cb21b2c8b400e32038341490e9a33595a02df4533b7633f813d0e497d33518784277c6de2d26", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "466359b9-b667-4a43-af12-686d49aa538b", "value": "T14F057C5037818077E7AA58740601BA783D797BE38BBF72924E80957DEE704C3C768B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "2095eca7-e52a-43bf-bdab-529990f609fd", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "955ccc36-0172-4c91-ad8e-892ff68e813f", "value": "24576:xJjq8sc5JGxNNNNI+++++h3/UQUQiNj5URW2AeF+99V3kW5Qk45:xJq8s4uNNNNI+++++h3/UQUQUv2AeEB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647537173, "uuid": "4f76389c-dd6f-487d-80b8-c3e3017abb84", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647537173, "uuid": "fc72032d-aa6d-4e06-a363-7c977876d383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "2072e00d-51be-47a6-9e26-5d9d76e143a6", "value": "emotet_exe_e4_86c60e90f3a3f38cbce1080d4c34615684f305f10a096a0338f09b37436d4977_2022-03-17__171246.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9f53af-a611-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647535570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535570, "uuid": "d013a79b-0509-45ed-9e20-4268a21ac97e", "comment": "Malware payload (RedLineStealer)", "value": "b12e69fa72f06b3cf401f0eab134cdcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535570, "uuid": "c79eac0a-d607-438d-8e4d-ed6c9bcd5445", "comment": "Malware payload (RedLineStealer)", "value": "86de051a211138102e973a043b1228c844fd4fc3dbe0a34ad347cea40c5a0591", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535570, "uuid": "89b8197a-3129-42d4-b535-302d9d7e1b67", "comment": "Malware payload (RedLineStealer)", "value": "9a3cbdd3cfa19218af62d6fd8465936d4267aa6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535570, "uuid": "cf4e8768-3388-4da9-82dc-33b6dd4cfecb", "comment": "Malware payload (RedLineStealer)", "value": "b2de09490e7a0678feeb11ebc72129ffe846eb682917e50ec2b8a02761b5536ca5e34aaaa221fb5de276edabf746ecd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535570, "uuid": "4fb2c39a-7262-447b-8e73-1394c9fd6cc9", "value": "T145A35CA973CD4A25F5FE4F7468B1115543F0E1A2AC02E79E4EC5E0ED1D26B80EA12BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535570, "uuid": "40956642-0e43-4e26-933e-730fc0b1ef88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535570, "uuid": "85d5b7bf-4dda-4615-bd28-d01f89358883", "value": "1536:t0DUkCrnG2IdANcZFR86yl3TKhW+9tYJJJJJJJJJJJJJJJJJJJJJJJRJJJJJJJJj:tACrnGmy45TwUB5wvOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647535570, "uuid": "b6edd676-b6af-4528-b452-b817d32d8a63", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647535570, "uuid": "5f64194c-70e7-4cd7-9562-84d3ac0f2c9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535570, "uuid": "b37911db-3ef0-425c-9369-10f86a07afe3", "value": "b12e69fa72f06b3cf401f0eab134cdcf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db200f4-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518601, "uuid": "8f6ba39f-4a3b-4b66-a148-2834a04d0b77", "comment": "Malware payload (Quakbot)", "value": "9166be4f893fd65147e3a93e820799bf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518601, "uuid": "853aedd6-e5c8-4a77-81a5-c18f199d0f46", "comment": "Malware payload (Quakbot)", "value": "87ab49174b3cbc5ed441d8b499897890e219b5fe2f936c66d486b2e9b967ac7b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518601, "uuid": "64a1a55c-bd24-4bca-8e2f-747e630c8598", "comment": "Malware payload (Quakbot)", "value": "7d74628d4934d7eb4901feeedbd4f9bf32201845", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518601, "uuid": "27249fdc-3214-4869-972a-5f909b3e0130", "comment": "Malware payload (Quakbot)", "value": "554a95b56d4ac985fb9da415df45ab493abcd4d00391ada72b4bfd827239db057ae0cda055ca43ce77211aeb8496962d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518601, "uuid": "77767436-945e-4f97-a1f7-fb3f69710960", "value": "T16A15BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518601, "uuid": "37ab2a8b-e267-42ae-b35c-1731b25f1542", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518601, "uuid": "60460c6f-62f3-4cd7-bcb5-9dd7a2368460", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518601, "uuid": "bbd95a27-5f9f-4c7d-8852-59ee3279a1fe", "value": 944600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518601, "uuid": "556fb9cc-d02d-4fdb-a834-36919cf63be0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518601, "uuid": "c39eb26c-704a-4ddc-9c4b-f3998b1fb443", "value": "87ab49174b3cbc5ed441d8b499897890e219b5fe2f936c66d486b2e9b967ac7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f325e12-a626-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647544293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544293, "uuid": "60b2a490-a48b-4a37-905f-2b5d4871586d", "comment": "Malware payload", "value": "fdee2525cce03fd52d2dcde4719b6864", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544293, "uuid": "769f10de-d509-4efc-9112-fbd968a37c48", "comment": "Malware payload", "value": "87ec228b1ac046ce7e041277da09bed496ce0ebf12a0285638838b3af74c105e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544293, "uuid": "a156d4cd-aa73-44ed-8786-e2215e90e495", "comment": "Malware payload", "value": "215ca464ec459b9f3d229541e464a464a5ea084b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544293, "uuid": "4eb97b8a-a941-452c-9211-90dce748688a", "comment": "Malware payload", "value": "21e4ff0ee3d03405c65aad618b5869c4f74c3e75760f6deed2ccf5b316b810c81ec8bba1c3fa0ba3635c8ff659d38edd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544293, "uuid": "6457040a-376c-49c8-9f26-c17c4d711da5", "value": "T190C42B017896603CDFDA363601F7EB2531E75CB0677CB52E6EC168EC9B2628A051D63E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544293, "uuid": "f3e966d3-3b33-4695-8487-564653e851c1", "value": "fe91b35dbbcef6d3f3836ad3e8b836df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544293, "uuid": "46dfdb84-117b-4486-8a19-8e4d6e01cdfc", "value": "6144:xe4HnxyzcUzcUin5jBd4hp3CBj6O7O7OOuw/RRRI7E7E7E7Z94kx8888rLCkxEZp:56Kv+tEgqHdov6eimJEeTN+sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647544293, "uuid": "afb4dbce-a2a5-4595-8b6c-6b9db0d8a21c", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647544293, "uuid": "e22b2fb0-4969-4742-adb8-4e976b67976b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544293, "uuid": "354657bd-9c0a-4bbe-8db2-dcd6d0b931d6", "value": "fdee2525cce03fd52d2dcde4719b6864", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d056a3c-a611-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647535324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535324, "uuid": "ea2bc42f-3e20-40af-bc12-2b9b6d9821b0", "comment": "Malware payload (Quakbot)", "value": "be6231746613e0b90a65fac14e349b99", "object_relation": "md5", "Tag": [ { "name": "gml01", "colour": "#39A518", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535324, "uuid": "9ab11ad8-68c8-4de3-8cc6-5f0577936209", "comment": "Malware payload (Quakbot)", "value": "8827f753e479eba9624719b5284bd5513eb7f92f68666f3247c0e0fbf88e873d", "object_relation": "sha256", "Tag": [ { "name": "gml01", "colour": "#39A518", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535324, "uuid": "f7ff5947-6fc0-4b61-968c-771ccc32c79a", "comment": "Malware payload (Quakbot)", "value": "6b62ef75a9e48bc4c8c18fa78c03f26565d5ce93", "object_relation": "sha1", "Tag": [ { "name": "gml01", "colour": "#39A518", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535324, "uuid": "6a1686b6-3392-4525-854e-73c4ba420980", "comment": "Malware payload (Quakbot)", "value": "c647655025aa78a7236c08cdf579016fb52dcf32bb9265e4256e4163c04a1be593578282d1874a6b327da727a5deb7ba", "object_relation": "sha3-384", "Tag": [ { "name": "gml01", "colour": "#39A518", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535324, "uuid": "b1c3040a-d1dc-485d-b885-edd344526429", "value": "T1B244F12D651EAD8AD37D503DC30408E1AB0D12516412F83E5DE8FA045EF26EB2BDDEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535324, "uuid": "40836769-f0e9-407c-9cd6-85b13e1deb3b", "value": "6144:R2AHMO0fO4MnoG46qVlzDF59IiPEJe++uYYw3ml6Uf70Uh:B4gcLCiMJeOSMZ70Uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647535324, "uuid": "337516ff-9d79-433d-b896-54c9267f448d", "value": 268632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647535324, "uuid": "48a53ad7-c58a-42d3-af16-4b2123e470ee", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535324, "uuid": "5ff031e0-2bdb-4975-bdb9-ae1a1a5baaf1", "value": "attachment-969561322.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d80fa3f-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518547, "uuid": "0a80ce4d-3246-49c6-b50f-ecfec3dc79ca", "comment": "Malware payload (Quakbot)", "value": "151d6a7d0db9505c579551b0f892b0b5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518547, "uuid": "eefc885c-cf82-45eb-9354-cbbe622cd7c4", "comment": "Malware payload (Quakbot)", "value": "885db6c05939665d231b45573a5e0ece0a0334a58c7c26132eea4075b0db85aa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518547, "uuid": "88337ffc-1d13-445e-832f-12b84d5c2129", "comment": "Malware payload (Quakbot)", "value": "419c963f83e8b7d69e49a3705b716ab1ace5a513", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518547, "uuid": "4d7bf25c-c4d2-4d1a-ab96-8f85e286ce77", "comment": "Malware payload (Quakbot)", "value": "3f387f2e2d284a0b238c46f4ace2542c74cb7b66756dab2f1412b6cf41485eca62d039b26f2f316b8fb56bcc6f014ab9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518547, "uuid": "a8bf7994-f6a9-4f27-9972-072785e775c7", "value": "T14515BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518547, "uuid": "9b085426-e378-48c6-ba5f-42e8cf29432f", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518547, "uuid": "a8acd771-c0d8-4e2b-af5f-4d56ee313461", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518547, "uuid": "6b51c6cf-0934-445b-b093-e8a429453c8f", "value": 951674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518547, "uuid": "b627c022-8526-4279-8ffb-ef42e914f915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518547, "uuid": "84b5e294-90f3-4bac-8295-c1e5b1f68396", "value": "885db6c05939665d231b45573a5e0ece0a0334a58c7c26132eea4075b0db85aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7f13d3-a5bc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647498787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498787, "uuid": "6a8ae7b1-16b3-4078-80f8-7215f5cefc55", "comment": "Malware payload", "value": "7950b0a91445a72960e1ac8999711ac1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498787, "uuid": "534d3356-da96-41d4-bf2d-42a2e9183f35", "comment": "Malware payload", "value": "88f940a96bc733ec0d9c95537ab716b82acab5f3a90b222f7533ff7ea00e3f97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498787, "uuid": "093dd85b-50df-4297-af96-c3c9f9bbc858", "comment": "Malware payload", "value": "0b7bc7ab6e20fcefc597f15ed4f9e27a0d755de1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498787, "uuid": "940792ad-ef33-4ed7-8f72-c853cccf840b", "comment": "Malware payload", "value": "29d50b3f9c7227593e2a1f3f5acbe21ab715acab2f081e65f76b2095109eda199ae1548a7d237fba7dc9469978146009", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498787, "uuid": "e8ed9fda-b316-43be-9053-5aa62f56429b", "value": "T12EA63304A3401CECF1A1503275A44526D53678368720D9CF6B68A23A9FB7FE5BDBEF90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498787, "uuid": "dfb19532-1bb5-45c5-b612-53efb24e4a3b", "value": "c5640c7a22008f949f9bc94a27623f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498787, "uuid": "4182b066-2fa6-469d-95d6-55eaf7fa6816", "value": "196608:v9l4XkYUGx7/ICteEroXxWVfEqlbkkwR7VTEiwYgFfMat8kmVUbDXQje8cZQ:b0XUU/InEroXgfEqirRRozYgt/t8kpbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647498787, "uuid": "93773c04-454e-409a-b4d9-cfef044276df", "value": 9705905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647498787, "uuid": "d281e9c1-c1ec-4ceb-8688-cfadd7890488", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498787, "uuid": "7eea5e68-31b2-4807-bb9b-1c16c64bbdd2", "value": "33295704.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e62968e-a620-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647541742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541742, "uuid": "17ff4a79-b878-4425-8bbf-a9d44030987d", "comment": "Malware payload", "value": "c628fae4dfb55f945d2afc849b49a2c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541742, "uuid": "0c9c59bf-1e24-41d5-81a6-272d593f2551", "comment": "Malware payload", "value": "890b815bbe901a87b5d3f983f95d4ce5d072a4c1440650884069d2d4d950564c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541742, "uuid": "aa59ca14-9e9d-4738-84d5-8e40cd2ab9c1", "comment": "Malware payload", "value": "8b9ef167d154e1eeced16a8e7717c6dd69ccae33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541742, "uuid": "c972399d-9675-4ba2-92f9-40a09df372fd", "comment": "Malware payload", "value": "fd568f260c66aff553c741f0136bb498c47c83d07a5fbc41649df7e5c17dec31e95713ff931018f161a6e974b2dc4a7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541742, "uuid": "4bc805a0-18cf-45fc-8044-2346484c89d3", "value": "T1B9058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90117EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541742, "uuid": "29175163-779b-4a63-a387-b8a1ec4326d1", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541742, "uuid": "51773b98-d6c5-42e2-80e0-deb3116e0534", "value": "12288:Wvz1CLJyyvmMLSrBga4ruGbPlVpqb+DlYzv:WJCLJyybLqBj4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647541742, "uuid": "55db6156-ac43-4eab-b8db-f57610dd3907", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647541742, "uuid": "a17f294e-074e-466b-873c-294282e5738f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541742, "uuid": "d929f673-651c-4e17-948a-68ce03a32bd2", "value": "c628fae4dfb55f945d2afc849b49a2c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43981ec-a63f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647555334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555334, "uuid": "d0dcde66-8bb9-498a-b0bd-2d46c04ae244", "comment": "Malware payload", "value": "be78b976cb3275018fd674670c356c69", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555334, "uuid": "7266062b-5a92-43b1-bf7d-e04f9ee71651", "comment": "Malware payload", "value": "8a18ce8b1925176b568acf8c7aefc1003797fc63d6e814529dc6d8d21bc2515e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555334, "uuid": "f05b6140-f5c5-4d68-a060-040af809fe6d", "comment": "Malware payload", "value": "0b25f92a4f7965640790b8fbd78a1050dccf700b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555334, "uuid": "66dd22db-a637-4ad9-9306-a15bd9e1f1eb", "comment": "Malware payload", "value": "3f9bc4167299bb946e45247f68374f66e2e568e3a86f0e02c9e3c2b70d767f2319a16ac06b6175d29bd55a1d8d2c7f20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555334, "uuid": "51182b38-5ef0-471d-af31-733b6be494d6", "value": "T17F059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555334, "uuid": "e692cd37-5ad9-4ef1-bf65-ed57d932dbed", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555334, "uuid": "08f107e8-5385-49b7-9a6b-4f5be06c3910", "value": "12288:V20BXOMcVzpWfmmnDDiX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDeX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647555334, "uuid": "f273c2e3-1c42-4310-b657-339d289b90b7", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647555334, "uuid": "911ff15f-20a5-412f-bf98-cd1a3d25940e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555334, "uuid": "902ac4f8-3e25-4faa-8762-ecaf31944155", "value": "be78b976cb3275018fd674670c356c69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e37f22c-a5d5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647509717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509717, "uuid": "14e06493-b231-4b31-b93c-42b6dd08e6b8", "comment": "Malware payload (Heodo)", "value": "3c0705fb57e8ceafa47cfc1b49f49d14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509717, "uuid": "31f59229-ed6e-4c55-90ab-ba3de3d79529", "comment": "Malware payload (Heodo)", "value": "8b50b9c59c8398e98cff65cfee8791679e9c3ee7ba621ed3dad869f2aefa13fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509717, "uuid": "20ef791b-7912-47ae-b761-ec9f996d1fac", "comment": "Malware payload (Heodo)", "value": "6cd13f06f028684a1597115f08afa663d0ac10e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509717, "uuid": "6958bcce-4c27-4c18-b114-b961dec7b9f8", "comment": "Malware payload (Heodo)", "value": "7f2fd6ac1e49b736bdc41425e3227e2a402ef1877ccd35829746b8e163bcdd85bd569cf6880fabdcf841fe3e22c75ac8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509717, "uuid": "c893e7cb-6c5c-40c7-a711-6d7303298297", "value": "T144059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509717, "uuid": "5f00ba29-79ab-47d5-a8ae-073eac1cf4a0", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509717, "uuid": "855851b4-dd27-485f-b918-f482ab671549", "value": "12288:KVHML2QJe6XxhqCWXQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqvQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647509717, "uuid": "f33cb58e-ef24-445b-91b1-32fe888db7de", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647509717, "uuid": "97971b54-c89b-4922-a6af-cce0f2d8547c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509717, "uuid": "e25226f7-6d4f-4c7d-8c26-9e8c06db94d5", "value": "3c0705fb57e8ceafa47cfc1b49f49d14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c44232-a5db-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647512332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647512332, "uuid": "e212f4c0-ba3d-46ce-9383-d8d37f9f6602", "comment": "Malware payload (Heodo)", "value": "fc34c9d4896558c5e67687d6ee20e23e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647512332, "uuid": "aa8f71b4-90d3-4c85-b8a3-668cd11ec5f4", "comment": "Malware payload (Heodo)", "value": "8c124b17795c075760073fe66c20f615b08ff06479fce87f7834eb7d63ffc85e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647512332, "uuid": "76ff8a80-d0f6-44a9-999b-880fc3766f04", "comment": "Malware payload (Heodo)", "value": "7189ec9962d57a98aa6347eda6b60e18b92d438c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647512332, "uuid": "371484b1-305b-44a6-97d6-017523d30d59", "comment": "Malware payload (Heodo)", "value": "fbf6ebaf18d92715d6966b5ecae186745ea836d40a05de51bd877013ad7e0a1e098f5a86bae93e0a2805664ce7390c53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647512332, "uuid": "ab033ca1-fb07-4229-b9f7-c3248ecafdb1", "value": "T1A1F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647512332, "uuid": "bb1a122e-c922-4758-acca-2558b594a9d7", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647512332, "uuid": "d6e1ca43-c5a3-4d27-95ea-43989417d30b", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hf8rLneTfABCJoWRWwfpW:BeCCF88j+Xi8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647512332, "uuid": "09e34608-4cec-4e16-8ec5-081edbea23e9", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647512332, "uuid": "98d8f1e2-cde8-40a7-9fd7-22cd5b2bdf38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647512332, "uuid": "9ff51461-225b-48e3-afdd-891a785563ed", "value": "fc34c9d4896558c5e67687d6ee20e23e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "543ab20c-a5cf-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647507043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507043, "uuid": "a581dc8b-2f66-4fb3-9d60-8c64967ec66b", "comment": "Malware payload (AgentTesla)", "value": "29c78dfc50223e1606777079d1013473", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507043, "uuid": "0ac88fc4-f46f-4b36-9b9c-f5800e95f9a6", "comment": "Malware payload (AgentTesla)", "value": "8d192583b9bb15ffdc5d0f996cd79f9bd2784592a4723996ab11aff46278d77f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507043, "uuid": "67d97b1f-6c67-4b58-89d1-17a988bea668", "comment": "Malware payload (AgentTesla)", "value": "26aa96944e12227553feb4d363b4954a6af24c2d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507043, "uuid": "d61a89bf-251b-4e0d-9f26-abeae00e36a0", "comment": "Malware payload (AgentTesla)", "value": "5e148927a2478110ee7680d883917cdb6a1bb5ba8695c3790aa6d67b5e03e0951965284e4fa7ca5173035a662a030e8d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507043, "uuid": "0a81063a-e682-47c7-a230-2904cef5fe43", "value": "T18525365B38AA410EB6616D655FBCF172C15EEAF219761CF75DF3090A1012AF08B2DB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507043, "uuid": "d36ac71e-d953-48d8-b9bc-5e8be32d9506", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507043, "uuid": "22b05824-7f9f-4ed3-bd23-d503e4aaea9c", "value": "6144:IWYXgvSekxd+Nzojs1cUIZ5ifKnc1UqHLzv9blXKVfTpIoJ8LC+:KXgvSekD06CQ5ifyel9bBKVrpIA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647507043, "uuid": "616cfb5e-25e4-4dc5-9e9b-900a3b690c58", "value": 998088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647507043, "uuid": "c56f22df-440f-4f91-9d04-34df7bfb0e9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507043, "uuid": "166e72f2-15eb-4ea0-baed-db44bf2ac3b5", "value": "RFQ#Product Type_1243536203-14-2022#A201223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b47dbff-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518570, "uuid": "4873a48f-da9e-46eb-9a1b-80d297e1f443", "comment": "Malware payload (Quakbot)", "value": "337a422ec9fc26d7e2388759c5c3d078", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518570, "uuid": "ad08a07c-09da-44b7-9dd6-9e6d00480a16", "comment": "Malware payload (Quakbot)", "value": "8d216af4898726287cba0bce13de22dbaaf4d6d04a8ea5bd2cfb088ecc025ce7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518570, "uuid": "fca90f3d-8e56-4e03-8c06-8c599e48ddc1", "comment": "Malware payload (Quakbot)", "value": "f397f61945d84bd3f6109cb0d6a47f794f9b453c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518570, "uuid": "c662bd2c-ce09-4bae-b127-1e46f8946a76", "comment": "Malware payload (Quakbot)", "value": "a908bc2e69fe695f542d4697248abfab15385fee343579db064b92a55d55a593b31d1a740892e034d474209f2c3b4cc4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518570, "uuid": "57dad367-a87c-4ff9-9a8f-25480c046a4e", "value": "T14F15BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518570, "uuid": "b77aa055-432f-4c71-94cb-3449aa212fb7", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518570, "uuid": "5de97daa-1625-41c3-9c85-674b61e11ac8", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518570, "uuid": "207e54b0-97f2-416e-af2a-66df4bc7fc62", "value": 947426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518570, "uuid": "44e334e7-0f97-48d6-b18e-630556762a9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518570, "uuid": "7a2353b2-2a14-4677-adfa-27a11e64e0d1", "value": "8d216af4898726287cba0bce13de22dbaaf4d6d04a8ea5bd2cfb088ecc025ce7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c973f0ee-a5a5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647489200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647489200, "uuid": "8ff1cb42-6db0-4209-8d3d-a134e52c8a21", "comment": "Malware payload (RedLineStealer)", "value": "7c9b156c2b217df6452d18d249e27de1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647489200, "uuid": "a198c149-70e6-4592-807b-bdaa63f9bbb8", "comment": "Malware payload (RedLineStealer)", "value": "8da1e5d874a170db187cd81b76e11248399c5fa5a5df98745ccdf5125f5ebd3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647489200, "uuid": "acf37c78-b633-41b5-9bc0-21346b465459", "comment": "Malware payload (RedLineStealer)", "value": "f89ef5ee9124c0f2d68e69651a59a6b6fd06fc2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647489200, "uuid": "5a41c134-7291-40df-a2e5-db88283a4027", "comment": "Malware payload (RedLineStealer)", "value": "df746fab070c89134cd8fdf8e42ba3d31d8f10baa9fae07102f597caafaa11e9dce17de36300f5af35d93681150e1307", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647489200, "uuid": "81349aa8-614c-4589-b092-9b2047969409", "value": "T1A684CF40BBA0D03DE1B711F8797993A9B53E3DA29B2451CF22D22ADE16346D0EDB5307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647489200, "uuid": "d0d98aa9-0487-442f-84b0-e2d5a50d7955", "value": "909e4097670a3851d6a882270ed674ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647489200, "uuid": "fbe9788a-ed8f-4d0b-b0d1-f5742a780814", "value": "6144:+WFNF0jRvfPyABPZ0vjnmRPdmzzwJ3Jocy9gNG3WhFo:+Wp0jRvHVBqLmxA8KGhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647489200, "uuid": "98dda2e0-309f-474c-a05a-2e6408e743d7", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647489200, "uuid": "696930ea-614f-4b84-9536-fd615d745997", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647489200, "uuid": "29d1a81c-d2aa-4b51-8c80-47028ff988c2", "value": "7c9b156c2b217df6452d18d249e27de1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbcc443a-a5dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513337, "uuid": "ea1c0db0-7512-43e8-8777-891ddf6d99fa", "comment": "Malware payload (Heodo)", "value": "3b542436bde04194f58b379a34759597", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513337, "uuid": "2acf8b1c-86a3-4d2f-8daa-810506c685c4", "comment": "Malware payload (Heodo)", "value": "8dae73b2310748a85e356519fbb57a1deba40dcbd80dc94687d6810ac703fbd2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513337, "uuid": "8a8264c4-9885-49b9-a7c6-50f1f19dba19", "comment": "Malware payload (Heodo)", "value": "b2fd6795c385cd49acdb37b39e7d6d724430b63d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513337, "uuid": "93e77868-6d81-4311-bfd5-4ad9d39a32a1", "comment": "Malware payload (Heodo)", "value": "a7c47e63b4658f073c042a8719f399b166a72b84c3eaafb8e3f8900c3f4f70f0d58e2f58d584159da9b106c2789e92a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513337, "uuid": "625e2105-64f7-4873-b43c-643547269c6e", "value": "T119F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513337, "uuid": "7bf894a3-79c4-4d96-9e90-a435f6205a88", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513337, "uuid": "bc60df37-d9d0-4661-8638-797e0729425b", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7h58rLneTfABCJoWRWwfpW:BeCCF88j+XE8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513337, "uuid": "e38dbe4b-331d-4b70-a086-80a84e371cd8", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513337, "uuid": "67f2a7dd-df56-4e3b-9f13-e1220ba8c151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513337, "uuid": "db163eba-6251-441a-bc44-336a62166a37", "value": "3b542436bde04194f58b379a34759597", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0795ee-a5d7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647510436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510436, "uuid": "9a5e126c-4785-4222-9a04-96dc5e66de70", "comment": "Malware payload", "value": "9d8c54971f5f1ff74368785674e18a77", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510436, "uuid": "5314226b-16b7-45ce-9aae-3fc2f9829ac9", "comment": "Malware payload", "value": "8df0d05c36a64b13869343917076ba8f65604ea1ecde50292f361ad4e34b4b09", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510436, "uuid": "a3b41fb0-45c6-4396-9d9c-95df2c1d4403", "comment": "Malware payload", "value": "329de5f9b1b72def08da75e5c9cc116ebfeb76eb", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510436, "uuid": "fb1db728-02f3-4b6d-a310-c3f26f26f911", "comment": "Malware payload", "value": "89a5931945ddb5f9f561ac2e7c003263b5356ca297cdb092f14783784c887614bb9d9672437e55c632e08758739621f7", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510436, "uuid": "fc98d1c6-2c4a-428f-a1fa-d9158a2bd251", "value": "T13FB2B03CC09578E8C6F755FF234098F2654E30A49280E10F7996E24D2B2B5C743CBA6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510436, "uuid": "08067f97-73cf-4e94-a32d-2304ac57d7e9", "value": "384:PfYNU0FeAEhvwNEkPQy3mbcLgboFX2Pk7HQs0OEu9QCwGc5Tr9T/VFVa+3RQI:PfYDeNWNlR3lE+287wHOPsX1pa+3RR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647510436, "uuid": "3a85c952-b3b3-49af-9300-4edcda0fee49", "value": 25021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647510436, "uuid": "d04e4499-de06-454e-9d54-9c1f1ba27028", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510436, "uuid": "8705cb29-9821-48e4-9d28-2b62902209b7", "value": "sec-request_0311.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62909bd-a5e7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647517569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517569, "uuid": "7b4a717c-f4af-4836-b15e-81fc6b3641a0", "comment": "Malware payload (AgentTesla)", "value": "99772f763398fee4dcd52d3c1cc0f5ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517569, "uuid": "0dd5226b-7353-42be-a746-c08a197e526a", "comment": "Malware payload (AgentTesla)", "value": "8e084a9927786a2339ed41e3c1b416d763e72fa052e62760ead5c2d15e1db278", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517569, "uuid": "403d871f-bade-4462-a1bc-7d65877afe72", "comment": "Malware payload (AgentTesla)", "value": "90681627e964ecf727b4c4b52531eb08435ecc15", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517569, "uuid": "883e7f5a-b763-44c1-ab7c-fec6336bb320", "comment": "Malware payload (AgentTesla)", "value": "82958d4449f7d8f039da686c12162176158109b4d605118481db16bb7f2f5f9df3bd3466cc288d13ce8cd3f0c31f4510", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517569, "uuid": "192ee3c3-0c23-42c9-b857-e372bca4aef5", "value": "T18C74235ADAE4DBFBFAB1243305FBC33CD6B6A2D502C71B079BE05E2B16474478644286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517569, "uuid": "177a1037-d6df-47e4-ba2b-b90145b59375", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517569, "uuid": "740c89fe-8450-45f9-84cf-14a623cb5a9f", "value": "6144:rGiIZhDmqAJBNxKGKXO3QxnUNM/iO8rLoqfXzUmBJLrPNVmURqN+3UPkkpydVUg:0eqEBEXO3Q9U2qO8dZJLrPNwURqNKbk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647517569, "uuid": "38265590-5756-4e04-9382-63ee6042dd86", "value": 356885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647517569, "uuid": "dc93bed8-997b-4501-82fe-1b20b0866c9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517569, "uuid": "5d7ff22b-aba4-45d6-8257-446745010482", "value": "documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef8bd1b-a64d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647561043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561043, "uuid": "38bfacd6-c226-4497-b7cc-e175031b9d18", "comment": "Malware payload", "value": "a68aae3fc5ef80671d09e2565d69d254", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561043, "uuid": "bdeee5ff-5a50-4590-899a-9df38e5e8154", "comment": "Malware payload", "value": "8ed1bc383c102bf5f6e12b057e068042098b8aadc526ea387066c8feff9bd9a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561043, "uuid": "8f25fda3-ecd0-48b6-a0b1-bbae2845a7fc", "comment": "Malware payload", "value": "3d1179231d0042ecd789afef966eaf575f26aae6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561043, "uuid": "f340c9c0-6930-4a5f-9ecb-7c167dab49d3", "comment": "Malware payload", "value": "d22d8bbc1b8d33f7b982ddac922aabbf0693c1eded90b02271265d026f230cb9f8d6004042d1fd726b9ae4f012e4a3a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561043, "uuid": "ae6c183e-52ad-4833-87ee-e1e0709214b0", "value": "T1C713F2C8BAFF0520F8CB4B3A42153EF59F58D844A70FC2A6C248D99B621B225E560CE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561043, "uuid": "6c6a3886-fd22-4ca0-bdb2-a964a97cc4bf", "value": "768:Nmowz73cZ7QuHjFFMhDMCr7VDESK+a7p/WSbE7uay:0jz7ShDFNs5gSKTV/WSI7uay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647561043, "uuid": "c59133e9-1af9-4ac4-a6d8-e3a77499a440", "value": 41492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647561043, "uuid": "870b9bbb-75f6-47f0-8166-7206b9a769a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561043, "uuid": "60a30cdc-fb13-462c-93cb-ad52b3f2f279", "value": "a68aae3fc5ef80671d09e2565d69d254", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a29423-a585-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647475229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475229, "uuid": "e1363601-9726-450f-b927-3fc93d064aba", "comment": "Malware payload (Heodo)", "value": "6173c043b8382d9a8479dcafd1a9388a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475229, "uuid": "68df47cf-d7e5-421a-b4ea-9a15fd99dc98", "comment": "Malware payload (Heodo)", "value": "8ed4c9f3a9eca739eb6c44d6acb9899a8dc01e49cded7d97cb842bbcb3ca8ea4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475229, "uuid": "59a59748-83e9-48f0-957c-46413542d673", "comment": "Malware payload (Heodo)", "value": "2988f2430df8021f96fdcdeba70898f7d07fdff5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475229, "uuid": "346f8fb4-6678-491e-b513-7521e2579b10", "comment": "Malware payload (Heodo)", "value": "066ca9f642c3536605e83dbee5c78407b7bee1025dc82a61495f2db3aeec5820e462ef913faefefd7d17cc706175a51b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475229, "uuid": "83af62be-5813-4a91-8ce6-28ba3171f128", "value": "T1D4F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475229, "uuid": "988e3bf6-9ff1-4a2a-a814-b69a5e688525", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475229, "uuid": "0c700596-c718-41e6-b9f5-ce7313b3d0b0", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPxXvkgKtuBdfMAofD:WCBAdKV9Xf0kq3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647475229, "uuid": "3f8f3dc8-3e06-4e9b-aa51-1ba4f21493ed", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647475229, "uuid": "581e9ad0-d29b-4971-98fa-d4a9d7f2c60e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475229, "uuid": "ac5f6c9d-72f2-49ae-955d-0171375f5baa", "value": "emotet_exe_e4_8ed4c9f3a9eca739eb6c44d6acb9899a8dc01e49cded7d97cb842bbcb3ca8ea4_2022-03-17__000023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff49a124-a62f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647548561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647548561, "uuid": "efb6abcb-fe89-429b-822b-3ea3dd8e88b0", "comment": "Malware payload", "value": "9fcf93cce44f7692e02e2cfca25dc880", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647548561, "uuid": "0aaa8e85-6107-4d24-ad02-bc46c5cd6d83", "comment": "Malware payload", "value": "8f7372be69d2eb30935007b4bf5f892acdd998570d0786d1691f30221355f930", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647548561, "uuid": "18f97fd3-f837-40b8-ac00-deb7aeceae92", "comment": "Malware payload", "value": "55cb6b7a4603c445937ea5d12b879271c282209c", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647548561, "uuid": "3304e0ec-5259-46cf-b112-d7c2481040d9", "comment": "Malware payload", "value": "a7ba203d4927d95e29578084ee4bfd21c2efa43f61e7f62acd3a50363219706de46faacd12f2fc85228b50063fe14daf", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647548561, "uuid": "d0d63487-bde0-4cfc-86e0-7c79ae0e9ff9", "value": "T172A2BF3FD131A828E77FA87C920440F6E7071C4A1007AA9D2C55F75E65776BA038F66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647548561, "uuid": "2c636900-fe7e-4437-915d-cd31b217d417", "value": "384:vA2Y5Vb1GNj20o4CGzPd6ZIwLJKb5CzgObff9kC+xbX7k7aU2d:o2EINro4FLAOCBn9kC+xbLkWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647548561, "uuid": "4913bfa7-cc3d-4ab2-8172-1c7f5bb61ad6", "value": 21452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647548561, "uuid": "d8f55134-3092-4702-b05f-34caf43b80ba", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647548561, "uuid": "b6966a40-10b0-4bf9-89bd-5de7e75331c9", "value": "Past_Due_invoice.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3089403-a5ce-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647506772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647506772, "uuid": "c7bbd313-c8bc-4a30-9fec-76c1c2157a18", "comment": "Malware payload (Heodo)", "value": "3ac5e788b519454031dbf40fa69ca708", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647506772, "uuid": "e8c09d93-01c9-4577-bcd1-deaa94057cd9", "comment": "Malware payload (Heodo)", "value": "8fb2c48223952ffa157c8a0b9ab98e9f8b2924f7b8aa1faef94f3adc91eb8b61", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647506772, "uuid": "023d8052-ec4f-4076-b364-55b46b248298", "comment": "Malware payload (Heodo)", "value": "986a0e58ea43b3db2b66aa5e1d5f1c7cb2fc368e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647506772, "uuid": "eade97ae-0dab-4147-9888-9abd756408ca", "comment": "Malware payload (Heodo)", "value": "e05487a9c729968ead844bf52861e394edfa732a80b71b23ca7eb80f7a8fc5fa2c04d17d311320549ac89ab6ff3fa255", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647506772, "uuid": "624f950c-e3fe-47a7-8714-f1b38d513d14", "value": "T166059F7A2B43F27AC7E50DFC186002981A75BAB2C7F764272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647506772, "uuid": "a95bcbe6-df3a-4488-b61f-0cae85a5fab2", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647506772, "uuid": "ba0582e0-f0d9-420b-9849-6fa0453efea2", "value": "12288:KVHML2QJe6XxhqCWkQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqcQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647506772, "uuid": "b3a83b53-2015-4dd6-9b6f-3168313a041e", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647506772, "uuid": "509f05f8-f032-4676-aacc-a8af400ad9dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647506772, "uuid": "ffe20e65-c487-445b-a016-02905fd607b1", "value": "emotet_exe_e4_8fb2c48223952ffa157c8a0b9ab98e9f8b2924f7b8aa1faef94f3adc91eb8b61_2022-03-17__084608.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44511632-a585-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647475233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475233, "uuid": "38f89c9f-6dce-47f2-bbb6-45feaa555ccf", "comment": "Malware payload (Heodo)", "value": "98d52533648c6917e5ed657b8f912131", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475233, "uuid": "fd45f077-a263-4f3c-b5ef-09ac7357b1ef", "comment": "Malware payload (Heodo)", "value": "908b49f4360fc9f125ab17425bd84430dc8973153118c8173d45af2ea387044e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475233, "uuid": "5d9f61c3-2761-4e21-ace4-986ca0b56396", "comment": "Malware payload (Heodo)", "value": "e0a88f03b1b507c3f6745042153dc5bbfec2fcf8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475233, "uuid": "f440426c-5c20-4a2c-9086-621b804529e9", "comment": "Malware payload (Heodo)", "value": "9e3d354a56072883e0eca9667439e4fddd930e27550197b90866de48ee29e193ff85d8f55af87169d70d1593e68eed36", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475233, "uuid": "5c70aec8-8cfe-4947-9ac0-0fb26fb18113", "value": "T176F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475233, "uuid": "d2f34393-8c10-4f02-baf4-96338ef91632", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475233, "uuid": "16c3e717-65f3-4269-8079-590527b0dc16", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPNXvkgKtuBdfMAofD:WCBAdKV9Xf0kO3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647475233, "uuid": "8b7c4aea-da60-498f-93b1-0479a6b01a68", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647475233, "uuid": "a350333b-9e33-44bc-be2a-3755f34dc827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475233, "uuid": "8ee10a22-a749-4a89-8eb9-6d593425351d", "value": "emotet_exe_e4_908b49f4360fc9f125ab17425bd84430dc8973153118c8173d45af2ea387044e_2022-03-17__000019.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bd997d-a585-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647475231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475231, "uuid": "61e0bd25-5447-4b5e-b09a-a62fd0c3ee3f", "comment": "Malware payload (Heodo)", "value": "41667182dffead16fdbe4aec0239bd75", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475231, "uuid": "175791c1-a1cd-4ef7-8bb3-0bee599e87be", "comment": "Malware payload (Heodo)", "value": "90c9a7b829932a067695149fd006a6448c723df63831de7f69469b6962b8de1c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475231, "uuid": "8971a615-e6ef-43f6-a034-138b6ebd3cdf", "comment": "Malware payload (Heodo)", "value": "786b823306bae1033be9a0b2cee3a871adadeba6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475231, "uuid": "799838ea-1aaf-4cdf-9063-bc5fbdcede94", "comment": "Malware payload (Heodo)", "value": "80515be10946ac9ab779f6f8ca187caea14cc7cc437572b6a7890d1c309e9b11ad28903e880643bd1744d6e9ffa56d85", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475231, "uuid": "57d6a208-4073-437a-b6f4-66494b533f79", "value": "T180F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475231, "uuid": "188b28c5-760a-4f0d-8e1c-9fac503ab338", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475231, "uuid": "e5c332ce-cc78-4cf1-b2ab-8aaf91b3aa34", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPEXvkgKtuBdfMAofD:WCBAdKV9Xf0kz3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647475231, "uuid": "b4a8798a-3ac5-4d8b-9737-62aa6601a3e7", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647475231, "uuid": "2587c9f9-795a-4182-b91f-9297d01c0640", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475231, "uuid": "304e71a6-77a7-4792-b921-e8ee9fe85991", "value": "emotet_exe_e4_90c9a7b829932a067695149fd006a6448c723df63831de7f69469b6962b8de1c_2022-03-17__000018.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19be7744-a609-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647531855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647531855, "uuid": "4e560bf0-4450-4b48-9cc6-87a8bc1a53db", "comment": "Malware payload (Quakbot)", "value": "e86deca6509b9ee71719c252b2945e16", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama166", "colour": "#284FE3", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647531855, "uuid": "c5f5f8b3-3893-461a-9c70-af5a8366c2f0", "comment": "Malware payload (Quakbot)", "value": "90e8c22c7e3da5eee1be0575f1be2bd545df3410ab270e44fabb45bb1a747fa5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama166", "colour": "#284FE3", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647531855, "uuid": "a80b0478-3cc5-4b50-abee-3fd1c15b5706", "comment": "Malware payload (Quakbot)", "value": "90e319208657821d413d5287cd27d75c2db70417", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama166", "colour": "#284FE3", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647531855, "uuid": "e5d88bc9-cbc6-40fb-8259-4726c93de9fe", "comment": "Malware payload (Quakbot)", "value": "bde282f01bc5dce6989b8abc6cfab561a4d20ce43c209279ba56fd867caa268a425f66d3bde85bcad99666fc3d836839", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama166", "colour": "#284FE3", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647531855, "uuid": "7190b03b-05a8-4972-a400-5525d7d3f2de", "value": "T11794F1137E8598A8F06D943694A4486A773BF961CAD0C8CBB35029AF1F7B4C0DC3665B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647531855, "uuid": "187e4634-ac41-4a98-97ab-8cc972ddb5d7", "value": "951b79bccb42b97d27d026ffee52a7e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647531855, "uuid": "4bdb002a-7457-4e2f-aa0a-a4fbcc5e677e", "value": "6144:RDHtVqOcpq2hmEi9TDSlboSK1eh/Dkb6f3LzDLnTBaf0aOMsm3Gu8u:tJWgFSlboSrDGw72xsAX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647531855, "uuid": "e72bb4de-7d97-4fbb-ad56-736f1fa5c51e", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647531855, "uuid": "2e10aeec-600d-4303-81cd-c83a9185d518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647531855, "uuid": "b5b05614-b203-473e-a309-43c9cd5ab566", "value": "90e8c22c7e3da5eee1be0575f1be2bd545df3410ab270e44fabb45bb1a747fa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50bd340f-a604-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647529800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529800, "uuid": "d0a56483-6065-4cf8-9d0e-94229dd7b749", "comment": "Malware payload (Heodo)", "value": "b762e3a0d9e2e8a90c3938abdc1508fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529800, "uuid": "644f497c-154e-4cf1-bae0-14a776cb4a9f", "comment": "Malware payload (Heodo)", "value": "91029b7524cc737811362caff28b618ecc1107dc7e767d4518d4ea0d7db3765a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529800, "uuid": "61d4fb09-4038-4599-9189-4faaf4b615fc", "comment": "Malware payload (Heodo)", "value": "195b96e438591e0fbaf801e71a8cc070ff919133", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529800, "uuid": "1ca69591-d253-4ef2-845b-b4e865a5ca9c", "comment": "Malware payload (Heodo)", "value": "caafbe396f5f3e35166eae78b875aa6bbf3179fe881cf94bd14c69fbcbe0fa22c234181e334afe01b18d50d5041bfd82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529800, "uuid": "4cc4c2b8-33a0-49ff-ad53-35c773c64c1d", "value": "T14B059F7A2B43F27AC7E50DFC186002981A75BAB2CBF764272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529800, "uuid": "6b376d62-a64d-4e23-a686-f39c5c16f857", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529800, "uuid": "0f5b1a92-19f4-4d4d-aa82-aa85995fad9e", "value": "12288:KVHML2QJe6XxhqCWUQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqMQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647529800, "uuid": "c8f749e3-64ba-4438-8250-3830450ee5a2", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647529800, "uuid": "45634cde-8409-4cd6-928b-e31ccf1b23ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529800, "uuid": "e7897436-d30a-49a3-a765-6edae4fe8369", "value": "b762e3a0d9e2e8a90c3938abdc1508fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ae921a-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553506, "uuid": "e1e08a45-7cf9-40d4-b569-9f30f848bfd3", "comment": "Malware payload", "value": "953f34661713dbb99edbf60c77764999", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553506, "uuid": "e3ace5e6-3ca4-44cb-9652-54026e38f2cb", "comment": "Malware payload", "value": "916c10e81f8dacefc17a6029b344089dd9b99573a0d64ab2affa9ee8a200115d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553506, "uuid": "f46b6d22-8346-4e15-8c35-8c4eafd4b92f", "comment": "Malware payload", "value": "e9f1bcd01545acb8eb5ffe8fb1d6dde05bcb9593", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553506, "uuid": "a0382777-9ae2-45d7-b137-69e2bef90572", "comment": "Malware payload", "value": "93dbe9154f35cb2d19f01df6f6fdadf5b44f5e5a3c964d2aafea5845137f9b2db177b1349e3f16ec67fb72955a811eba", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553506, "uuid": "cf17a72c-53e3-455a-bea9-be59e90373d9", "value": "T12A059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553506, "uuid": "94ce5f81-1174-4669-97c7-ac56e0fe359d", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553506, "uuid": "d62a6b18-4664-4205-ac4b-500eb7708f65", "value": "12288:V20BXOMcVzpWfmmnDD1X5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDJX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553506, "uuid": "89c766f4-43f5-441a-b994-465f57c4f5c8", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553506, "uuid": "6003c9b6-3291-4ad3-a001-8b799f202fb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553506, "uuid": "ea12375c-4a88-4f7e-adeb-75797f635d07", "value": "emotet_exe_e5_916c10e81f8dacefc17a6029b344089dd9b99573a0d64ab2affa9ee8a200115d_2022-03-17__214456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bbd0195-a5af-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647493258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647493258, "uuid": "3e2bceab-9865-4cbc-a676-f8e126cc1369", "comment": "Malware payload (Mirai)", "value": "43a61a100e54a0b8aa79d15aa5d74d6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647493258, "uuid": "b23528ae-cd79-424f-a76c-b7e592b667d2", "comment": "Malware payload (Mirai)", "value": "91ecc1731b12cf97f9ea53ec106485adcfe69c5554eb1cb077d2e30c768508d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647493258, "uuid": "2e79b2a9-7207-4a1a-9ae3-92eab7d60c0b", "comment": "Malware payload (Mirai)", "value": "d2fcc2ca60c3e04b525af4e09ff0200b1c404262", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647493258, "uuid": "c89284de-df57-440b-9715-132eeea1f418", "comment": "Malware payload (Mirai)", "value": "f4d58125f6dc3b8bcba5ebf726374d765ed98eb026794becc19b94a801af4fd2f2508a24c6663e3a7186f99215f7a739", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647493258, "uuid": "949b1c87-ce5f-40a6-8547-ece74579e2db", "value": "T136432A25AE7A1E27C0C4B17B11F78224F2F6534E25B4851D7CB20E8EEF14B8464672BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647493258, "uuid": "a315739a-b691-4350-9e2e-2e218a8789e8", "value": "768:eloQixSu7tUfiLn+rYXCo6WstpH+sPQnr6dlPY8UtFO+Hrf6BFAg:el/ixSuO9Yf6v3or/htFLfQFAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647493258, "uuid": "89f8c89b-e90b-43d2-8265-169513a5794f", "value": 55736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647493258, "uuid": "28fb59a3-b1c7-46db-8952-fcab467d2fb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647493258, "uuid": "431a3f19-21a0-46db-ada3-320c3fed1c1b", "value": "43a61a100e54a0b8aa79d15aa5d74d6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d840232-a5bb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647498415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498415, "uuid": "4c50e58e-0659-4104-a62e-73b80a68f1a7", "comment": "Malware payload", "value": "e86e44f23d2d50ec615e1f66d335a619", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498415, "uuid": "1d233773-8d32-46ff-8e15-ddef673dce9b", "comment": "Malware payload", "value": "920f745b05593085c1898b4be13af29e3b445bbcc98e5b9e2c8e94908fc57ab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498415, "uuid": "f42316de-3605-4059-a999-07863c20193c", "comment": "Malware payload", "value": "43f9cb33d7fd527fc2bc755a1fd659c267313c2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498415, "uuid": "84f0fdb6-bf30-4fac-903f-a429bb75e30e", "comment": "Malware payload", "value": "0a5e9c9df966cc549bf9844f5f115c69b96c7f3b57c2dbc03f0d8e965d1ffe3c44057c457410e2fcb6b7de661783aa30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498415, "uuid": "db9141ec-5b11-4ec5-a6b9-020f11592818", "value": "T14462E95173D8CA7DF9761B715C239A4806B5BF45DD23922B38C9B70F7E32B8046A2B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498415, "uuid": "2d6ab4ae-4965-4ee7-ad79-3199160b1f5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498415, "uuid": "d40188f5-810b-445a-8759-357ad4a0fd78", "value": "192:HzBSWIuMVJZ3gglYQIeNzqFVkKhdhR0VHbpexEC:YXVJZw8IeN+FVxhRO7pexE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647498415, "uuid": "0a92cb15-6cda-4c33-abd0-cef3e7d64e87", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647498415, "uuid": "afa000ce-52de-4894-81cc-c0b22f8d9380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498415, "uuid": "9e4a6402-999f-4b8d-9df9-5ba495df4ff0", "value": "89085041.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b15338-a5bb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647498672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498672, "uuid": "64c6d2fb-f332-4809-a833-5e2c2af81038", "comment": "Malware payload", "value": "c6f20f022bf394c9188397a12b90760e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498672, "uuid": "c9f25d74-4403-4a8c-b1e1-389da0656d6b", "comment": "Malware payload", "value": "921bc271b1ef7cc341444a6feacae5e9c8b69dc8201b6bd19b50a7fa2b539d81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498672, "uuid": "a0aedcae-cd2a-4adb-80e4-dd0eb8fc1a55", "comment": "Malware payload", "value": "7ed403cac45bae24705f7073c28612f62575c479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498672, "uuid": "59f34c78-9bc3-45e7-bf92-de6ff5466804", "comment": "Malware payload", "value": "73eec8848b91cb8b21742e353bf419ea0b60f9258d5cdf116523dadfb61310178818d194b8c97ea88bb85a815a8fcc14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498672, "uuid": "b500af16-9f7e-40e1-af07-1ec562d32d1f", "value": "T1E1A63314A3401CECF5A2103266A44525D53678364720EDCF6B68623A9FB7FE1BDBEF90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498672, "uuid": "fb21b3ea-f015-4dc1-9eb1-b26b7f199d63", "value": "c5640c7a22008f949f9bc94a27623f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498672, "uuid": "0437f720-41cc-4b1f-83c2-74eb2604f8fe", "value": "196608:Ihl4XkYUGx7/ICteEroXxWVfEqlbkkwR7VTEiwYgFBRDf8kmmy3DX9je8rZQ:20XUU/InEroXgfEqirRRozYgrpf8k63P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647498672, "uuid": "add16655-9d68-491d-b434-a793cb2b7f91", "value": 9705924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647498672, "uuid": "d2fc352c-f203-4460-a71a-d533d67e0f23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498672, "uuid": "9f6d601b-aee3-48c8-937f-d5e3654b8e75", "value": "14942417.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee473b20-a5ad-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647492698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492698, "uuid": "c83a6f68-2a74-41f7-98a8-5a9c17d5b21a", "comment": "Malware payload (Mirai)", "value": "7d37302cdace8759f4c03b475a8700ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492698, "uuid": "10594711-17fa-4cc0-8b38-7f8d0d3fe2b9", "comment": "Malware payload (Mirai)", "value": "9268fc9f18d6d43c17c325faf430951ebeb6858d9074eed0aa282961a5cf7ff1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492698, "uuid": "a3f60417-c0d1-4306-ae30-dc34e3719b4a", "comment": "Malware payload (Mirai)", "value": "6fde776bb6cd5a05112a8075a095b6a04f1735ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492698, "uuid": "ddce8fdc-8a30-442e-aced-721574959484", "comment": "Malware payload (Mirai)", "value": "a86e9d9ee663e3d8c2816d3daeeff67f1daeb22ffe1ca0378124db6a3354a6eaad7993e9f47383b4e9737bc702ffaa39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492698, "uuid": "8d318da5-9464-4ab6-8776-8cb7fb1eb926", "value": "T1F1B2D07C930405E5E0F4D0BA1DA103962E701FB6E4609C17A995F90BAFA29BC1CF7ED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492698, "uuid": "5106b2fc-be26-4d8a-ab62-f7108672ef0a", "value": "768:3QkRQ942YZRHTfLJNcHX8Uz5EJgGlzDpbuR1J0R:3E9gZRHJNcHX8LVJue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647492698, "uuid": "0e47225d-e9d0-48fc-a3b2-9af4b1c18914", "value": 24868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647492698, "uuid": "ba78d4c3-07e8-4977-a265-2b17c07f28f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492698, "uuid": "ed2f6f0a-5b4b-41e3-9eaa-bbfdb6638421", "value": "7d37302cdace8759f4c03b475a8700ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86303b70-a630-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647548788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647548788, "uuid": "edcd9aa8-e8e0-49f7-bfc2-728d1f8255eb", "comment": "Malware payload (RedLineStealer)", "value": "aa26b0b52ce830d783e6aff3970c59d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647548788, "uuid": "4467e537-c54a-4efd-9f6f-716865e10c73", "comment": "Malware payload (RedLineStealer)", "value": "926bdc1a0c0b9034a1254caf2d6412437d0275c7d418af961a87c1ae7d79be60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647548788, "uuid": "4efdf532-7643-4db2-a08a-d0352842b200", "comment": "Malware payload (RedLineStealer)", "value": "3404448b0ef0556b77ea47950da22859009c6cf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647548788, "uuid": "dc38064f-a9e0-4a94-9aed-3b64bc9e5d39", "comment": "Malware payload (RedLineStealer)", "value": "d8b6207d063038b60d720d60ae1d20e1746791e1f96ee0ad075b9f5db30fda86cfb0a8783dca4208f6338c933bf5ad22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647548788, "uuid": "a001c0d9-e436-4511-9b6d-266fad5dbd99", "value": "T1BCA34DA973DD4A28F5FE4E7468B1515143F0F1A2AC12F79E4EC4E09D1D26B80DA22BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647548788, "uuid": "513155b9-0282-4ec6-87e1-458ba1b7fc54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647548788, "uuid": "9c8b61fd-5443-4c7a-a82a-ddd9ecdca5dc", "value": "1536:d0DskCrTG2IlA5cZRNcS5NLeeZ+igajuhtpMpg6obuTxYr0HC8LS:dICrTGaSrNBZOYp+hAHX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647548788, "uuid": "0ba1c472-1ad5-40fe-a2c8-f68149253b43", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647548788, "uuid": "6671f4e6-466d-4265-9d90-83efd0fd88d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647548788, "uuid": "b493b0e8-0646-47bb-8b8f-f57a5a6877de", "value": "aa26b0b52ce830d783e6aff3970c59d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5781684-a5fe-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647527473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647527473, "uuid": "a8d1caac-ecf3-4ddd-a9ef-fd51ccb73853", "comment": "Malware payload (NanoCore)", "value": "d380ccb6a88c06fe9224e795187f20b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647527473, "uuid": "a20c2754-7260-4399-90c7-476215ebf2b6", "comment": "Malware payload (NanoCore)", "value": "92f846f38ed7bbf0c481ccc3b8de60d1169551fd7a9b34de22d2c3c2d588c2ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647527473, "uuid": "503d7528-f002-47c7-8cb4-e9d9a86b5613", "comment": "Malware payload (NanoCore)", "value": "eec174c13e39b2db6ea5c7928ff9c34a70c54415", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647527473, "uuid": "7e05d9c8-04a5-4365-839a-fd24544e5661", "comment": "Malware payload (NanoCore)", "value": "fe015095b07a3a9d0b7670c5cba8c97a5edb2575d999d3e4183d5c3268e37580681e4063397bb6c8caec47f67000c20e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647527473, "uuid": "a32fa899-390b-47f3-a967-0f391fdc774a", "value": "T1AB35120867E28762ED698FB0E4B191F813B96C469812E3469DC37DCF3E3B706466531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647527473, "uuid": "43ac591e-18b9-4c24-ab11-54ef148ff2b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647527473, "uuid": "9da3d1c4-9e1e-425d-b591-83a3e530ea23", "value": "24576:f4X/9MCIK6ont0c5eg5aGOSmy3GbanbenY/UrSTH3iKI+:gX1M6tItGey3Gban6Yc2Ty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647527473, "uuid": "272b7f7a-b82d-481b-a3f4-db97e82ad1d8", "value": 1075712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647527473, "uuid": "a2e640ab-79b8-4670-8baa-bcfe3146fb84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647527473, "uuid": "ca03d89a-76d8-4c81-bad3-a3c1cd5703b0", "value": "order details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a663a621-a5f6-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647523931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523931, "uuid": "c7d52863-7335-4c67-bd97-12ca7fe1b1f1", "comment": "Malware payload (Formbook)", "value": "8dd60a0afc01bc7c1a1e3c6d5f844ce1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523931, "uuid": "b5bc60f4-d1b8-4ff8-8699-f35160bc155f", "comment": "Malware payload (Formbook)", "value": "93b7b31f375aa3bd37e131c4aacd4a4301ad8596d4c4d264258569fe0680c997", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523931, "uuid": "bcb18325-82b9-4cb3-a46a-ce7c48048be4", "comment": "Malware payload (Formbook)", "value": "d0e75d5b44cee0a6d7e40454ea328494649f4766", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523931, "uuid": "7f51cce4-938a-409c-9852-ec4d5533883c", "comment": "Malware payload (Formbook)", "value": "a1d3219060ae45af2175583f6fdc439893156e1ef7726d2cdcd55dfc471fca0c71aca77d6fe8e5b7129f8ccaecc3ba79", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523931, "uuid": "02e99ca7-b1c0-490b-9a32-93c8febcf3cc", "value": "T1F58568F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E5951EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523931, "uuid": "71313048-6059-43f8-9ccb-7e59b4d67d57", "value": "12288:mF3nLr0IRIw+//ay0/EFUHnrtIJBa/BtfOLaJ:mF0Ixuay0/ECGJSfOLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647523931, "uuid": "ff686a0b-0588-46c9-af96-9d3c9939f097", "value": 1726905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647523931, "uuid": "0b6550d0-7fc8-40d1-b52d-35fdb6ead7f0", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523931, "uuid": "89c2b244-ed4d-4fb0-ba8d-fcbf779d049e", "value": "PO DRAFT-Mt ch.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f900139-a5fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647526872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526872, "uuid": "1de68f92-d854-4272-8f79-d8f22e417c5c", "comment": "Malware payload (Loki)", "value": "7f033eda7b2594a11215b9d68b7fc507", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526872, "uuid": "3a3d5335-5929-4161-b3e3-f7d00a89dac0", "comment": "Malware payload (Loki)", "value": "944220c5aff35e369c250d000c287223061bc5acbc7df5b3209fb526685ddde9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526872, "uuid": "37bf0a6c-0e83-47a8-9e4a-148d1b124895", "comment": "Malware payload (Loki)", "value": "5dcc2e4ff79baf4a5b4398571fa2126e1328e698", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526872, "uuid": "224cf22b-1365-4d77-b85c-139742d41fba", "comment": "Malware payload (Loki)", "value": "98f0186c9dd850afacbd54f1da00f3a0ae36f4ab16d4564e93c51e30ada9b85ead7fb59ab4f75ede42eed7e6f4546a51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526872, "uuid": "ba82e480-1bde-416f-8b30-a914445e6602", "value": "T1FB25124826E7C763D17E53B5C02590E917B06C47E822D79AAD4378CF3E3BB404A56A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526872, "uuid": "1bf9e1a8-2ce6-4133-86a5-41d5000ad26f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526872, "uuid": "708c36f5-30d5-457c-91bd-22935e826297", "value": "24576:7XR9mwdDIhFsUChAQx2QZAeDIcVvBnF2ST:7XDLdDyCZkQDDNRBFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647526872, "uuid": "75a603b7-32f2-4b31-8e25-cb29c9054683", "value": 968192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647526872, "uuid": "b1752b08-e639-4cba-981f-28fb4db9e28e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526872, "uuid": "6d365b74-e964-452a-8d34-6084e5aab293", "value": "New order & Mackson Frangmat Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775cdbe0-a5df-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513974, "uuid": "2cfd2729-3bcc-4b1e-8a6d-39eb5e337c42", "comment": "Malware payload (Heodo)", "value": "3e1df4794adb2a17fb8371bc9d9a5e1d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513974, "uuid": "bc02d2fa-7581-4f7c-b31c-22ebbe2ec65e", "comment": "Malware payload (Heodo)", "value": "945f9167eedff97a9826c28e8b25d237c355dcf360e266c8c1c7575740a7c1e9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513974, "uuid": "c2fa7002-29fc-4c93-bb95-72ca53305f1f", "comment": "Malware payload (Heodo)", "value": "8e9114cceed488e093350e5f987eb7d5f5ed5f38", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513974, "uuid": "de3a802f-86c9-4097-915d-27fbe9cf5269", "comment": "Malware payload (Heodo)", "value": "250452ee33d7551ec72e476eb6560f0b33ec8484b2dc4ffbf4b4f16c03d8189bb5e554da124b64c34731b83b967278b7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513974, "uuid": "dfc18b2a-5763-409a-8ef7-33da84c8190e", "value": "T121058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513974, "uuid": "301c4de5-51dc-4310-8659-9e4712783e7e", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513974, "uuid": "44db6c08-3d3f-4bfd-977d-45c2c8bdbf15", "value": "12288:Wvz1CLJyyvmMLSrBgI4ruGbPlVpqb+DlYzv:WJCLJyybLqBB4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513974, "uuid": "867f89aa-9b0d-4f33-801c-2bae0affe733", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513974, "uuid": "01fb3997-48ef-4bc3-9183-392c61566d90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513974, "uuid": "4c4ef0b6-3134-4e2f-8c69-745049219190", "value": "emotet_exe_e5_945f9167eedff97a9826c28e8b25d237c355dcf360e266c8c1c7575740a7c1e9_2022-03-17__104609.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ffaa78-a626-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647544311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544311, "uuid": "88e6ab3d-7ae7-4ab7-8869-842b4f9165e5", "comment": "Malware payload", "value": "c0628f15ce57e4e3d4e232551da10a2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544311, "uuid": "84eb4e89-8f48-4700-8cb5-9eb26cb184af", "comment": "Malware payload", "value": "94e751b930bd15beab160a5d13ef14f987868d21932be742425f2a9e953f7af5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544311, "uuid": "0126c6ce-9bfe-49f0-89d3-c50072478849", "comment": "Malware payload", "value": "630a1003976375591ab3e548e7a2698d334ece05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544311, "uuid": "a1ccce00-7128-4586-aa51-91f989ca75c9", "comment": "Malware payload", "value": "bad3a98a3f32bdf0198c5a64ea7ec9cb833338751fd66e01f3929800527d9881577c228a79193c8dfc393fe39dfa5479", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544311, "uuid": "7e800ed2-f0da-445a-9373-021ad8748326", "value": "T134058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544311, "uuid": "967f410f-c7ce-4599-a75e-283fb56fd987", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544311, "uuid": "ba9bd0cd-b028-4822-ab9f-d8b167dee00e", "value": "12288:Wvz1CLJyyvmMLSrBgU4ruGbPlVpqb+DlYzv:WJCLJyybLqBl4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647544311, "uuid": "16b000d2-0ee2-454f-93b2-d36b92fb97d7", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647544311, "uuid": "4754da96-29ee-4ab2-9470-4f40e620e581", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544311, "uuid": "82ca8635-eff3-43ce-810d-aa3d0583d45b", "value": "c0628f15ce57e4e3d4e232551da10a2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a62c033-a615-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647537171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537171, "uuid": "2c60db58-4632-4687-9a4c-04c7febeeff4", "comment": "Malware payload (Heodo)", "value": "adc0a7724ab44fc84b6177fcc377228f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537171, "uuid": "cecd5e29-571c-4d57-bd34-9c6e3918368b", "comment": "Malware payload (Heodo)", "value": "953ab1137507215809bd0965adcbfd10273b8d338be009d91163798ecca9808e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537171, "uuid": "82ca31f0-b3ce-4b29-afba-9c511c5e4ad2", "comment": "Malware payload (Heodo)", "value": "474101a7c0beb34d48d5cd1bf1ba5c9a5bf69d32", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537171, "uuid": "cf6f395f-fff7-4b3f-970e-ad808e25a1a7", "comment": "Malware payload (Heodo)", "value": "158966277b568f3d44af3c418a427b595d57fe1bb5d3e831a8373fd5f532ee358547e49f5b14ff2e0abe97a7dc3cbb96", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537171, "uuid": "3944f5dc-df14-4e0d-82d9-78dc6a27e95d", "value": "T17E057C5037818037E7AA58740601BA783D797BE38BBF72925E80957DEE704C3C768B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537171, "uuid": "212eda7b-e557-4a07-9859-5779ad83d933", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537171, "uuid": "a8868fbf-77df-4502-9991-e5dcdc333661", "value": "24576:xJjq8sc5JGxNNNNI+++++h3/UQUQiFj5URW2AeF+99V3kW5Qk45:xJq8s4uNNNNI+++++h3/UQUQMv2AeEB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647537171, "uuid": "05af69ff-6c9d-4f96-8a78-8524cafdec79", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647537171, "uuid": "3e0b288f-7694-46a3-82c9-3dce752d3ea5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537171, "uuid": "97a62098-2cb9-419d-a37a-0c0d31e42587", "value": "emotet_exe_e4_953ab1137507215809bd0965adcbfd10273b8d338be009d91163798ecca9808e_2022-03-17__171245.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91980402-a609-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647532056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532056, "uuid": "ee1e4691-8ddd-459d-ae92-02e036e4382a", "comment": "Malware payload (Loki)", "value": "2ede16e8bad55cf3a5d5dd352cdb0562", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532056, "uuid": "c21cba55-7ae1-436a-bf15-bcfed0a613a2", "comment": "Malware payload (Loki)", "value": "957bd81e208402d0f600bef22d042b9593dd2e1f79588656b72b438dddb820bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532056, "uuid": "4dde577f-6f18-4951-b8f8-4cda2e2fa163", "comment": "Malware payload (Loki)", "value": "409b8b59637427829a84d1a8a02977a4c37efe1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532056, "uuid": "6f7a1b16-313e-4f8a-b834-45a9a78de957", "comment": "Malware payload (Loki)", "value": "c3ddf780f6a81af7d82ab8418c0bdfee3422a4b790e29b1e2d00cea3e072da5de3ac3148eb0636173aa058008a5b1271", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532056, "uuid": "6d78893e-aa52-4d8a-a805-3d24ceab3f45", "value": "T1AF64122F75E0DA7BD0A166B55B73D7F8F7BBD2880DC7190B8BA43F321E818821406256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532056, "uuid": "6a40dcf9-b1df-49ee-ab4a-357649acbdf8", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532056, "uuid": "d9840523-7fd4-4c1f-824b-f5039071cc57", "value": "6144:rGi9nZGz9/WZm0iXVJnuOYg8rKw5/tJTHYmJpjmd432ydsYTSJA55/S+JpWtvuFP:Bw/WZLAVJZ8rLJT4mjUySC5/S+DWQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647532056, "uuid": "25eba291-9c5f-402e-b16b-4d788d7dc7c2", "value": 307155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647532056, "uuid": "acf3fbef-662c-4fef-8d11-b23c7bcab709", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532056, "uuid": "0f8f8dc9-9fa3-4fa3-a3b5-10a5d14a775b", "value": "HE HANG_240210032533_A166.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95bb1d2-a617-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647538243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538243, "uuid": "31278201-7af5-484a-9a78-0cd1a9cbefbc", "comment": "Malware payload (Heodo)", "value": "60cc72f191847e1e4a79aa11fc411f44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538243, "uuid": "4b21e25b-63f6-4996-83f7-accf008e3929", "comment": "Malware payload (Heodo)", "value": "95e103c95d67a29d7eb873d94517b23469d47a7ef3f71be6c4eec787fab9b3ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538243, "uuid": "ec25d3db-d0c3-44be-a8a1-cb4dfe825cfa", "comment": "Malware payload (Heodo)", "value": "6cd64b00c4aeee3d2a816db42bd9e6f2646d1640", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538243, "uuid": "f20fd2ba-0e1f-4144-b7d2-7385dd37216b", "comment": "Malware payload (Heodo)", "value": "e2aed2a1b1fc48d3a6aa37d1447f96c9e48d0b642a0dc80d55111fff17afa0e4ad64373f4dfa1dd2ac43c890ec2aa91b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538243, "uuid": "eaab5efd-66e6-48f1-a4aa-370544cca1e2", "value": "T13E058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538243, "uuid": "f8dd8b39-4771-4729-96ac-27d53402aabf", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538243, "uuid": "b7c93a75-2501-49d4-b629-fc43b716fe84", "value": "12288:Wvz1CLJyyvmMLSrBgb4ruGbPlVpqb+DlYzv:WJCLJyybLqBS4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647538243, "uuid": "fa8fd6e3-7aff-41bf-bb13-5528a1fbbd7f", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647538243, "uuid": "b7d4eb45-22d1-41d2-8b9b-191f8a3d4981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538243, "uuid": "d62a1487-1c12-4e5a-b0dd-14fbbfb80926", "value": "60cc72f191847e1e4a79aa11fc411f44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82561593-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553506, "uuid": "e82c50c4-4bca-4c94-8fea-3bdc3fa2bc9d", "comment": "Malware payload", "value": "38f37a2c88fa0d08fdda4cb31c3f3fa6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553506, "uuid": "229c92de-2b6c-400f-aac3-0a98fe6d8378", "comment": "Malware payload", "value": "95fb597fd63f1edbf0f7ee75b2416708fb87156fa7712fa5d4b7f7b08681e344", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553506, "uuid": "8cd5b39f-aa80-49ca-a8a6-400afc14bdf2", "comment": "Malware payload", "value": "47809dc74633763ea76c26b60427d10576702390", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553506, "uuid": "dc9b75c5-feff-4c4c-baf7-60a4115b2935", "comment": "Malware payload", "value": "9a9306e5db1a32605cdc98fd99ba3acac7421f5eb53afbd4801ed3cd901a14421b9185c4f549581df34d0c8b36570d90", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553506, "uuid": "b7272925-7201-47e5-8d98-6f94a29b8706", "value": "T145059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553506, "uuid": "fecf5cba-6d90-4d93-9cc0-e152d03e292d", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553506, "uuid": "bb618c1a-5fb0-45d0-ac58-ef50d6fc1ab6", "value": "12288:V20BXOMcVzpWfmmnDDPX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDzX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553506, "uuid": "89a31114-3409-4f1c-9bd4-355adcc1386f", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553506, "uuid": "9378bb69-b1bb-4909-a110-b0ab310af56b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553506, "uuid": "4c42da3d-bae5-4d11-867a-4b00de91f35b", "value": "emotet_exe_e5_95fb597fd63f1edbf0f7ee75b2416708fb87156fa7712fa5d4b7f7b08681e344_2022-03-17__214457.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906c4c9e-a5c4-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647502419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647502419, "uuid": "653978b4-926a-4e4b-a20c-179f562fa535", "comment": "Malware payload (SnakeKeylogger)", "value": "c579ade2e0688feb45c82e6c31234d06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647502419, "uuid": "162e4c39-e69d-44c3-a58e-ec30294a0ede", "comment": "Malware payload (SnakeKeylogger)", "value": "966a990eafa21e93237dfc539317d2bf924c8a17fbde441714f0c95dcdf4ccfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647502419, "uuid": "c6f901f7-ca39-4c2a-b08c-6b543ac9b9b3", "comment": "Malware payload (SnakeKeylogger)", "value": "c6eebf41807ee78f97bf3fff1c8ce2a74e32436a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647502419, "uuid": "bf1d1d9d-2735-4cf0-bf3b-e95400b8e773", "comment": "Malware payload (SnakeKeylogger)", "value": "5afdcc12ca85f35fd1b4991e425bf85bf8c27be9ad034b8b8e952a9fc5b9f3c17a351a2180dc297ca611be5dfb1b11b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647502419, "uuid": "b35482b3-c742-4993-bfca-7aea0f05c4ba", "value": "T1A144023D2BA97E72D85FD2F70016079D6BF093A1D622F7545F8221A9173BBC019C8E92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647502419, "uuid": "32ba4510-6b87-43e0-a952-2d7507811153", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647502419, "uuid": "fce5a809-0211-4ff6-9c4c-81e8ff25bd5e", "value": "6144:O+j6C1MYICxnV4vBHU4HrNqX4EHmF10UWJLFJFob9jAEM0:O+jiYPxSvBnrdEH4gfFk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647502419, "uuid": "85e61e21-0c24-4b77-a9a1-da848af16553", "value": 271360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647502419, "uuid": "c8cb925a-635b-41b3-aad4-2d4e61b4224b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647502419, "uuid": "61d942bd-8c18-4b4b-8408-c7f041a4ae64", "value": "Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff398beb-a5e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647518496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518496, "uuid": "1c6fa4ea-1c6d-4892-b8a6-a44b23178086", "comment": "Malware payload (Heodo)", "value": "6ac9dd3a89a7b5faf7e31c436ff35b7b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518496, "uuid": "a6f555e3-dbad-4b67-9597-88e50eaea50e", "comment": "Malware payload (Heodo)", "value": "9775667d29687c654531e0d57eec08c5e72270a3921d36876e196c2ca9a433ce", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518496, "uuid": "093f6aec-68c7-4f84-b9c9-c0e6f0fe7fa5", "comment": "Malware payload (Heodo)", "value": "26f92fc745df0a788203711a49454e6af20bc0a8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518496, "uuid": "25703ff3-fb21-4a96-a75a-70306fa9e701", "comment": "Malware payload (Heodo)", "value": "82fe5a3417585bccbb539d0c931229ce143277f4846be1ff12c179aadbcd044a4129447542bcc081dd8dcb6ebbb82c91", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518496, "uuid": "bf98eb07-9a52-4d1e-b02c-c56a6d331a3d", "value": "T13BA2BF3FD132981CE67F987C430440F6E70A1D86600765EE2C45F26E66726B6038FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518496, "uuid": "faa162e8-96b6-489a-a26a-149a67f3d783", "value": "384:YHTyVb1GNjyo4CGzPd6ZIwGdKb5CzgObff9kC+xbX7zUSA:MuIN+o4FLYCBn9kC+xbLzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518496, "uuid": "feba7a4d-c591-46c0-bd8b-2ebb5556b73c", "value": 21444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518496, "uuid": "008ccd46-4eba-4266-8aef-a632799e3e3d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518496, "uuid": "c2549b18-1c0f-4116-8f3e-6612017297cc", "value": "Rechnung-im-Anhang.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf0d127-a5fa-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647525445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525445, "uuid": "aa131c34-109b-4d2c-80ae-1c0a75ffc326", "comment": "Malware payload (Formbook)", "value": "85a2d19aa2c31c6aa8c55f5300a6e306", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525445, "uuid": "888e051b-ea16-4a44-94e4-ac70666750d9", "comment": "Malware payload (Formbook)", "value": "97c616bf4d72290ec5613fab2937c2a47a91a0d80ae8ff6a590d7f3b6787675a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525445, "uuid": "d3de2d6a-8b48-4555-8d84-4e5f8d1bb270", "comment": "Malware payload (Formbook)", "value": "53fdf8f736c67b32ce0473d0b8b280eb7ef0e388", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525445, "uuid": "a19db226-922a-4672-8c79-a9f0a9c2d3f0", "comment": "Malware payload (Formbook)", "value": "9462f9307d56c85d055a4d2a24c4ba4c9ce0dbead6aef725e8b838b30e29c454e571e413987d39eeee386fe8fbf8a7e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525445, "uuid": "9e15db1d-e900-4b00-a0e6-bc0d7e62610e", "value": "T1CA357CF2A2518832D42236384D1F5EB8B5297E11DDE4A546AAF43F0D3F3C5B2FC21A56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525445, "uuid": "1fedd881-a874-4533-9804-45c8dcbad9b6", "value": "066f2adf6884c84166ea572f3442e2f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525445, "uuid": "f34562cf-d7f5-43d4-9e81-fc32f2b8a76e", "value": "12288:RbojJKNbgMwT2NRAvS/yqenMbJjRsBp8oziAO8Iz2sVW3MyqI6F3HAhcAszeVQ18:elKiCRAvS6qOMZGBNgzYqTHAhU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647525445, "uuid": "668f990e-2177-4db2-adbf-2e5b07535e0c", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647525445, "uuid": "07f791c3-8723-4d10-9b1f-160f68584637", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525445, "uuid": "ffabc860-4328-42d1-a38b-c8638667bf72", "value": "shipping documents SST2112-250.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c1981f-a5f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647524302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524302, "uuid": "9ea2b783-75b3-4be0-b029-c8e4d4bfcd43", "comment": "Malware payload (Mirai)", "value": "e20c0f404a2f2c474c13597dfb271157", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524302, "uuid": "1376f047-9505-4175-81d7-7a2e0a06c918", "comment": "Malware payload (Mirai)", "value": "981e7e2ad4eac3d27765d90080680fb5af3d999a10bb65f35d66381d10a018e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524302, "uuid": "267b24b5-e40a-4de5-b320-b8702d51d283", "comment": "Malware payload (Mirai)", "value": "ab335a976ce1723585681aa5cf9ee050ce792f10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524302, "uuid": "b94879ad-f341-4e62-a99c-770c31d267af", "comment": "Malware payload (Mirai)", "value": "e360fb50db2801cd85031115f8f53eab9d805211d635ad5b3830b7340bc236603dfa60df27bb19da13bdcb6429b0f871", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524302, "uuid": "0bc2015e-e688-42b3-81f8-848447cf7061", "value": "T12FE3A53E7E11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524302, "uuid": "ba479225-428c-4a32-800a-daad86f06320", "value": "3072:JW6dm9tS1aRGQdK76t/zCuI5mrThPaLEnvPrNb:c6IG+LC/mrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647524302, "uuid": "d199a058-d04c-4162-a829-6b4dfa5e64b0", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647524302, "uuid": "c2679132-b157-4159-abf2-7d9fcc1fc892", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524302, "uuid": "1d6dc39d-3af5-462c-bbf4-8f8926b44434", "value": "e20c0f404a2f2c474c13597dfb271157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a80d1eb-a629-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647545601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545601, "uuid": "db11fe1a-c033-4696-b7e1-afaa0acd9e64", "comment": "Malware payload", "value": "8f3468fe5dfe7ffc72216e7a181b2549", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545601, "uuid": "76e337ae-d5c0-4252-b327-2b370d438e8d", "comment": "Malware payload", "value": "98eaad7740c03a9ebdf1c694333de75adf6edab153bc6457d354d2a6457d093f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545601, "uuid": "45abc426-2745-4712-9973-237c2fe6362a", "comment": "Malware payload", "value": "5c367cb10923817f73e889a34a936df1cc3ce44e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545601, "uuid": "cc94103d-d64d-4aec-b456-59627f4722a0", "comment": "Malware payload", "value": "10b4e28ecc7861b55debd09a68ec5d61e48e5cb2ce45ed8cea346feb5cb96f81f30c63282141403382ea4caabf7dae84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545601, "uuid": "814b50ac-14d7-48e1-baad-016e82246f56", "value": "T12F740240F7D246F3E1E2423211F3B0AB9636A7249728DEEBE35D1C035995AD58A703F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545601, "uuid": "f2b172a8-1c9e-4dc2-a618-35d7522f6a71", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545601, "uuid": "a1da3d6e-5990-4456-a0a9-22a5437ced84", "value": "6144:mzBkLL2NTB8RiktP+L8Tul+PY608mbnJIJVAR7F1wYu5hctR6dFwnWjDbQfkN7iK:mKyNTKR+l+PJmbnYKR7FWTTcR4NDpHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647545601, "uuid": "a55fafcd-a84c-4252-b05f-9b8d2a6a1a74", "value": 354304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647545601, "uuid": "9f307c7f-35f9-47b6-841b-50d562ba835d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545601, "uuid": "c60ed5f8-c29d-4d2e-b97e-38fb98d68cf0", "value": "13750392.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc46d586-a611-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647535591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535591, "uuid": "7346a234-025e-4746-9890-21d8bd777956", "comment": "Malware payload", "value": "85be3b1eead6b636a62a2f75ba9e74f3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535591, "uuid": "10892457-d29a-4003-ae03-0dba713e357f", "comment": "Malware payload", "value": "9925a80b0fdc0a3e0eb48052e338e303bd888bd9e550edd612238f8c41255343", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535591, "uuid": "fc2aacea-8f0e-452f-b3a6-ba43fe7c31aa", "comment": "Malware payload", "value": "d1da218798ea25a38b638f54c09b1be1c162a06f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535591, "uuid": "c8d86da7-6a08-44ac-8411-ddd207fc766e", "comment": "Malware payload", "value": "620b99783f77ffcdcc10172250043da8cda0ba0d4397f6e3e28821b2aeb536abeabd51a82dd3f7d207deb3c047d9c4fa", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535591, "uuid": "cf9a4af1-d300-443f-a701-3f316b7f6305", "value": "T11A236354BA59E89BD19B2D72D94F8FAAB3342C05CFC2C34721DB779D1C366189B09A80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535591, "uuid": "bfbe8a81-14cf-4b98-bcec-f0cc0f669ba9", "value": "384:wKEiSUR/8dzcMo0H9QGLDdaam1tnM0qrP2qaGS0jmQtoa:V/qQXU9QJPtKr+qmB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647535591, "uuid": "be7a4922-ae61-4816-920f-048194427cc2", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647535591, "uuid": "7b583ed1-ca96-4c06-81cb-20b2747e9c5e", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535591, "uuid": "8d03dba9-c5b8-4f54-b765-e8d5ad3f2216", "value": "85be3b1eead6b636a62a2f75ba9e74f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "164dfebf-a5f1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647521542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521542, "uuid": "b80370ed-0fac-46cb-bbcb-7e3594aafc8d", "comment": "Malware payload (RedLineStealer)", "value": "f92445eabc1e8a0bf1b099f9e6c41194", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521542, "uuid": "235bca2f-c99d-45a2-93fe-9dd0f664b5c5", "comment": "Malware payload (RedLineStealer)", "value": "99561e82d86545aadc9b9ed48a7cc11c2b4bc04e710a1b843cbddf4eb08a4942", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521542, "uuid": "2dff8f34-4ebf-4dda-a707-d43d1a501a46", "comment": "Malware payload (RedLineStealer)", "value": "70793e733028af2d04a292e445efc8a0406896b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521542, "uuid": "8fa85d5b-0112-4273-87d7-e897968e2d4d", "comment": "Malware payload (RedLineStealer)", "value": "78e26350e40f3add2a37d7c68ce8c11376bc4c1ed24e55747892b3958e991a062a90e6db51ea2a5124c979ac4be4154e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521542, "uuid": "244a8013-4c17-49c8-ba93-5494614a3a4d", "value": "T16F840262B691C132F47359309920CAB0537B79361FB9C64B73A5677A1E323C19A7F30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521542, "uuid": "b356547b-dc0e-4b0b-96ce-55efe5bd350e", "value": "fd0ede3c5c8544ae63b9b4361c8fee0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521542, "uuid": "3c2e464f-6acb-4a6a-bd93-8a88b634f394", "value": "6144:sLavK/hEd53iAP78fs9Z8mIPJVg1yaSA3P:Ya4WS0j9Z8rPj+yad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647521542, "uuid": "09c29bd9-03db-4499-b538-3480c0d27156", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647521542, "uuid": "0c6d628c-4e8d-4287-80ee-cb22858bb6c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521542, "uuid": "6eeffb0f-1b36-4c22-b077-8360c9d2fd99", "value": "f92445eabc1e8a0bf1b099f9e6c41194", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75bad48d-a5c9-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647504522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647504522, "uuid": "a3f1d323-0b0e-461b-8863-e7d4d02e7378", "comment": "Malware payload (Loki)", "value": "80cbbd0a9799fc010edecc34ce7cb50b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647504522, "uuid": "f4fd005b-c87f-4ecf-b512-ad9be2991c6d", "comment": "Malware payload (Loki)", "value": "9989f1547cfd8fc2e20e943afc30641aa855d98b8c04fc26c5ab5a61cb46204a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647504522, "uuid": "e5bac148-2d42-4b44-9573-5128a2362e51", "comment": "Malware payload (Loki)", "value": "6d083a94ea73f221d5d58c6984ec787f6761e4da", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647504522, "uuid": "70c223f7-1cfc-420c-b98e-10436bf205a5", "comment": "Malware payload (Loki)", "value": "44ff788c61e919dcb39900d4af2955728ca781201534eeb23b1e95972ceeea7f745d32474a74012ccccb39c94c602b54", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647504522, "uuid": "ff95f461-ead2-4d0d-92db-b09c61731688", "value": "T18E14129E37F7615EF266E33A32071D2C5170FC02AC3A01AEA4057C1E39725B562E9B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647504522, "uuid": "45d5a5f8-ccf1-466e-975a-8d7e675b936a", "value": "3072:yMR5POtse109xaDWEzexDll8NWmSpZvKUZhXmzSscZFUuQaNGxTVfHRnesuuWnEz:2F1uxakhl8NWSUrscZFuhBHRnesuuWnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647504522, "uuid": "972e99e9-03ef-40ed-9614-5376df9cfef6", "value": 190360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647504522, "uuid": "f62f6004-08dc-4f2e-b04e-aed4c60d00a0", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647504522, "uuid": "cbc9ed4b-2c46-4253-b929-8a13c7d2e78d", "value": "Invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b971f123-a5e2-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647515373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515373, "uuid": "0f3a5754-b816-4aaa-a2b6-f5affb015c52", "comment": "Malware payload (NanoCore)", "value": "a37d70a0a16d391dad551c91496b59c4", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515373, "uuid": "3bab7be1-3bb0-4b79-8b09-52f38f01cc2d", "comment": "Malware payload (NanoCore)", "value": "9994567153e0799df96fb16a54776aaf881aac1ad584b6a0130ecf18d17a1b78", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515373, "uuid": "1852a97d-e014-4417-ab16-0c3d14ad0595", "comment": "Malware payload (NanoCore)", "value": "1a729372bf31d78ef3904f8d1dc526a628ea9c8f", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515373, "uuid": "04ea240b-2c42-4562-8368-1c9d232a93cb", "comment": "Malware payload (NanoCore)", "value": "e749259bfc6bebb3e3b7109ef3e7815c18222f5780f0055d0720fb8f926e37e90c93785118f89d44f7cf85cce585fe32", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515373, "uuid": "f4d8ac14-69c2-4c26-b06c-fc4245f6a00b", "value": "T120A2E11DCF326AE1CF55ECF80616C65764B7EB3B048CAA0356208D93B6D4BB58BC42E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515373, "uuid": "655e2655-ab67-4e11-aeb3-caea8e0925cd", "value": "384:y17zjagLXRRsK7flYihBZFVBQu5hmxhl/u3niIDPHGKdZ2ZprQ46FptZSEaD7BgJ:2agLBRsK7dYobF5hmxnm3SKdkpr0FzZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515373, "uuid": "26088079-6487-4649-adbc-a8fbb04c99ff", "value": 22494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515373, "uuid": "7ec83ae2-d5df-4264-9729-d1ce09570cfb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515373, "uuid": "1cb35225-a99e-44ad-99da-cce011d24cde", "value": "payment advice.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033fa11e-a5e8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647517644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517644, "uuid": "69a8f12c-8b86-40ef-92a2-a4616106643a", "comment": "Malware payload", "value": "84dd212f8e6813be02f395a288c64090", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517644, "uuid": "bdbc772d-5315-4cbd-bbae-1ddb30b03430", "comment": "Malware payload", "value": "9a7b2cbaf07319d6488a7f7aded99a96559f5fedc87e4eb21065628538569aa0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517644, "uuid": "809df8e8-18be-44dc-b189-d20467ab97ca", "comment": "Malware payload", "value": "b0a298c4fa7d4fd9e8a13129f0bcc155cce3d548", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517644, "uuid": "5cedfa75-3881-4dfb-b2d7-41ecbf059a50", "comment": "Malware payload", "value": "6e06f9abaf27c92ea5864f829d61c7b2e71bb33d6f52060cb7c369c63f583ef3a1444faefb420ca38b449fc0e1b4377d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517644, "uuid": "dd5814dd-47bc-4ae7-a3bc-be35c0dd5492", "value": "T1C8362382FB99A86EE9F3C3394779865A84068C56C783E3474951727C097BFD08E81FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517644, "uuid": "e954429e-08e5-400b-a224-4fb6eb4a9489", "value": "98304:CFDBFVKwrnx8VRmUEF35ga143bwtmXkqQFDO1mw2Z3XcWzU6V2x:CJbg705ga1Viknut2Z3XcKUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647517644, "uuid": "15ad38b9-6b6e-40d5-966a-c8292e7a2d84", "value": 5285735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647517644, "uuid": "a3580a73-4b82-41a1-adf0-9e59e8d1ae0a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517644, "uuid": "1942b68b-158e-4831-a1e7-f1d7f10b97f2", "value": "postbank.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a88f72f-a5ef-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647520905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520905, "uuid": "4a3d5968-121e-4d62-8b1f-7246d4a9dc94", "comment": "Malware payload (Heodo)", "value": "4337f755ce0e4e174853e2b9e26c0164", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520905, "uuid": "503a5fa5-d91f-42aa-bc5a-43f3f7d8aafb", "comment": "Malware payload (Heodo)", "value": "9a8a7fda56e4863c4ed9cc9340cc413005de3a619b1c9c790b007348597da0e4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520905, "uuid": "90a13157-7b6e-4dbc-bc2b-3f25036fac7b", "comment": "Malware payload (Heodo)", "value": "3e785993b27c0dfbb1e025bf7eadb3d392f11223", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520905, "uuid": "be4f0080-1c76-49cb-b24c-904e8dc708fc", "comment": "Malware payload (Heodo)", "value": "27709880acf04778b6da01b215379dd0fd304dc56272f9dc5e5a41450fce61a7835f4407227014dc3807e30c29f9cdf9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520905, "uuid": "ff45fe9f-1324-4125-ab2c-f358c77a2d29", "value": "T164A29E2CE921744DE3BB683C420650FA924A1C022147B5ED3991F77D6B73697068FEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520905, "uuid": "95e5e4a9-4d29-4167-bd3f-546a200fa093", "value": "384:X3uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:rsNs/zXtFCBn9kC+xbL42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647520905, "uuid": "f76b2d78-29b8-421d-a7f1-fc66ff05ade5", "value": 21657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647520905, "uuid": "3944f2d1-7020-426b-9dd1-adc5d11f515c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520905, "uuid": "89290959-6e73-40de-9ab8-5ce46a634a34", "value": "2022-03-16_1925-Balance.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4044e423-a585-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647475226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475226, "uuid": "ce4f0a61-3b6e-4d8c-a05a-07c22a088d3f", "comment": "Malware payload (Heodo)", "value": "64c5662f14fb8c2510159617d7691b01", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475226, "uuid": "9191669c-e278-425e-a6aa-b7d87076e22c", "comment": "Malware payload (Heodo)", "value": "9ae79d165817ea553de1e4d035a00ad2368a3da6b3513af65597eaa5f3e0e636", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475226, "uuid": "63acf535-13f6-46e9-bdea-90bfd54e69eb", "comment": "Malware payload (Heodo)", "value": "59701b558e41b708aca4865876984bdce73afbda", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475226, "uuid": "b44bff72-d7d3-4adf-9312-aeab54564a8b", "comment": "Malware payload (Heodo)", "value": "bbcb27a9286c9ab59e46a606b076fca571d754018b3abb0569496f750a820722e5a8e8c902a6899a14ef96e149815289", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475226, "uuid": "ece39331-f59f-480d-b09c-f1ead4364e04", "value": "T19BF4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475226, "uuid": "9c2de215-20f6-491e-8874-c57b0498c6d7", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475226, "uuid": "e809ddba-2eb1-4f10-ac5f-76698b96c3d3", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPvXvkgKtuBdfMAofD:WCBAdKV9Xf0k03KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647475226, "uuid": "c1aa4f0c-fb28-4a40-80d0-3fb9a2a28317", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647475226, "uuid": "9e66e3a2-9c2b-4edf-818c-5a578c725aa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475226, "uuid": "6d07410d-c522-4323-8b42-8332480da239", "value": "emotet_exe_e4_9ae79d165817ea553de1e4d035a00ad2368a3da6b3513af65597eaa5f3e0e636_2022-03-17__000019.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8138cab7-a5f7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647524298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524298, "uuid": "53eb5fd0-1814-4885-9086-82e540e8d3f5", "comment": "Malware payload", "value": "3aeece5cfcbf529d0f5427a7e72740e0", "object_relation": "md5", "Tag": [ { "name": "pub", "colour": "#C85B7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524298, "uuid": "06e24576-49ee-4eb1-a34b-8b2622fb8be4", "comment": "Malware payload", "value": "9aff1a17ed333f41577618a091ff9ae834064e3d90c992b56e6d6011783bf1d1", "object_relation": "sha256", "Tag": [ { "name": "pub", "colour": "#C85B7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524298, "uuid": "070445b1-a7b2-4fb1-8316-f82f021cb069", "comment": "Malware payload", "value": "a69d6aae2d007b6e939e96a270ffc69db6627cc0", "object_relation": "sha1", "Tag": [ { "name": "pub", "colour": "#C85B7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524298, "uuid": "4092ae75-8762-47d0-9baa-76194bc7e617", "comment": "Malware payload", "value": "a76a5b2e946c79fbf07d7f7fd32bf26aafb2d48041e0a517fc817f82dd8724bc4e46584ae49291751329d8270a52e9ba", "object_relation": "sha3-384", "Tag": [ { "name": "pub", "colour": "#C85B7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524298, "uuid": "e31e54ce-02fd-4a4a-bf17-bc1fc1bb8d10", "value": "T12E73E110FF52EB15D099473EAC67CBAF99117EE84D26050BF1A8772E1CBB990A950F30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524298, "uuid": "0e6e4207-a3bd-4bf6-8fe7-1422cc661e26", "value": "384:Q3EcsumGgTyMwRVmpQCTNTY2MZnNJ2bA1i38hOzYt60zAOwPjPxBhrNkxFyqyX:coQGXqPowy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647524298, "uuid": "bbe5955d-2fde-47ec-98a2-10c39166533f", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647524298, "uuid": "d9b9462f-124d-4aa5-aae9-41b370fb54d0", "value": "application/vnd.ms-office", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524298, "uuid": "aa44d266-ae42-4df2-afa5-0b5264ee4bb7", "value": "Purchase Inquiry_pdf.pub", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f72b0a-a5fc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647526646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526646, "uuid": "2e8a45c4-d615-4804-8228-dec12350555d", "comment": "Malware payload", "value": "b60df2929f8b4794e011252b94c6027a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526646, "uuid": "3f1b2328-e893-4380-8bdf-f23e084472c9", "comment": "Malware payload", "value": "9c280e9eb8810c5032cd036691238a204886d52636926011b839a7716da6e51e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526646, "uuid": "61e066b0-5687-4690-a065-0644e9bd1056", "comment": "Malware payload", "value": "804da91bb9c116e748cd425c6c15ade2007ed78b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526646, "uuid": "6ffc7e9f-741b-4833-91fc-4fe221d7b45b", "comment": "Malware payload", "value": "4d33e0444aa51542ab37239debeb91ddc4a3a8e52f5c28d2e9592f2175c88ee6bce2c36ec6bfdc68da9e5d1d0eb410e3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526646, "uuid": "4b70fc7a-d1ae-4029-bdaa-377f011645d1", "value": "T13A839E4033E49904DAA9077A8AE7A110137E7E176276CB0E2EDE32CD5D327C79912BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526646, "uuid": "7a793a16-e10c-46be-b60e-c27afd0fc0a2", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526646, "uuid": "1ad8655f-008c-4935-8222-73e40aee010e", "value": "1536:EqEFNDRSvi1Fo13eJG53G73mxdvdzO9qCDU:3EFNDEi1Fy32GhNvRO9qCDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647526646, "uuid": "b567e87a-70af-4762-9a3e-d6d8762c3d8d", "value": 84480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647526646, "uuid": "158e3603-caa8-472f-a20e-340111c1ea9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526646, "uuid": "89547494-4644-4efd-aae4-664d35c97be4", "value": "x.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df05b6e-a614-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1647536748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536748, "uuid": "9db4a9f0-c313-469e-9349-1b8d507337bd", "comment": "Malware payload (CoinMiner)", "value": "dfbeebd2d3a9d844a653ecdc57163836", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536748, "uuid": "96900766-ac1b-4744-a832-5c2a8ae74f70", "comment": "Malware payload (CoinMiner)", "value": "9d4fd14758e5b2450433ecba3c6869b1ad870f5323bb2cafab9449ae9a1a219c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536748, "uuid": "70595fac-785f-4439-9bd5-a4fec48d98b7", "comment": "Malware payload (CoinMiner)", "value": "242c8c7d95076c61f199dea341a05847f70884c9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536748, "uuid": "88c8ed9c-cc4d-411d-b518-fcf30a23e7d0", "comment": "Malware payload (CoinMiner)", "value": "573c31caa9e60963bf3dd66afd62d2e89ef60ad27091cb12f7c44c43e52860e5e1f96621db9f94171432d7d80c42e1d3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536748, "uuid": "0951b093-3916-479b-af86-ef014c6ae34d", "value": "T10583419D726072EFC867C472DEA82CA4EB5074BB831B5213902715ADDE4D897DF244F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536748, "uuid": "b9d8af86-48e6-4976-9502-edaec618a0fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536748, "uuid": "250a81fb-aa51-4bf9-96d1-c6fb507a5561", "value": "1536:UOUCxnGi467f1YG2VXvCxWdRv79YKbFfTqc6RkTMC5C:6Cxf46LJ2VKWdRv76KbFfTqc6RkTML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647536748, "uuid": "d1762f12-e80d-42ca-a7c0-00a53c0e882f", "value": 87040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647536748, "uuid": "e570d508-9530-4c32-b031-5c88ecb86c98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536748, "uuid": "a6c0da2f-5a85-4f5f-99ed-59a32e6708b8", "value": "35344724.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7bdf75b-a5bb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647498727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498727, "uuid": "ffe1f1db-7e7b-4891-b2a4-0281859ca8c4", "comment": "Malware payload", "value": "74d06c8b27adefe33d3b51c7a4724039", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498727, "uuid": "2d1af091-bc08-4fa2-a257-de2bc8fc743c", "comment": "Malware payload", "value": "9d5777d44cb17bc4ba3e04fc9b0b2f0abae9894eaedc51df93fe221c74bdaf77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498727, "uuid": "e1c67ac3-b824-4cf9-882e-70d0671dd64f", "comment": "Malware payload", "value": "f20e0b7580987c7ccf1ddae6b8f50a28719fe0af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498727, "uuid": "306e1976-37fb-4838-a0cd-d7ee08dd3e97", "comment": "Malware payload", "value": "884b0bd9774d34661579e0eac286f826c12cf0cb73ddca20d095a36481f7e360ead6f77673d6d8114ea19737c0145042", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498727, "uuid": "9b804d10-2402-4053-8a97-dae6a1456a00", "value": "T128A63314A3401CF8F1B1103275644926D536B8368760E98F5B68A23A9FB7FE1BDBEF50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498727, "uuid": "30d01fef-75d1-4b82-8c90-9ab26a405d21", "value": "c5640c7a22008f949f9bc94a27623f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498727, "uuid": "baa90f90-75c0-4333-b6d7-de46c3534773", "value": "196608:gvl4XkYUGx7/ICteEroXxWVfEqlbkkwR7VTEiwYgFQiAZ8kmzjNDXOjeGZ:O0XUU/InEroXgfEqirRRozYgKiAZ8kyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647498727, "uuid": "5a1f1fd0-9fea-425a-b72f-4648c98edb9c", "value": 9705910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647498727, "uuid": "829604bd-e8f0-46d0-b89f-9fe81d73def0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498727, "uuid": "acaec25d-cd65-4066-99bd-e02abf51712c", "value": "24851319.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c449cce0-a5eb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647519257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519257, "uuid": "eb4f1561-00e3-4ebd-bd73-3b785396fb2a", "comment": "Malware payload (Heodo)", "value": "fadc005659b6018e5b6c478cffa95cf7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519257, "uuid": "f4f7acf5-3e9d-4ade-aad6-01e40c28ee22", "comment": "Malware payload (Heodo)", "value": "9d6ece7f4f1439bef7e7db2f2bf36567c62fb3371df111fdc903ce639b106d28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519257, "uuid": "a100d8db-114a-4908-bbbf-f4454608bece", "comment": "Malware payload (Heodo)", "value": "cc965e547b3d93cce070e62000aefed1ec4e7d7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519257, "uuid": "b25bb67a-f303-4d94-bf2c-b29b62772a1c", "comment": "Malware payload (Heodo)", "value": "9ae3002c9ce206f7c11d019b77d3b3e31bd44b05d1d5daab9ee1c4945d14376f31d898b2c57d63b2a1292ba1bde7853a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519257, "uuid": "820ee799-6d8a-4df3-8d8b-2cb3de04b6a6", "value": "T1AC058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519257, "uuid": "5c24cc02-d249-4ac0-b54a-e18afe1884b9", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519257, "uuid": "608eab25-4ec5-432d-90ee-a529b556ef01", "value": "12288:Wvz1CLJyyvmMLSrBgD4ruGbPlVpqb+DlYzv:WJCLJyybLqBq4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647519257, "uuid": "4d16a714-0c3b-457b-84a9-bbf01a813cac", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647519257, "uuid": "f3031900-4721-4fe5-b3ae-d639526fe74b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519257, "uuid": "1e9a04c9-8bcd-4f59-aeb9-e7f6b966b193", "value": "fadc005659b6018e5b6c478cffa95cf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59d3cf9-a617-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647538237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538237, "uuid": "9ef0d862-673f-43cc-bd6f-6a67a36a9504", "comment": "Malware payload (Mirai)", "value": "ae5c38ed2fb69af2bc5f4d4956110b84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538237, "uuid": "bce9f024-7137-4df4-9a87-060ed473a112", "comment": "Malware payload (Mirai)", "value": "9e590326941dcf786a13a8aeab2d7660d2b7d7ae93fc92b5bdb51ddbd231ed1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538237, "uuid": "c5eb364b-9d31-4e12-82d5-89eca61c8260", "comment": "Malware payload (Mirai)", "value": "b061b2bd523efc0c37c0091975d46f8ab5d2fae9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538237, "uuid": "2f1c1693-ade7-45ba-9262-65703adfb298", "comment": "Malware payload (Mirai)", "value": "6dbc8da048dcaccfcb7baf95341014a591f3469d249a96b386b0b0a40dc9ff3863b8b7edcd667058c2133b35f12ddffe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538237, "uuid": "082b3f37-6310-437e-b754-e42cf715089d", "value": "T18F63F84AF8828B26C5C613BEF91D158D332253E8E3DEB2239E105B6077C646B0F67D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538237, "uuid": "d78cef95-82e1-4081-b452-5a8fb1799083", "value": "1536:H0nzhvCwk/3UNwuQqUkaduwaC6QRFq/Z/osFYzOPIhi0lWquq:YvfksN3QHkadGKu/ZoXlWquq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647538237, "uuid": "cefd8095-9910-42d8-848f-1d148d7f1234", "value": 71108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647538237, "uuid": "4ca55ece-a8c5-41e7-a598-f77f40c6ddf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538237, "uuid": "e3e1ef6e-5b40-49d8-8af0-dc601ae0f4d8", "value": "ae5c38ed2fb69af2bc5f4d4956110b84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83012d40-a61b-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647539763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647539763, "uuid": "ce50028e-2653-470a-805f-45ce5f23d54f", "comment": "Malware payload (RemcosRAT)", "value": "a884258f15c704dd04ac5c2fae9c8dca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647539763, "uuid": "2b8fddef-13f3-4f79-99d5-1a708ed0a4dd", "comment": "Malware payload (RemcosRAT)", "value": "9e5ede8160535eae10bd05d831b9276301611620d7b82e38ea1c8d75edcbd7eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647539763, "uuid": "99abedae-f691-4f7a-84e1-c603a9ed884e", "comment": "Malware payload (RemcosRAT)", "value": "1f97f64ce8f8598523d429c4ef77c4fd437bfcab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647539763, "uuid": "ecdb3aec-d825-4f82-8b84-73e72489e910", "comment": "Malware payload (RemcosRAT)", "value": "6dff868c539c147b6edd411dcc844a00e10c14ebdb4f44a9ffaaf894df0330744446fb581cf835c6b91ba7bcb03fdbf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647539763, "uuid": "824d0176-b337-41d4-a68b-b4cb42c3c2b4", "value": "T1B2355BF2A2508832D12236388D6F5EB9B4297E41DDE4A546AAE03F093F3C5B1FD11B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647539763, "uuid": "838a876f-847c-4dd5-b8e5-333a1ffdda53", "value": "066f2adf6884c84166ea572f3442e2f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647539763, "uuid": "a61c8c8d-c581-4baf-b488-b17c52a5eceb", "value": "12288:RbojJKNbgMwT2NRAvS/yqenMbJjRsBp8oziAO8Iz2sVW3MsqI6F3HAhcAszeVQ18:elKiCRAvS6qOMZGBNgzOqTHAhU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647539763, "uuid": "251a94ce-116f-4aa6-ba9b-749f8a03c8e2", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647539763, "uuid": "bc7bdb7d-eb19-4a5e-99dd-0c247594de39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647539763, "uuid": "d58efb42-57bb-4527-9ed6-acb5759c1cd0", "value": "File.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b5100c-a5f6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647523792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523792, "uuid": "50d3aced-a408-406b-913d-f38b430d7961", "comment": "Malware payload (Mirai)", "value": "4ad008183d815c311f33975ef81ad3b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523792, "uuid": "96436a25-a08f-4faf-97ba-d7cc7920ad0d", "comment": "Malware payload (Mirai)", "value": "9e80fae097901e9ea8f896fa58a870a6b22c2289d30e32677d90bcb21f9eca18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523792, "uuid": "c82796d3-a0d1-4547-8b96-69967a8eab04", "comment": "Malware payload (Mirai)", "value": "1935a489c4dd34a34c14e282ace0d108a8d98c76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523792, "uuid": "a9c62760-6a85-4dfe-8845-fae93c43b133", "comment": "Malware payload (Mirai)", "value": "6998c1eecdcb76af1ed1ea42db933ff381620dc18ea6b22cb0c38acb54ff60731c6a5d679f9601afeb05b60d0e664b1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523792, "uuid": "eac4aac8-adeb-43ae-9e02-3593753303af", "value": "T10AB31877A4654F73C045A5F125BA9A310F12AD931B1F1A88763CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523792, "uuid": "e072635e-f544-4ab3-986f-f9f2f8565391", "value": "3072:MDVLSItJP+Xsp4JlN3H5jmH1cuEgvniuN/:MDV+ItJH2l3H5jmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647523792, "uuid": "6e4a64b6-a7d1-4efd-8e03-5815bf54813a", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647523792, "uuid": "8617d2c7-4d93-4dc7-86cb-774334b196c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523792, "uuid": "1da3b4f5-4124-44ed-b37b-cb7019116dd5", "value": "4ad008183d815c311f33975ef81ad3b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b581150-a599-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647483728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647483728, "uuid": "d5ee590c-a24c-4d5a-a003-ae4241285fd8", "comment": "Malware payload", "value": "f6a822552cd802ad5c95e0e54cb0ee3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647483728, "uuid": "99b2f6f2-e448-44a0-9c69-5d7a537e21a2", "comment": "Malware payload", "value": "9ea91a681d290f7d835956e7449c1c9e2143a584b612999543633282c79890bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647483728, "uuid": "0596b1b8-7b26-4dc9-a5e7-7fe792336a7c", "comment": "Malware payload", "value": "071b2353adc52536cb935b94015d8dfe5d641130", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647483728, "uuid": "8b5234c7-90e8-415b-9c23-cea1eba3560e", "comment": "Malware payload", "value": "9767fb03eecdc0ea772ccf4a139290bb9cad47073a837cafc5468078b09e15baac007a4c2c23b668d1ec5354a70654db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647483728, "uuid": "9976525d-f653-428b-aa6a-6e53207b8495", "value": "T1E4351240BBA0D03DF4B706F8797997A8B92E79B11B2890CB42D51AEFA6306D0DD75307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647483728, "uuid": "7fb6d4f4-7b43-4070-9f9f-197b5267528e", "value": "909e4097670a3851d6a882270ed674ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647483728, "uuid": "14c17f5a-dd7d-4104-8b5e-0a1deb2de3c7", "value": "24576:mvd566v0/PTDXwmuFMNjDndx9uHaSx/QN6YNNx8nMjYdx3V:mdvM7DSFM/x9QHQNVSH3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647483728, "uuid": "ef336272-7719-4973-bd9f-ec4d62f67e2c", "value": 1148928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647483728, "uuid": "f0dd1735-4f91-446f-8ae7-ee5a69547636", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647483728, "uuid": "69e8e159-0a99-46ff-93dd-ddc383f63fb5", "value": "f6a822552cd802ad5c95e0e54cb0ee3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab90f2e6-a632-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647549709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549709, "uuid": "df22df7a-b007-4186-9286-9d65af780ed2", "comment": "Malware payload", "value": "b90c6cf0565dc6ed2ea2a1f5d8423bbd", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549709, "uuid": "3f4da318-2fa7-4856-970d-3a104cd4ec6b", "comment": "Malware payload", "value": "9ede291b890cbfd8ba296f0e9c0ba1fecee07a2db8886218d3b5afa1ab855dba", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549709, "uuid": "566bf8ed-29d3-40fe-80a2-fa63c0c3158f", "comment": "Malware payload", "value": "6aaa82d9d9b336022a94b327cac7ab442d610c32", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549709, "uuid": "418ca4fb-8501-489e-9ec9-c102c9dac45a", "comment": "Malware payload", "value": "381baf90b54c808d06c4637fc07f2513eea4aeb1b1b5a22d1a70e50b33e363098670b84d1351529e517e87c1e634ff71", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549709, "uuid": "6cc82dae-ff1c-4bb9-ad92-46105d1db3a8", "value": "T1B4D2814273589A2AE36D4B70D88BD6A4332DBE4D4C41421FF280BF7DBDB11B64A0275E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549709, "uuid": "1a35e362-7089-44ce-8a64-7bc338e89b89", "value": "192:HHlLfLVuRJeZ7bnLyt2AXSb7KfqOC7lcJ6SZEvAiq6/6rT5bk8xgNAOR6PtKa9YC:hT4RJeZ7rwOKpicJ6qiSY5UPEa9Y+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647549709, "uuid": "19069ad4-bc55-4e48-81ef-62d2818fac1a", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647549709, "uuid": "af08e08a-c6e0-4a7a-879a-39fdbd17d51b", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549709, "uuid": "9510f72f-9bc3-4e8b-bfbc-9be51df6d52d", "value": "SecuriteInfo.com.Heur.19049.27391", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0684052e-a62e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647547714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547714, "uuid": "863f42ff-3e12-4920-8758-f0bfcf1876d2", "comment": "Malware payload (Heodo)", "value": "d0921935dc016cddeeb077f2534e15e9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547714, "uuid": "5560628e-bb8a-409f-847d-b09b5d277bd7", "comment": "Malware payload (Heodo)", "value": "9fea5a406643e6755613bd29f6c57a9cd73f46ad9f2a3eec111b805f5fce51ff", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547714, "uuid": "add463ee-9076-4edd-b6b9-636b4f34d9fa", "comment": "Malware payload (Heodo)", "value": "5b5be56e7fd4313a0c3ba0c30b0c7ee304bcefee", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547714, "uuid": "cd1099b8-0a6f-4e43-9ccd-3a33bd7d65f1", "comment": "Malware payload (Heodo)", "value": "6133328e186062bd7700d5dd250a051b039def7932c28ac3a6c1077e4acd13c6b278dee315ea409e45e2237c89f9b527", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547714, "uuid": "5843b46a-3c6c-4942-9e51-f639159949d9", "value": "T126A2AF3ED221E818D67B987C830580F6E70B2C561007A9ED2D51F25D66726F7138FABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547714, "uuid": "16c8fd20-b066-40ed-9d54-7492e2e91827", "value": "384:yQZAVb1GNjJITo4CGzPd6ZIwVKb5CzgObff9kC+xbX7zL0crX:yTINqTo4FL3CBn9kC+xbLHjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647547714, "uuid": "044e2882-216f-4622-9eb5-43d65742ebe5", "value": 21461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647547714, "uuid": "53167f66-e65a-4518-87c1-03d34619c29c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547714, "uuid": "d1820039-978b-409d-9a61-d8129cf70e3b", "value": "Form - 17 Mar, 2022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf7397e-a5bb-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1647498679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498679, "uuid": "90699b56-9536-41f0-9b2d-adca44585884", "comment": "Malware payload (AsyncRAT)", "value": "0f91464b7b2922214dd3d8a8cfbfead5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498679, "uuid": "a8002f5d-bf1e-4911-8ebb-f7c33a172180", "comment": "Malware payload (AsyncRAT)", "value": "a03a750c266a3440bad4bdbf1a6539a5f3108d4b1701049167dce3c21b8892c9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498679, "uuid": "9abad71a-0d06-4bc0-bc5e-c3cf4c42c30b", "comment": "Malware payload (AsyncRAT)", "value": "8e5d54bd519a95331fe7dff5a0d5906b0b517aac", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498679, "uuid": "f39960eb-0683-4a16-9f49-4c6533e082b9", "comment": "Malware payload (AsyncRAT)", "value": "343d9322c7b2011fbe33b51db1bafd9472c356edd1a8776dfd8ff6c2f14c6187c97a908bce0d5dfedb9a29c032716201", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498679, "uuid": "2b3a7031-a316-46c6-b176-e3fe290c1f95", "value": "T108232B0037E9812BF2BE5F78A9F26145867AF2632603D54D1CC451DB5723BC68A43AEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498679, "uuid": "3e846729-c99a-4c9c-8e01-484a6cc882c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498679, "uuid": "3685e80e-c33d-48da-a601-dd26c1669a2c", "value": "768:MuwPvTpY8oiWUUGyKmo2q8r/q0CCMnoCp78PIsejbXgX3iboI6UXs07iBDZ2x:MuwPvTpTf2/4C4BsSbwXSMIJF7cd2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647498679, "uuid": "1bcea58a-a5a1-49cd-ae47-b95097fc277f", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647498679, "uuid": "a36b2127-bcf1-4f55-9486-1235dd9283e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498679, "uuid": "437cc00e-1ace-4d08-a563-7fca22ec6ef3", "value": "93720437.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a579613e-a60d-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1647533808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533808, "uuid": "caab591d-ddd3-414c-bbe6-04a611614e3f", "comment": "Malware payload (AveMariaRAT)", "value": "afbc94741871347de421f6166510e144", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533808, "uuid": "8c54d60d-cafe-4cf8-b20e-5136af193294", "comment": "Malware payload (AveMariaRAT)", "value": "a06df43cf78f226603a42ee45c6c676ecc9f5a6c978d3b3e18b364b116ba20fc", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533808, "uuid": "4a588cbb-7695-4bb6-896d-d0537890eb27", "comment": "Malware payload (AveMariaRAT)", "value": "b1ee3f6321eedb3e50a8e079bbe1fb98e41ad83d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533808, "uuid": "5d89e35e-3a72-4cf6-a5a8-579782039203", "comment": "Malware payload (AveMariaRAT)", "value": "fd1a7ed271345d29978cd12e03cda9211ae7f34601e57428963343404e06344889f74dd6527fc387b739096fb1ea83c5", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533808, "uuid": "ba4de04f-bb78-48f8-91a2-f59199179c75", "value": "T1DD2523FD22644A37CF7D4537E94580E61F72E667621EFF03398D28EA908B39829452D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533808, "uuid": "882d68ad-e229-4c3b-8881-4511294663a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533808, "uuid": "5ecec505-0e1b-4142-a9ae-23249ce704aa", "value": "24576:owODzu6ar9fw2maEoZ7OWwfmSTzZ+KhYk15IcZ4vkZVR:ofG6a62mVU7zwfmJ4usnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647533808, "uuid": "46d39a2a-3bfd-4d6f-aaae-f95b6b82efdc", "value": 1036288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647533808, "uuid": "bb2770e9-0919-4774-acb4-587ec3afd6c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533808, "uuid": "4af8c028-35f0-440e-82ee-821910bd1c87", "value": "vbc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79bf1f6-a5dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513330, "uuid": "8ba2a109-28b5-4fc0-8362-eeb1fa00259e", "comment": "Malware payload (Heodo)", "value": "1322cbe9e6ccb0222ed5280ad5a13211", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513330, "uuid": "862184b3-f893-468d-ad62-3a4fdd24b8e3", "comment": "Malware payload (Heodo)", "value": "a0aa2195984aa5247a535538b941d63918182923f3aa5c4da039e66deeed038b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513330, "uuid": "e63337aa-4ad5-42d5-95ca-59465dfff492", "comment": "Malware payload (Heodo)", "value": "211b2a8f63a3adb1059d4fa6d9683896fae46dfa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513330, "uuid": "dc7e1ad3-aa48-4560-a1c2-c1ca0b066d0c", "comment": "Malware payload (Heodo)", "value": "cfeaaa54b401a0f381dee57354ee9182e294bc02aabe157bc97012af92e4ff50b1c27158423d242cacbb62c91a0d4cbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513330, "uuid": "0224d2ac-7efd-4e7d-92c6-9d87a672c589", "value": "T103F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513330, "uuid": "485c4ff7-7111-4831-8ecc-2e47b8b92f8f", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513330, "uuid": "da0d68c1-5c74-4da9-a68b-d635e20104cd", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hz8rLneTfABCJoWRWwfpW:BeCCF88j+Xq8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513330, "uuid": "c6b9d08a-9eaf-4314-bb40-abb4484daba8", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513330, "uuid": "fb3b0d33-c30b-449f-a45f-3906f21b4f20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513330, "uuid": "41a2aafa-e3f7-4fe9-a4e0-23a664c1951e", "value": "1322cbe9e6ccb0222ed5280ad5a13211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681c0423-a5fa-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647525544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525544, "uuid": "687ce63a-79e4-4eed-82d0-ee7e8fe59025", "comment": "Malware payload (AgentTesla)", "value": "0903103f0e4ed8931a1fb316e58a4bee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525544, "uuid": "ff4efc59-91e5-4164-99c2-4cc2f8919706", "comment": "Malware payload (AgentTesla)", "value": "a0c3371953d59c8e30df713a05e21c633ab4496bcde543b727eda24cc8456116", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525544, "uuid": "007a0e59-3388-4964-951a-856e9d9885e8", "comment": "Malware payload (AgentTesla)", "value": "15d3dd2702a4c2a5d39d4fa043a3a7884f2c3447", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525544, "uuid": "6089c0f5-da03-41a5-922e-ba1afe2ebf95", "comment": "Malware payload (AgentTesla)", "value": "1e925408f0c9a74e6723d684c77426659d19d775f8f9951e92165e124279c53bfe172caa17c21c3fcca502170f846a70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525544, "uuid": "f8c24bc0-07e8-4494-b40f-4a1912211e74", "value": "T11BC49C3F15686373C97BD7768651101AF691D1EB7902AC19EED31B800D232CA7FC6A2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525544, "uuid": "3405cdc8-ba6d-4390-a078-7fd21254714d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525544, "uuid": "33d8db6a-bd2f-41c6-818f-729434d5352a", "value": "12288:1kyKRQTacZ2xb7QxUq1tgax8CjSRUcho/QI:1YQT9kb61tgax8CKQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647525544, "uuid": "e4ad9b9d-e9bd-44e7-957a-971e6e5790bc", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647525544, "uuid": "5f43ec99-c51c-4da7-aa0c-6931f4ccef5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525544, "uuid": "8e285022-3c1b-4852-9f50-b010e96772a2", "value": "Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a3aac0-a5e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518445, "uuid": "a23cbe89-3741-472a-b1b8-d734a0d20752", "comment": "Malware payload (Quakbot)", "value": "6184500a72c0eaa8633ebf96c02a8ce7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518445, "uuid": "fbbc8d75-9833-486e-9c54-79ecf3c036a7", "comment": "Malware payload (Quakbot)", "value": "a1095451d452076c9ebb47771b1cf5563bd97ec0c85c75b290dada55462b7b12", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518445, "uuid": "6d16a8e0-9951-4dc9-812d-12fb76a12d31", "comment": "Malware payload (Quakbot)", "value": "bf658e914a42d52e55207612c137f5b28066ea08", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518445, "uuid": "f1ddba8b-1ddb-4f9b-b7ad-b0a9444b2e8c", "comment": "Malware payload (Quakbot)", "value": "cf7314731470d5591cbffe09d9d1cfbc39366143c368621c20a409cd224a9289da5b4e4a249831db06470e4f2052adf8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518445, "uuid": "efc42f48-fa41-4603-a2b9-2c8792545989", "value": "T17225BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518445, "uuid": "fdf170af-0575-4446-bc94-a8b46d8e5c73", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518445, "uuid": "b87d9b32-3d97-42e4-b685-5886c25b59e4", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518445, "uuid": "c5f87762-eefe-4db6-9a6f-7f521746a10c", "value": 962132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518445, "uuid": "83f6540a-2862-45c9-a7bf-e9767c4e42d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518445, "uuid": "214de5b4-4098-4512-853a-a7d94b6216a3", "value": "a1095451d452076c9ebb47771b1cf5563bd97ec0c85c75b290dada55462b7b12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a6ca80-a591-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647480571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647480571, "uuid": "e415109c-06f7-4d37-aefc-212289cc2b63", "comment": "Malware payload (Loki)", "value": "aa558cb4ccc237d6a3ba87a505200777", "object_relation": "md5", "Tag": [ { "name": "bz", "colour": "#5E7FAD", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647480571, "uuid": "7790fc7d-3594-41c7-a891-bc0fe3e17e52", "comment": "Malware payload (Loki)", "value": "a10de49e3be47eb0bc5137fd5b922b6c44beee23aaa435a50745cc6b7c6e7591", "object_relation": "sha256", "Tag": [ { "name": "bz", "colour": "#5E7FAD", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647480571, "uuid": "f0bdda36-eec1-45c1-8b70-7a3a743d44ea", "comment": "Malware payload (Loki)", "value": "2b971160ebf0851da15383739c52ace7706fd080", "object_relation": "sha1", "Tag": [ { "name": "bz", "colour": "#5E7FAD", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647480571, "uuid": "03f43a9a-5da3-4e14-a2f3-f53e67c1a72f", "comment": "Malware payload (Loki)", "value": "0952c2c1a00331ecb0ec7a879c8b4b34506ab022d655e12e68727799ae31dae6efbe9bdadd2b96d1845ad4a55589c09d", "object_relation": "sha3-384", "Tag": [ { "name": "bz", "colour": "#5E7FAD", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647480571, "uuid": "70b6d10c-85ed-4c22-9723-71b15cc7b2ee", "value": "T14232C09412FAE530A86A85363BA227E6D8DA33F09ED7146F7A01FB1D1183B515338CF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647480571, "uuid": "f29c64c4-5d93-47f8-96ef-f7b66e8bf812", "value": "192:PTD+TEYan+fzTihso+mdPotFi8u3aABhHhqLD2A9E0k1Vizij7:PTD+TxaMzOF+m+Ffu3NBg/a1Viy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647480571, "uuid": "e378d711-14a7-4a22-a080-b807844f0e25", "value": 11680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647480571, "uuid": "23b67bfd-14e3-4583-b0c3-7080fe4bfea7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647480571, "uuid": "68de81da-c10c-4354-9441-1ce6b99a18c8", "value": "IMG-107110003023.bz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c757e5ad-a611-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647535583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535583, "uuid": "ddb96423-694d-4526-9f70-ff7b4da951e7", "comment": "Malware payload (Heodo)", "value": "f514032c418a7b8415057359febe02ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535583, "uuid": "f5869254-d49b-465d-bc29-e63f2d9ad91e", "comment": "Malware payload (Heodo)", "value": "a14dc5d86453bd357c361062f6832473174f129f54f58760cc239b0e1f399e71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535583, "uuid": "f2927b98-e896-4fec-9c8c-424d03e3c234", "comment": "Malware payload (Heodo)", "value": "0a6fcca495c5e796c617ec789f025f653a67c77c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535583, "uuid": "9d93a899-b72d-4d04-b8e7-1b9fb9120e65", "comment": "Malware payload (Heodo)", "value": "9f412d91c60be720a04337e5a1eba1bcecc7fc5dbe3e51ac83657731e08354e1afd2d6db2447c710d002f5923ab963b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535583, "uuid": "d089c1d8-d56e-47b6-b1fd-466166360da2", "value": "T16D059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535583, "uuid": "81af0805-296d-4d45-bdce-707da074ac52", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535583, "uuid": "fdea3646-fca8-41a7-bd4a-98d17f806a34", "value": "12288:KVHML2QJe6XxhqCWKQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqCQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647535583, "uuid": "034cbf60-99ce-4855-8e9c-1bb998f1d900", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647535583, "uuid": "0d3ce4f0-1121-4ca1-bd7a-7f4a7de58b2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535583, "uuid": "369edb34-60f6-46b6-af6a-1724c07df133", "value": "f514032c418a7b8415057359febe02ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0990aeca-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647518514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518514, "uuid": "1193d332-d601-4f4d-88ad-95e2703472b1", "comment": "Malware payload (Heodo)", "value": "e8428419d5a75f5308f92578134fc799", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518514, "uuid": "8039095d-d7f7-4033-aa5f-25eb9297db32", "comment": "Malware payload (Heodo)", "value": "a1676944428259804f866dd07cfad158c68ac7b98d69b325e157a7223235a2fb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518514, "uuid": "10b8bb1c-2f9d-4b8d-8485-eb05c57cac3f", "comment": "Malware payload (Heodo)", "value": "6b0b735bd524a11bc324cad784132666ec0c1dc5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518514, "uuid": "d5f3b931-094c-48fa-9c71-fd96152e23a7", "comment": "Malware payload (Heodo)", "value": "49dbb3c513e594b10aaf49af401f72424ac72e4ef869947b20f271ffaf2a45bf2a0173e3902c54cccafe5fd0438a5156", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518514, "uuid": "531bfba8-be46-4981-8673-100bf82f4937", "value": "T1DCA2BF3FD132981CE67F987C430440F6E70A1D86600765EE2C45F26E66726B6038FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518514, "uuid": "56f65da0-b76d-4aed-858f-26d10be7fc54", "value": "384:UHTyVb1GNjyo4CGzPd6ZIwGdKb5CzgObff9kC+xbX7zUSA:AuIN+o4FLYCBn9kC+xbLzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518514, "uuid": "a3a8463f-64d9-4258-8984-45d765cd811e", "value": 21444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518514, "uuid": "33188c58-7feb-4c1c-a3a8-8fd2026670bf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518514, "uuid": "1836b556-073a-4334-bdbe-5d46fb017b7c", "value": "526273544-72907246-Neuer-RV.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2563617-a63f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647555358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555358, "uuid": "7f496cf3-527a-4501-9334-06fd99c40fbb", "comment": "Malware payload", "value": "00034cb33b16eaa1ec681348880c87b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555358, "uuid": "a41c0eba-f4d4-4094-a8e3-febcf37ed74d", "comment": "Malware payload", "value": "a1b34e72ad731e52ad3eb1e93b08c461146282ea757b2595f7d3c4ad0887011e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555358, "uuid": "c208fabd-970e-43c6-8e73-135d68fef2ad", "comment": "Malware payload", "value": "29e5c500261e31db7247f5ee89a8cc2eac4f7839", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555358, "uuid": "c3019500-3632-40fe-a8d6-9c39bd4d0474", "comment": "Malware payload", "value": "91d93ce1bd1e86b6ed479bba6639c444890721da74c669ccc30a9c5e6e7a1d4157a5512d70efdb31f8be77f275b03f8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555358, "uuid": "24c659fa-c957-4a6c-b462-77106e796353", "value": "T1A6059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555358, "uuid": "58f31ef4-084c-4017-8619-fdb3cdc7510a", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555358, "uuid": "cb286b8d-e8aa-4b9b-885e-a24f5a206c78", "value": "12288:V20BXOMcVzpWfmmnDDcX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDYX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647555358, "uuid": "d898f96d-922f-4179-a1c2-eb1425b94cb2", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647555358, "uuid": "48af9ac7-eef3-404d-908c-5eb9c5a89f0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555358, "uuid": "55a0e759-c231-4c50-b449-d6d2de95df88", "value": "00034cb33b16eaa1ec681348880c87b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0248eb20-a5de-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513348, "uuid": "0effd16e-b8d5-4746-b344-141860bee557", "comment": "Malware payload (Heodo)", "value": "58d8aa89f8676eff7df87741fca4f725", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513348, "uuid": "5ef803b7-0298-4178-a91c-b811030792d4", "comment": "Malware payload (Heodo)", "value": "a226688e3c15cc13e5c773f4a8fc991759590cac6b82b46e86686d198f9507a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513348, "uuid": "cc2ca562-1df8-4cde-b59b-fcd729330ddb", "comment": "Malware payload (Heodo)", "value": "6452ccb8b7c7c4154e0d87433b86160549bf69f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513348, "uuid": "16fda255-5f9d-4fd8-8fe2-dec45be4a030", "comment": "Malware payload (Heodo)", "value": "10bc111ace38df5ca0b80f7f6986c144e652787e522484584062333d43941c428337842532d1166efa9033e62d334fbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513348, "uuid": "5873dfc0-8707-4e04-8b18-e2445b63c9a7", "value": "T137059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513348, "uuid": "fe482a54-0d74-41f5-8875-6e5741133608", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513348, "uuid": "6704cfe3-bb84-4861-9477-3ab8ea5baa2d", "value": "12288:KVHML2QJe6XxhqCW7QHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqTQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513348, "uuid": "892e412e-bb63-4642-be8a-3e2d9091ed7f", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513348, "uuid": "72a967b8-6e31-4fc8-bad8-92da3be2147b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513348, "uuid": "85c14211-8cb7-4840-9ac1-4f730e4ddc74", "value": "58d8aa89f8676eff7df87741fca4f725", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc491fd-a647-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647558518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558518, "uuid": "1186d200-1087-4999-9dfc-48e04c07b091", "comment": "Malware payload", "value": "70a70972ecbd71d255507e2e9fe33abf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558518, "uuid": "449c10c1-a57b-48a9-b1a2-9062dc4348a3", "comment": "Malware payload", "value": "a22f2392782c744b123bb9e42dc556af63eb5396f1b76871f98bc7822de10739", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558518, "uuid": "57da8452-1fa4-4d1f-aca2-b79d570f42ed", "comment": "Malware payload", "value": "4c1229499ae49ae76933007bef36e68169040c18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558518, "uuid": "5b5e8cb0-25ef-4c42-8bb6-44af508ea2f3", "comment": "Malware payload", "value": "eeee950b14cecb68d95ff3eb724216350d0cc7742097b01eeb20c7028e9636af90b3be7e24e3ae3ccecb90e24b93d1e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558518, "uuid": "1160358e-90f5-4060-a2bc-a6b5eccd14d0", "value": "T185059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558518, "uuid": "8ca7949b-0728-4ebc-8fb8-40cba7854611", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558518, "uuid": "643c6384-3976-4999-a661-429f3daf97fc", "value": "12288:V20BXOMcVzpWfmmnDDdX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDhX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647558518, "uuid": "3ad8b6b8-2582-456c-bc29-3f3fcbb09087", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647558518, "uuid": "32af748d-e040-40b9-bcd0-9c9910d37b9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558518, "uuid": "34178c87-d8da-487e-9745-4dce11c89eea", "value": "70a70972ecbd71d255507e2e9fe33abf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f682012-a619-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647538817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538817, "uuid": "c8adc033-c18b-437f-8c9f-511a0cfae8aa", "comment": "Malware payload (Heodo)", "value": "3efb5a77020c575fe15cc7300bf7320f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538817, "uuid": "782d6939-2d45-4d6f-8357-17595dc27776", "comment": "Malware payload (Heodo)", "value": "a23c51276f481ed24dce9aa4d338aee7f3f7175e230a1ec393060f4b97028710", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538817, "uuid": "b8d50da1-6a25-4a4a-91c6-73384745fa88", "comment": "Malware payload (Heodo)", "value": "71ba121c3690fdc56e3d15b4962e6db609693f93", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538817, "uuid": "7e84f763-72e7-4328-bb56-16434b247152", "comment": "Malware payload (Heodo)", "value": "76fb18952e05f5f775ee57451db28415e8d88bd2dd7a5fa756603a5c95f74921525a5bdcac19c1392cd52227506bc4b1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538817, "uuid": "4d57ec8d-9882-420c-afde-531493c50943", "value": "T15DA2AF3FD122E819E67B983C820480F6E7162C4A6007A69D2951F65D66727BB03CFB6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538817, "uuid": "f34fa5e0-47ef-4566-bb12-f32a17f311d9", "value": "384:6JaVb1GNjImo4CGzPd6ZIwwSKb5CzgObff9kC+xbX7Fg7a:oiIN3o4FLTCBn9kC+xbLF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647538817, "uuid": "01e47398-08d8-4178-9db5-39a073b0945f", "value": 21436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647538817, "uuid": "84b32191-3251-4b5a-9509-eb6f8c29cefc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538817, "uuid": "2bcba47f-5ad0-4ed3-bf69-ead13974880c", "value": "ohne Titel 1703.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a9633e-a604-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647529782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529782, "uuid": "576f3ac4-53c4-4fd3-b546-1761054077dd", "comment": "Malware payload (Heodo)", "value": "d8e25d105241d06a4488cee1daefce01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529782, "uuid": "df6d6608-bd33-4d01-bace-4c5fe31d73b4", "comment": "Malware payload (Heodo)", "value": "a271dceb313f6a4e731a571f70000f06c10715c0421100a25d4c6c5bf3e2e96a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529782, "uuid": "a6de5ff8-3c40-4e1b-b4d5-92b51cf372c0", "comment": "Malware payload (Heodo)", "value": "16e3f03f601b1db83b0b7a6b972003dfcbd78b8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529782, "uuid": "66bbb776-81ad-4f20-83cd-579688326e35", "comment": "Malware payload (Heodo)", "value": "7b949d975d378cb625a85d6b24bfec7bbebd22eeb8a7d0e2ef1b9d892d371369d451d282ae09e0bfc2af481d9c5bb999", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529782, "uuid": "a1e471df-9cf5-466b-92fa-47f905bb68ca", "value": "T1BB059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529782, "uuid": "8652135c-f892-4372-a263-78267ed60ebf", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529782, "uuid": "d488bf75-3d0a-4bad-a60b-792e45428b6f", "value": "12288:KVHML2QJe6XxhqCWLQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqzQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647529782, "uuid": "60fadb10-5f53-44e4-9af1-f42a11ba0973", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647529782, "uuid": "74ac3510-e497-4fad-8e1a-72dd7c654770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529782, "uuid": "be7f713c-10dd-4e64-98d5-dcf8f07e01f0", "value": "d8e25d105241d06a4488cee1daefce01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757ef2d3-a5e4-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647516118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516118, "uuid": "9a291d3f-ed1b-44ed-bc2b-ba14e8c36b3c", "comment": "Malware payload (AgentTesla)", "value": "2efa4a55647ec5673aac8cd612026d21", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516118, "uuid": "b33b8947-9196-4794-a4dc-0d2c45036080", "comment": "Malware payload (AgentTesla)", "value": "a306a3946f4b31aa9c89320318bd2060a71077850d735ec94fe1cef950d0d9d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516118, "uuid": "c62c3f7b-8698-44b6-95cf-efca42d8472a", "comment": "Malware payload (AgentTesla)", "value": "bfea50a9fd1af339c758f685fd343915cf440b95", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516118, "uuid": "dd36d053-8556-44da-809a-a29f844dada4", "comment": "Malware payload (AgentTesla)", "value": "6735d0676d03f084c8beeaf1a3b7dc11c529c42d4b266dd06bfd1c2a861b1f75241433ab1246aec2eb3d799bc7d730bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516118, "uuid": "4c3645c9-cb7b-4da2-9e66-c0f5f2dec84c", "value": "T11E45125A3BB48523E1AE03F164970448CFF0711A200AE76EEE81B5E85D633DD9E5F267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516118, "uuid": "768a8b03-a87b-4d5c-8e61-1db488ef4223", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516118, "uuid": "9e4684f5-def6-4377-b557-edd418878793", "value": "24576:1L3W9xDEMc1MDpvxR43wHfVC25kugYfW0X9SDpRIRV:1L3yxDi1qdxR4gHfVCgFgYf4vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647516118, "uuid": "0f3745e4-0932-432c-baf8-7f2aef40991f", "value": 1212928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647516118, "uuid": "caf6ecea-7ba4-40ce-b2d6-a2f4628d4333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516118, "uuid": "715b72c2-0dc0-41cc-8d7e-5f4232b27729", "value": "FFQ-2924 N-ANDALUSIA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b2a128-a649-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647559596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559596, "uuid": "54a98c23-bb0a-46b0-9ce9-8c44bd8370d1", "comment": "Malware payload", "value": "d6e88639c5e487b716bb59190f22d223", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559596, "uuid": "d1c28af2-9e06-4691-95c4-5843b82065dc", "comment": "Malware payload", "value": "a318f905035ef596e11499bf75de6ecf4fdfaf7b44ae27c318ae4612bb373c62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559596, "uuid": "847f8812-8422-4d11-be5f-4167d6115868", "comment": "Malware payload", "value": "f15d4a53f13e80bad0e7a7b81f54ec6a2cdfc8f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559596, "uuid": "84c008c9-1b9b-45f2-885b-9de6084ec32f", "comment": "Malware payload", "value": "6c1dcc7872d4e08340b70ad06ff1e8ea2af102b84485ffdf75950b0f2353c2510f9f52d505b379188df376893c602859", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559596, "uuid": "e8754913-9de7-43c3-996d-563f3b618eee", "value": "T1BD059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559596, "uuid": "5259e222-8143-443f-a053-aacea6dc622a", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559596, "uuid": "9211a823-2fe1-4e30-bacf-9119f908add2", "value": "12288:V20BXOMcVzpWfmmnDDlX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDBX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647559596, "uuid": "897abe1d-4e80-4c39-a478-00d4edb1d310", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647559596, "uuid": "06011827-f916-4ba6-9b27-700a8babe7b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559596, "uuid": "0c35d7f8-44b3-4101-97b6-0ff8ac35e1f1", "value": "d6e88639c5e487b716bb59190f22d223", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3414569f-a5fa-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647525457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525457, "uuid": "fd7716ef-cf4b-4a6b-88bc-57a4c36dae88", "comment": "Malware payload (Heodo)", "value": "1fe646b271360a9763f740c6f8f9af13", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525457, "uuid": "3753fba0-c011-4350-bca5-5b860787d1df", "comment": "Malware payload (Heodo)", "value": "a39e8b4a8ccfa495ea1c1de66be40d4383a32cbe44d4f70a2f9c47e8662d1f5e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525457, "uuid": "97c747ce-b5ab-482b-a729-e02c58cb2291", "comment": "Malware payload (Heodo)", "value": "5ff8c44e039f6344276f4827f5345cc8f2900086", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525457, "uuid": "dbebcf70-77ac-4bd0-9054-575d174e2eca", "comment": "Malware payload (Heodo)", "value": "f25368a8d4580ec38ba01ec578e7234dabb55e594f2056fb1fb3ba98d88f542b10925776f336e93df1e3a4b469c7f3e1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525457, "uuid": "257c3a4c-2e2e-405f-bc7b-f137e4304423", "value": "T1F6059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525457, "uuid": "c2ce500b-6109-4117-81d6-babb69f42102", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525457, "uuid": "0bf9b193-a3d9-48ba-8275-8da321dd07a7", "value": "12288:KVHML2QJe6XxhqCWrQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqzQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647525457, "uuid": "98808946-4d54-477b-910c-bee84d8150e9", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647525457, "uuid": "25f5e9af-dc46-4e3a-88a9-aeb5d525eb50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525457, "uuid": "1102b6dc-0a79-4f21-aecd-f7556cd74679", "value": "emotet.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b307ea86-a5ce-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647506772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647506772, "uuid": "7abfd73f-ec15-4ff4-aa02-f2eda9f08c08", "comment": "Malware payload (Heodo)", "value": "94c320440afbfe57247904176bec5bf9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647506772, "uuid": "b08364c2-193c-46df-9908-92244b811175", "comment": "Malware payload (Heodo)", "value": "a3a6ed2e7c9ab9c18e827483c87fb928ead08f3e00942d7074821312cb3a4776", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647506772, "uuid": "a5725ac2-e06d-4a6d-b8f3-2fbae2a120b9", "comment": "Malware payload (Heodo)", "value": "fea9bcc698033bf93bd3e23967c0c39da3d46d06", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647506772, "uuid": "be82124d-20a9-4ecf-99e0-cede69cfcb75", "comment": "Malware payload (Heodo)", "value": "70080e2058f2362d0dabeb34089a68901f3bc461c32c8bb65be152432ac1758858730d05ce8ec102740b0b22ac4527cc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647506772, "uuid": "1dca23dc-0b9f-4ef4-944a-09ca9a75ff06", "value": "T1D7059F7A2B43F27AC7E50DFC186002981A75BAB2C7F764272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647506772, "uuid": "123ad6cd-d7a3-4c26-9e30-5999d84b0e20", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647506772, "uuid": "4055a812-98bc-4937-8130-721ff6be4a1c", "value": "12288:KVHML2QJe6XxhqCWuQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqWQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647506772, "uuid": "2fdfbf1b-b5fd-473d-8cd2-8386f2d74330", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647506772, "uuid": "2f6fc1a5-c952-4b52-bdb9-230cf7a388d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647506772, "uuid": "4cca8b40-4d40-4605-a60b-82a281f8eb4f", "value": "emotet_exe_e4_a3a6ed2e7c9ab9c18e827483c87fb928ead08f3e00942d7074821312cb3a4776_2022-03-17__084607.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f994e46a-a5e5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647516769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516769, "uuid": "1bcb1a4e-c053-41a0-be06-a1b929f1ae1b", "comment": "Malware payload (Formbook)", "value": "fd765088c307e3ffc582d991b8b34201", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516769, "uuid": "6c3c0328-0b56-49e1-91b0-a2578976bbee", "comment": "Malware payload (Formbook)", "value": "a442c0b593cfc03d8088a7cadd1788c222b43695c066a4c58b66b840319368db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516769, "uuid": "a207de49-c14e-4558-87da-98f2f869e942", "comment": "Malware payload (Formbook)", "value": "49fdb23c1860cad1255389224ca280e5755c1079", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516769, "uuid": "aa0ac665-46af-4143-a6d8-746c21cfb70d", "comment": "Malware payload (Formbook)", "value": "822f0c1e49b013169a3e18ae20d7c768996ae668f04acd70cfff33ed9a70853cc5743444669d922be0492866c8a5463f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516769, "uuid": "75eb01a8-cf34-4221-ad47-8b877d617e6c", "value": "T17FA4F193F59005E7ED6847B298374C6816677EBEE9F0B80FA69E752067B31D3001B90B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516769, "uuid": "de6a68a4-b240-48ba-a9ca-82b098d2905f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516769, "uuid": "9ac176ed-f7fb-4458-a891-da388aa931cd", "value": "12288:qWXn9fy7V8zxLNArHFIBgqpL5LNJZWV8jkD1:/9a7V89LCTepLDJZWVD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647516769, "uuid": "f2b3b082-30fe-40d2-83d1-d781c08ec54c", "value": 472968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647516769, "uuid": "a9a2ed36-5923-4b05-8450-23b7dea94248", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516769, "uuid": "81b51082-736c-41f4-bd33-b3e0c73695c3", "value": "RFQ 97571784.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35904fd-a614-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647536838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536838, "uuid": "f1917bf6-a87e-40ef-ad82-c3c38fc88c94", "comment": "Malware payload (RedLineStealer)", "value": "57288d14db433159d42ac17f648d3e37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536838, "uuid": "7274fa96-7ebb-4eea-94e3-2bc01442c3d0", "comment": "Malware payload (RedLineStealer)", "value": "a4654e4d47d0052ceac2a4dabbf6d3e1d01145a78ed9a98dc49361621bacd46f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536838, "uuid": "bfda1b8b-9c6c-40c6-993b-d2e33601303e", "comment": "Malware payload (RedLineStealer)", "value": "f9cc823e4f0d2cf5491ec7bf427105beb00dbca9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536838, "uuid": "c1eb756c-b120-47dd-affe-e7eb2eabdf8f", "comment": "Malware payload (RedLineStealer)", "value": "5ff6caf28d29ce1f7f670f4bc544375ce37d1c41ce788d93505c12f3ef3774201ccae5f026047153c4b3557126e95d0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536838, "uuid": "62add0f4-d95a-4cc7-812d-a8f1ebb462e2", "value": "T15EA34DA973DD4A24E5FE4E7478B1615143F0E1A25C03E79F4EC4E0DA5E26F80EA12BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536838, "uuid": "52685c4d-5dd0-4540-86df-f98975b7380c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536838, "uuid": "61e2a350-0e6e-4548-bd11-898bda228dd0", "value": "1536:S0D0kCrDG2IlApcZG95SRN78HqMWZlfEmVGItFeLFbuTxErsvibL3B:SACrDGqPC9eqMoFFSHwvEDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647536838, "uuid": "e1e1092c-efb3-452f-9b6e-51ea390a26eb", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647536838, "uuid": "ffcca425-d8b1-43d8-8956-b384d607c591", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536838, "uuid": "e3cf1ecd-b1c5-4003-9cd9-43abea4b46a2", "value": "26976121.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f66e53d-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518577, "uuid": "b74505b1-3101-4419-b21d-67646fa9f248", "comment": "Malware payload (Quakbot)", "value": "11dfffc2648a2f0b046a0cf9455ec705", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518577, "uuid": "398c218a-e03a-44ca-8a46-60bd35c70e1d", "comment": "Malware payload (Quakbot)", "value": "a4abbf61e648843a5b9d565e22bcda72aaa2ed1238002fc7f35ebe5c27d9e3f2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518577, "uuid": "228a73b4-9088-471c-b09d-2774243ffa3a", "comment": "Malware payload (Quakbot)", "value": "1006de62f93c100d1cf67e6b00932de9b8bc9346", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518577, "uuid": "81d9e42f-bd33-4e2c-9d09-2b387df9efc1", "comment": "Malware payload (Quakbot)", "value": "679142b36164cbd49eca25129f2d7ae7d20a451a7d03c5f0330bdfa9fba4924b3d94b65f38d626b6669715acff497cc9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518577, "uuid": "c702bd50-31dc-4629-9b81-21b772dff7ab", "value": "T1B715BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518577, "uuid": "c5e2e097-f01f-4b6f-b8c0-18f8c398dc67", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518577, "uuid": "f2ba962c-27b7-4dd5-8185-9a0c7ebea5e1", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518577, "uuid": "3b7157b6-4c2d-48d8-a299-51665e486451", "value": 946391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518577, "uuid": "988104f7-8c7a-4241-8bbc-8c1f36bd9354", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518577, "uuid": "cb46d934-dc2d-4f81-a2f9-cb8c4fd4c9e0", "value": "a4abbf61e648843a5b9d565e22bcda72aaa2ed1238002fc7f35ebe5c27d9e3f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98b00c2-a60c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647533466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533466, "uuid": "7495445f-e579-42c1-9f6f-eb7c56bb9dc9", "comment": "Malware payload (Mirai)", "value": "b2089f7aa9a681fedfecc1c48b0fe1bb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533466, "uuid": "a13e4232-cd59-4d50-82bd-ab2369046c0a", "comment": "Malware payload (Mirai)", "value": "a4b883cb8aaf1d9677f9abdb154fb1ff1faa753b2ab0ee6e3743555121346619", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533466, "uuid": "b11e42fe-c009-4a6c-ba23-46fb9ad29b86", "comment": "Malware payload (Mirai)", "value": "68326ae07931730d4cb3f778a5c0afe294d1a4e2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533466, "uuid": "39ea41a8-73b7-4930-9f00-35b983a70ef4", "comment": "Malware payload (Mirai)", "value": "21ed8a3b1d8dbb838fc40ff103be737d6de4a223256b4210dfdfca1d28705de4cd2b9ba9220a92d584e7122af78e0a14", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533466, "uuid": "edd398a6-f184-45b4-91fc-ebf3dfc6c77d", "value": "T17213F751FE499A02C4850073FE0B43897B26C3F4E9FEB7074E266F492A4A466CFDB519", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533466, "uuid": "b1792786-62c8-4fbe-9e3f-53cd029d8824", "value": "768:Dl3l1TFyfPwz7Q4PXvN7fas1urtNlUZyHxMSf4aYwsJDmeVYdQ9w:NXTcXURuvlUARhf47JDmeVYdQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647533466, "uuid": "f6de82ec-aa23-4e9d-babc-b1e0a3c0e772", "value": 44080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647533466, "uuid": "7359cdee-7c8b-4751-a69f-0996f7c3a481", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533466, "uuid": "acdb9a1a-8ce1-4928-afca-192de33de6ba", "value": "arm-20220317-1611", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088ebadb-a62e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647547718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547718, "uuid": "3430e3e2-63f2-43f2-9fbd-9fd700151de5", "comment": "Malware payload", "value": "c9f0465f9864d0f4d3dc7beaf1748194", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547718, "uuid": "f00a8634-e158-49e3-b649-e8c3261b60c2", "comment": "Malware payload", "value": "a4fc34b42844531d99ff3b44709b0c15321b61abb3bf78af0f5b91cf1873685b", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547718, "uuid": "864ed34c-66ad-448d-b155-8f6a80b5e33e", "comment": "Malware payload", "value": "7b277c3b6ae2d9de9c0376c159d49e965f46537a", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547718, "uuid": "3aa56009-4ca0-40d5-a77c-d68311b8a2c7", "comment": "Malware payload", "value": "def6c26f6967790ab0d92a293df3fd786d0d84b0bf65bcfeb77385a05118c51ac03bf82255aaaecfb91b1486c9e8ffa5", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547718, "uuid": "061394b4-1249-4b14-bf93-b645622714c8", "value": "T18CA2BF2F9132D818E77F983C820441F2E7072D4A6007A6DD2C55F25E26736BA038FAAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547718, "uuid": "8ffb4f81-592f-4d77-b785-3344d32f63df", "value": "384:B5Jm7qVb1GNjyo4CGzPd6ZIwBKb5CzgObff9kC+xbX7Qi9rc5:B5J7IN+o4FLNCBn9kC+xbLQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647547718, "uuid": "0ae0403a-a273-4882-be5e-67196ede6ab0", "value": 21440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647547718, "uuid": "2ae09734-a666-4750-ada5-69403ab60e90", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547718, "uuid": "c2ede2b0-1a60-4e94-b01d-2894e1abf3a7", "value": "INFO_9415361.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6231bfc9-a5fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647526823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526823, "uuid": "32809f52-02b5-4af7-9d80-77a19c687143", "comment": "Malware payload (Loki)", "value": "81797ed9ed8ee52183f4ca16b936736d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526823, "uuid": "27e16ad3-335c-4543-b02c-bd331e53a8a8", "comment": "Malware payload (Loki)", "value": "a505328a745c9959c1b46492e0c9d5ad738002fa7a1785df07cd8e0d732fbc2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526823, "uuid": "b81366f7-7d8b-4705-bb31-e821b5f8b2ad", "comment": "Malware payload (Loki)", "value": "9ebcfed681c1c7c4798cbc77ecbfd2d95ca81e26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526823, "uuid": "3fa0d67c-70dc-4849-9f1f-0c6884c7cd44", "comment": "Malware payload (Loki)", "value": "bc313d77f4203ae1c2855a5059814b9a899a804994cce1ffb59d9dd22075500d24187b15ea9d5edba1cdfcdd07dcc25c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526823, "uuid": "06fd3e8f-5863-41e1-96aa-2b07159ad6ee", "value": "T1B1F4CEC1E98555A4DD58AB716A36CD3582237DFDA874981C28DE3E2B3FFB2D31022463", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526823, "uuid": "cce2d11a-95c8-40be-8caf-961b17764dbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526823, "uuid": "a16bde26-1853-4143-b1eb-a1afc2aba2f6", "value": "12288:ojKNrrPv99tlTfS+W1mdCxyB0vcYSw1cP7r9r/+pppppppppppppppppppppppp1:oM3v99/t7Cx71c1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647526823, "uuid": "7ccb890c-ab80-4e50-90e8-b1c6e87b5b9b", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647526823, "uuid": "ea1ecd60-056b-4ed2-857c-650ea014f347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526823, "uuid": "08f7647d-6688-480e-b122-db7bed8d79eb", "value": "Comprobante de Pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee67c0c-a586-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647475600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475600, "uuid": "e4f55e4b-3f60-49d0-8a5b-5225c2851c17", "comment": "Malware payload (Heodo)", "value": "8de6f0db50a0731d34a8943dd739e0dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475600, "uuid": "d2ac8fd1-a7a5-46db-8991-a5df79b18e5c", "comment": "Malware payload (Heodo)", "value": "a6276be3b2976a066cad14cacfd1264e75e7b1f99e0a588f4415efb55b80d6b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475600, "uuid": "87bc430d-220c-42d4-9d4b-5df8fb2217b0", "comment": "Malware payload (Heodo)", "value": "ceae5dc08531548f74fa3a46b9a66a4ddb3422bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475600, "uuid": "594f44c9-7e63-4884-b4f5-81e6b74bef4a", "comment": "Malware payload (Heodo)", "value": "6f1ae81c6789a736de651cc847e73604f81d0e57679fa22aa0a5d8dd590fafeb9224758cae401d36ffc2c9e3b19d9548", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475600, "uuid": "e66f6cdc-211d-4643-9ebc-689c1334fd4d", "value": "T1C4F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475600, "uuid": "86f27e53-b3cf-4e74-8b3e-fe28d4a8bcd3", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475600, "uuid": "da80b5d7-79de-4448-8761-dc087e42a483", "value": "12288:WZjb8BOPxue5dKV9M/98f0koP5XvkgKtuBdfMAofD:WCBAdKV9Xf0kK3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647475600, "uuid": "366259c1-e930-4cd9-9a3d-5a9f10b8f95f", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647475600, "uuid": "c02e24b1-4ae0-4c62-8611-c804141d8019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475600, "uuid": "f3617805-4d46-425d-a0ef-8ceba15738bf", "value": "8de6f0db50a0731d34a8943dd739e0dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474c2506-a5cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647507021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507021, "uuid": "5878a457-0342-41f2-90eb-742ad4f1153d", "comment": "Malware payload (Heodo)", "value": "adbb44d002b743f0db65606468e5ec3b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507021, "uuid": "ce561ea2-4325-433e-99e3-a3f12ad481be", "comment": "Malware payload (Heodo)", "value": "a889e5cbd15b9f14100a99793dcb485bafd0ecf69bcbf489fa9c9f6ee60a4e78", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507021, "uuid": "9cb2d1ba-95ff-45a9-98bc-0724faac0aed", "comment": "Malware payload (Heodo)", "value": "cafde1434eb38eb18fb36ce20b1395730b133c95", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507021, "uuid": "b6155106-e0bf-431b-bc2b-0524b515f863", "comment": "Malware payload (Heodo)", "value": "9fd8306b0e02d832c1523141d7224e984a6bb158fb764c318cff939f2e13f50fe82e4ed05336208f7f755d3adc4c9771", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507021, "uuid": "5a605134-a90a-429e-90bf-54bdd242a4dd", "value": "T108E2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507021, "uuid": "98be0ea7-14ff-4d65-9503-a6d4278109d6", "value": "384:cjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:cjpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647507021, "uuid": "d32f9203-0727-4271-b3e3-13a948a1e156", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647507021, "uuid": "70e1e0c7-88e4-4b40-9f08-861afec0f544", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507021, "uuid": "077daca2-6f6d-405f-8cd3-87bfca7a9905", "value": "6066556904373418125.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf40ca3-a5f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647524291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524291, "uuid": "18ffd341-a8f4-44d0-906b-37ddcbb960fc", "comment": "Malware payload (Mirai)", "value": "982874a78bea9914a8c8603a4ea5409e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524291, "uuid": "b81769af-b658-45d2-9b5c-8ba67144c4cd", "comment": "Malware payload (Mirai)", "value": "a94ad26685b1febd6d9fb7725b6508e33f7a19f05f43d227e4b469006e50c479", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524291, "uuid": "94fb1867-b3f2-47f8-b7b6-a33a11537273", "comment": "Malware payload (Mirai)", "value": "f0ba2487e48b351e92e84fcadf83bb623b460579", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524291, "uuid": "c53361b4-0f85-4383-bef8-52cd3c4b573c", "comment": "Malware payload (Mirai)", "value": "47120228199528f8e4c54a6d63aef2cdd5b68cf16e8c1a54e509b14fc2bc808072c736b15505227e3a684d9e601b2d4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524291, "uuid": "12389ade-b735-4240-9c4c-d85ac80002ba", "value": "T1C7C3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524291, "uuid": "d78d7454-804c-403d-8286-026703ec4008", "value": "3072:4jDy/+mh1vtbPIKaXbpcUPium7/L7QsvmGfIiNb:mOJ1vxfaXbywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647524291, "uuid": "0784421d-e8a7-4035-a943-50856db2bb64", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647524291, "uuid": "134f83c3-27bf-41ff-a5c0-44d8bade657c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524291, "uuid": "6cce5d7b-212b-44aa-a1fb-196e20c0e66f", "value": "982874a78bea9914a8c8603a4ea5409e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d1d83e-a5ec-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1647519608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519608, "uuid": "5d75326d-0b6f-47fa-8c62-f635b1e8e662", "comment": "Malware payload (Gozi)", "value": "9bab606355dd9027faeaaf3a92af29c5", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519608, "uuid": "e67a7d09-919f-428a-b9a6-861c9d33f06c", "comment": "Malware payload (Gozi)", "value": "aa061443567b8385559c74fbfa81609f499be77e11982f23febd93c366f8b89a", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519608, "uuid": "689a7619-cd9f-4962-8269-cfeadae2b492", "comment": "Malware payload (Gozi)", "value": "aa4d2658b05ea0b2d4c5c2c127125cb8a52f81ad", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519608, "uuid": "a9040300-85cf-4a2a-9b1c-654c1762403e", "comment": "Malware payload (Gozi)", "value": "4b5a45c8f0ccb4f9eb932d383be4e26e5f9632d15e2dfb9ec6e42080c01acc6e29f27820897574385efca1b4d28c21ca", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519608, "uuid": "4282ae92-1e13-47ab-b58f-00e92c7dd596", "value": "T1B1D095659D30E8CC434EB050C98D255D34D142208F351B7CC6150456D81CB8CD72E1CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519608, "uuid": "d4214468-4bf0-4d6a-b1cf-1faf6fe1433d", "value": "6:hKX9tSa2jkzozaqEHiO6snaYpXkGVokOMkfiqcVxWpCY:hKNtSjJ2qEHiqnaYuGPOZSbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647519608, "uuid": "c8a81d4e-e56e-455f-9c50-37836d29617d", "value": 259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647519608, "uuid": "37429855-bd66-4e3f-9d53-5ce8385c5a28", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519608, "uuid": "151a10e3-e4f9-45c9-8857-cdbb76926435", "value": "ps1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a2cf62-a5d2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647508260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647508260, "uuid": "e059868e-ec5e-433b-9b8b-08031e1c5c27", "comment": "Malware payload (RedLineStealer)", "value": "af3feaa59256bbbaf821cc6c1f41fa38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647508260, "uuid": "590e7573-bd70-44b6-b7fc-26f2480e3b2a", "comment": "Malware payload (RedLineStealer)", "value": "aa0e15fe454f98ad125eb59bf774fa53f1797bfcb9e5ea480942bdd116621c5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647508260, "uuid": "09f8be30-d760-49ae-82bb-40ec699e7edb", "comment": "Malware payload (RedLineStealer)", "value": "3a929cc99dbf9a631998277be63cea441f1c44ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647508260, "uuid": "a25d70e4-4fb9-4818-96af-35ab58e8fa6d", "comment": "Malware payload (RedLineStealer)", "value": "d137ce1e2053e7edc2acdbe0051dc902a5471c77d7e1a38a7d9110c650c7d60ff6a1b5c2d3c38b97e66517c4b424c025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647508260, "uuid": "d9746546-9420-4ad5-a305-16f3d2498093", "value": "T12E84BF40B7A0D03CE5B752F8797993A8B52E7DA15B2414CF22D62BDE16306E0DCBA347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647508260, "uuid": "ec55f923-c6a1-41ea-81e7-b815a04c756e", "value": "b472aaf48fca3ed6a184088234bd1425", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647508260, "uuid": "1f6b91d1-e820-4d8a-b28d-ba375c514872", "value": "6144:t0OwgdFMqbz5ug2i8cvk7Tch1yEYlUKDwbr3bimCbTuQm6w6glauVV:t0GdFMq3Ag2QM7T/yuwfLim9d/Jl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647508260, "uuid": "e1bdf942-34ba-4e06-a57a-27544f5a803c", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647508260, "uuid": "71da09ab-0702-4ff3-9995-f78d7b691884", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647508260, "uuid": "f41dc0c8-54a2-45c8-ae61-b7d963f423ec", "value": "af3feaa59256bbbaf821cc6c1f41fa38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ec6ac4-a5de-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647513683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513683, "uuid": "eda01d47-a651-4b94-a025-2affd4ca0f4a", "comment": "Malware payload (AgentTesla)", "value": "85202c1bae190f63ff759a87f4e62b6f", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513683, "uuid": "d5a2cc01-32aa-4c95-b0e7-c43d7c5c6095", "comment": "Malware payload (AgentTesla)", "value": "aa2ac41f10008827496f00d5ca55c3867fa92b1c73c66c9ee276870cb2658e4f", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513683, "uuid": "ccd26fad-d527-4bd8-aa8a-263ed097ccd9", "comment": "Malware payload (AgentTesla)", "value": "69adde9f41cf94fcc80495f4726b9142377d6e4d", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513683, "uuid": "781c3bf3-72e4-45fe-9507-1a2b9e7b55b1", "comment": "Malware payload (AgentTesla)", "value": "b9cb659112b93aee16ccbd97f77cd7439d6c78e4d5f42cb7dddb9531553600284e760c2f0278c4a7fcbb62de21887689", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513683, "uuid": "5d39bb27-e451-4595-a8b3-d62733861b18", "value": "T10D3523932AD0FFA45EC50B35EBDB879460242DEB5028442EDE893D77A1E7187C67DC88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513683, "uuid": "b3c17a07-0ae8-4d71-9bbb-6c0ed3444415", "value": "24576:clIzhzPq5XwNYWuG493wt20A9QCQqrvp9p8bc9v/0po0x4:cOdCRWNuGy3A20+YGwbUvcPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513683, "uuid": "8ee3b164-c55c-466b-b9c1-357b18b9fff5", "value": 1084595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513683, "uuid": "22a5c1c0-de9b-4aef-9c09-cbf720ef6396", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513683, "uuid": "ed1aa271-4a34-4a62-aad4-3d88cbbceed9", "value": "DHL AWB AND INV.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aba24c9-a5e6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647517039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517039, "uuid": "c05d4e43-32e4-4623-b4e4-fca12adb85c0", "comment": "Malware payload (AgentTesla)", "value": "2fddafc32614887aaf8dcd7636f7c59e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517039, "uuid": "f6bc2421-0c14-4ab9-9a8d-01a0f0cdb848", "comment": "Malware payload (AgentTesla)", "value": "aa37f1f2979f2bc0e337b25406f647fb5f6d7996b85ef272c93ef8f8e6596120", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517039, "uuid": "cf31df8f-5419-4ace-adbc-26cb695d7c66", "comment": "Malware payload (AgentTesla)", "value": "8ec7739765054c8ffae3be0cdf4c3a3a73a65d81", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517039, "uuid": "423a7e60-a541-4f9f-b48b-cbaed511a49a", "comment": "Malware payload (AgentTesla)", "value": "2037e3cbfa5521683ee392f6e32c3e6ac6d5981f9ec0f28237fd95edc4a1b773ff8399a8d677a90cca57a3936dabfb9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517039, "uuid": "d8530a56-7620-47b7-b780-be247916444e", "value": "T1E9145334A1F66AC9F896CEB28E61E609FFE70C919941821FD17439F61233B84C6451FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517039, "uuid": "22263a67-25af-4a29-bceb-770501277d1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517039, "uuid": "42ab6154-a2b8-4fd1-8e83-a28fb6bef3e5", "value": "1536:kWTyTumVmfwR7hqECKr1ZjhDIBPrEaO+dSkLiRN2E43e:xyOfwT1T71sVoaXSkLiR54u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647517039, "uuid": "661f26e0-4eec-4329-bad5-97f2b33856c8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647517039, "uuid": "b95574b4-40d3-4c7b-816c-a17af9e12818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517039, "uuid": "5687fca2-6084-442d-aefb-59337de13889", "value": "Bank Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d78653-a62e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647547707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547707, "uuid": "90564630-655b-43b9-9c2c-6f2d06f021d5", "comment": "Malware payload (Heodo)", "value": "de00d1b78115cbd6fee53c814c39c2a0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547707, "uuid": "071497a5-f919-46b7-8d15-6b2340678255", "comment": "Malware payload (Heodo)", "value": "aa730632ac24ddba1894ff24315b0389caeaa63c4d48efb27c0d08194c30da3e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547707, "uuid": "44713788-2c7f-4e82-977c-9a52a4849e57", "comment": "Malware payload (Heodo)", "value": "5ced70bb33d350c7bfad1e3ccc8aaff6b85e9023", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547707, "uuid": "90105bc4-e6cb-4f47-9464-c9101f08f066", "comment": "Malware payload (Heodo)", "value": "547cdfdb36baaa7a28982c48af25534e5c56c10b50269dd2815370fab3aef8db9cb80c0a555d6197199be0b07d7c3669", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547707, "uuid": "20137b3d-2392-4040-b708-7b06beda6a47", "value": "T174A2AF3ED221E818D67B987C830580F6E70B2C561007A9ED2D51F25D66726F7138FABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547707, "uuid": "f73b2b58-98bc-4c94-b884-1239d9d90867", "value": "384:mQZAVb1GNjJITo4CGzPd6ZIwVKb5CzgObff9kC+xbX7zL0crX:mTINqTo4FL3CBn9kC+xbLHjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647547707, "uuid": "6ff8a9b7-bbe7-4ce1-965d-20e781c189b0", "value": 21461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647547707, "uuid": "ced94847-eedf-4b7c-a2bb-373ea662c877", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547707, "uuid": "6b90513e-b6c0-4521-a54f-c68f866e2ff0", "value": "Address Changed.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f1250f4-a628-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647545340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545340, "uuid": "0df27a9f-a420-432f-89fe-955db1a091d1", "comment": "Malware payload (RedLineStealer)", "value": "1dadd66c280643ffacf62ef9db1a375d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545340, "uuid": "a5382846-a76d-47c6-b712-8bb1c2d2e418", "comment": "Malware payload (RedLineStealer)", "value": "aac6bc93e72a4a9f48809275318fc806bb36492e133540da69830241396bc71c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545340, "uuid": "11c9f0bf-6a8f-423d-a962-f9fa468706c5", "comment": "Malware payload (RedLineStealer)", "value": "87e66725598d27f0d4c5816b986444b6fc547534", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545340, "uuid": "71453d7d-25a7-4cd2-9fc4-2aec0cf3fb8f", "comment": "Malware payload (RedLineStealer)", "value": "8db803df8ebadc8bbc5059b846ab449a75377fd839698055858c9ad01461586e9b63ef9bab789fba881775bf4521f365", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545340, "uuid": "de93b10a-16e3-4af2-9cc9-839ff2c68863", "value": "T14F262363D254034AF9D0CC79C2377EE472F6432E9B807878A1DABDC7256E8D5D2129A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545340, "uuid": "c4f5dba2-fc79-4705-8388-712c55ed6f2b", "value": "b2ec5e305a410e6442f3911ef61575a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545340, "uuid": "501a079b-4f5f-4cbc-8d3f-6376ee632d6e", "value": "98304:fi74fagyNQ7uIdieYzIAU66mh/g8df0awNaFgywwOBEQaFRek:fiYtyNhg/aIj66QsawNswEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647545340, "uuid": "61bc45b6-743b-4060-a884-802b21718c96", "value": 4747928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647545340, "uuid": "5a57decb-f7fd-42ea-9e3c-ec9a9d2b2b34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545340, "uuid": "2969f4e2-2d2b-473c-9b63-79a5c791e425", "value": "12951244.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711a1e63-a5df-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1647513963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513963, "uuid": "651e383e-0717-4549-980f-0886149e4bb3", "comment": "Malware payload (AsyncRAT)", "value": "242a1a4a10d28b96431404e6a275f52a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513963, "uuid": "7948f9bb-3110-41a2-bcfc-90370541f69b", "comment": "Malware payload (AsyncRAT)", "value": "aaeea2518247c61576d04a680a02693dbb21cff050af2d3049f0c0636cbc478b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513963, "uuid": "9807c5b2-f8f4-4523-aa86-2a13d6a3bd11", "comment": "Malware payload (AsyncRAT)", "value": "b0959d12c43f326e5f32cf5f67ffdd968d79d46c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513963, "uuid": "dbfaa61b-50c7-4b40-9740-2eca37028dfa", "comment": "Malware payload (AsyncRAT)", "value": "19779588daef3621f7f371c451233c7d217bed36807771d568d4180ef27d8a299199876eca58731784d70dad5c228cdf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513963, "uuid": "dd746d48-94bd-46b2-9530-22a551ade574", "value": "T18C2512696BB8D923F1AF97F9B0530648DBF061462016D38EEEC274D81D537C8861F2A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513963, "uuid": "4cdae9fe-0e1c-4ae1-ac28-8e38d79d5f44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513963, "uuid": "e7dffc32-496e-42b2-9324-47d80e8276ee", "value": "24576:C3r9jkFloDNQO9+qT8GDHKidcR9Ic0u//C8od:C3RjkFfOQ48GDqEcR9IcT6vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513963, "uuid": "74dc2c0c-6909-4985-b3f9-d432ff440c2f", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513963, "uuid": "c2a852ed-ac17-4261-a91e-b833efa8503a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513963, "uuid": "aa16f60f-30ba-4d9e-9b9b-03ecd6113bb8", "value": "543456543454345434543_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d6578e-a629-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647545626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545626, "uuid": "f0050391-3646-473b-bdb2-93412ef53934", "comment": "Malware payload (RedLineStealer)", "value": "83f2a7b4fa3d346b88816bedb32c83ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545626, "uuid": "d55e6570-a108-4501-b899-50fda283913a", "comment": "Malware payload (RedLineStealer)", "value": "add5911470234648268e85f3563499b0150832f5b45c1870d7dabd0530d3ea5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545626, "uuid": "3a2489a4-8ae0-432b-8532-d944b9d75268", "comment": "Malware payload (RedLineStealer)", "value": "3697119bc4af6f57660a2887dac7736a8377aea4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647545626, "uuid": "ade17a69-c927-4c26-854a-e5cd53221239", "comment": "Malware payload (RedLineStealer)", "value": "c2a6f97692f44debb3cd1a7c7ff1fad51f3b1fbef6a2f26214b6120c15d06b5e25b429d2936ff99f6d87d5d64203ac1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545626, "uuid": "851da51e-73a3-4270-ae0e-5b5f3d0efab0", "value": "T1C936334B928A9F8BC190D0B185E367C86F16365B3C91E70AA072BCB509C1DF2DB5ECD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545626, "uuid": "bba9e7e9-0f69-4333-bbe2-2b71b397f464", "value": "dfec469ff9e19f9df882decc3c09398f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545626, "uuid": "99c28649-123c-4016-8306-1629a7a6757e", "value": "98304:zoVzwJuWpyTRTqbqmCbzjVQrLjtHAOxuhY:MVcJ7p4TqObzjVQ5pxuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647545626, "uuid": "5afcb3ac-efbf-4687-b4f9-1e5a484428df", "value": 4874392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647545626, "uuid": "97b37948-1acf-4698-99b9-63fd96ee7552", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647545626, "uuid": "03a057ff-2a08-45b4-9b4c-56607ba16e49", "value": "13808185.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ddfd808-a5d8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647510790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510790, "uuid": "3682d30a-3dff-42b3-b0cc-51c72b56860d", "comment": "Malware payload (Mirai)", "value": "229305eec5f7c721448007a46198d4b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510790, "uuid": "ba710d0b-fdd7-46cf-82f7-ac9fda33cc79", "comment": "Malware payload (Mirai)", "value": "ae0a1ab905913722a7cbd1bae963a63a498a61d75a91a01e84831cb2358281b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510790, "uuid": "545e1852-859c-4239-9286-2c8d834783ab", "comment": "Malware payload (Mirai)", "value": "33837c3762f6c5becd649380afb600a4ca0b7aea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510790, "uuid": "43d66c15-b567-4fc0-92b2-18887174ef89", "comment": "Malware payload (Mirai)", "value": "0871fe06f413dd0eccd5c2525a245bdae91aeab1a299892a1d9530d70f1d7f65a378c351b5512b570571e6fcfa3a04d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510790, "uuid": "3532a1c2-1776-4f4e-9b8d-34c0c14e5e7f", "value": "T1B5835A25BC3A2A27C0E4A07A11F78B1576E123CD25A4CA0DBD720F5EFF255902857DBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510790, "uuid": "f050a2a6-1be1-4ec3-a5fc-0600a21abadd", "value": "1536:TGrFs4S7GnwnfTKCnBy56Dt4bIY03U4yUsn9xB4rL:CGd4MG+Sz2U4vOxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647510790, "uuid": "2d9821de-6392-4c39-95c8-f99646890931", "value": 85992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647510790, "uuid": "4678b63c-03af-4634-9044-fa867dfba8cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510790, "uuid": "699565af-99f7-417b-92c0-099ac8fce8a8", "value": "229305eec5f7c721448007a46198d4b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d09142b-a5f1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647521526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521526, "uuid": "0d91f70d-eb15-4b52-b7bc-323e58cd6756", "comment": "Malware payload", "value": "88065b573f143abd38fd4fee29b9ff7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521526, "uuid": "b1ee3aa7-90a4-493c-9c3e-1e0f652ab1ec", "comment": "Malware payload", "value": "aea13d72450c7a5dfcd62a615f775dae60b1e936753b61720f110080fa2f82ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521526, "uuid": "004d3c87-e645-45e8-b368-b9d40fc17f6b", "comment": "Malware payload", "value": "dcc8571f0e78c408800a6208727e01260f771df2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521526, "uuid": "ed466607-d11f-450d-97d6-272061535c63", "comment": "Malware payload", "value": "6a4931cd32c8a9fec3426eee54056262c866ee75b888fb1840d76585e83d785457be9eb01d37c8a283c12eef2407c35f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521526, "uuid": "90db9ce6-33ce-43d3-87af-53d8b49d311c", "value": "T166F1C806E7E54337ECBD067EACB3175053B2E7264D13DB1E58CD815A5D633084AA2BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521526, "uuid": "a4658901-e809-4206-87e9-b8682fdeddc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521526, "uuid": "b663a8f4-a586-40a5-8b68-e61cde2ad0aa", "value": "96:1PyJOuzM2WGKoFRJkdBvKozt1IfW1QGGrQPzNt:0Wj8JGl3Ifn0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647521526, "uuid": "8cdeb6e9-09b1-4168-90bb-e3d665b67177", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647521526, "uuid": "74d30e96-fedb-4ad7-8b7b-39d8444cea4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521526, "uuid": "e4aebfec-72d9-419e-ba61-838ca83cf75e", "value": "88065b573f143abd38fd4fee29b9ff7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e4c427-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "f90d4918-2317-4709-89c5-51dbc63ce986", "comment": "Malware payload", "value": "4e555b7027720c4e63e1df68cbb2bfa6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "9e42dde0-0670-4038-b11a-4cae0f64ee33", "comment": "Malware payload", "value": "aecf9984cdd4bc9cad216d29eb605865ce68dd63223f2a3085e140bf99ef247f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "31592a7a-8102-48f0-8635-6f9885075a16", "comment": "Malware payload", "value": "6a0aacc74fd32406528ae38c9452c5314a1a6978", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "91f0651a-6911-4744-8c59-9da938b95a2a", "comment": "Malware payload", "value": "06c82f967124e8f47bdb63a13303809c6a505f29b792c4521d8974449ab729e7734421a6d3f66457a9a052dab16031ab", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "e634d48d-0d4f-43f5-9444-70b6164bcc97", "value": "T1CD059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "3ff25898-abad-435a-9650-65ea4c095681", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "89305225-083a-498f-a79b-d88e71c2cbbb", "value": "12288:V20BXOMcVzpWfmmnDDbX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDfX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553507, "uuid": "9e2d8efd-f3ec-411f-aa77-8d60ea5ecc38", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553507, "uuid": "04ce7a31-5c7c-45b3-b875-672a414e46c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "a1dad6f2-3c79-43e2-8a5d-3866ab0f8109", "value": "emotet_exe_e5_aecf9984cdd4bc9cad216d29eb605865ce68dd63223f2a3085e140bf99ef247f_2022-03-17__214458.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80b0b7e-a5ad-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647492688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492688, "uuid": "5e74f0aa-722e-42fe-a259-7027ba20b197", "comment": "Malware payload (Mirai)", "value": "84f8e7fec18716aeab5c6666db50ab6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492688, "uuid": "ddcf4ea9-7a2e-4fa3-8c12-5998f466cb91", "comment": "Malware payload (Mirai)", "value": "aef4f93fce938369787374d1b2d4ca4a8beaeecc978f37a48da0c9ba1e26e15b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492688, "uuid": "1642a8d0-c0d8-42e6-9778-0a394d22c571", "comment": "Malware payload (Mirai)", "value": "175d9d3d12dbe563fd20b5638d6d3751bcca583d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492688, "uuid": "5b97a231-1314-4fef-9136-36a551043fef", "comment": "Malware payload (Mirai)", "value": "41a32561fd6b030d60f3b44e94cd2ee88d9a6bbe7e101dc1b62acbacdb19c7d25ecfa1db71308341914b2b4d6b9e850e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492688, "uuid": "3679a5f7-4a06-4d64-82f7-7306de01cee4", "value": "T19A238DA5C5E9AD6CD2484AB4B9148A389763F80896D33EFAD601C3299407FBCF15D3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492688, "uuid": "4b2051e2-7306-4b3e-9bf7-49d34caa3165", "value": "768:NaCeLeUe4pg8Uh9FKwU0byWfs3IQ2+USbNCaoHGVO/bCGgBZZF:NaCSBvgDHFnUefs38+rB+H7/bCGgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647492688, "uuid": "2800d184-3abf-4db2-9de9-f609717f48b4", "value": 48220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647492688, "uuid": "6683f8f9-9659-4787-b26a-689074f7c1e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492688, "uuid": "6065db2b-7ec7-4871-82e2-9cfaa312097b", "value": "84f8e7fec18716aeab5c6666db50ab6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c300360-a5cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647507029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507029, "uuid": "2f974c86-3e49-42c8-848c-abb10986683b", "comment": "Malware payload (Heodo)", "value": "b257c7193eba4785c8bdc274b4f0cf05", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507029, "uuid": "884c016c-045d-439e-b064-ce0af8c2a745", "comment": "Malware payload (Heodo)", "value": "af24adfb4c3dba8b80cf83ea86bf1d68cce3e731bae5542a828538171afea079", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507029, "uuid": "c05c6f30-eea6-4d87-8f8e-153a730b0477", "comment": "Malware payload (Heodo)", "value": "26e254edd599c165a488dd6d469df86b744cdc1c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507029, "uuid": "d6188770-0581-4baa-889d-2bf4622a5e58", "comment": "Malware payload (Heodo)", "value": "279957c60ebde1747eb036665b458d4a4d187a277d14aea49b1fc0ca723b412f3dcafab94e74ac488442413c55f99ed4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507029, "uuid": "0588fd18-5fd8-42e6-8b1b-b12f837f1b83", "value": "T127A29E2CE921744DE3BB683C420650FA924A1C022147B5ED3991F77D6B73697068FEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507029, "uuid": "8d0f81d0-4541-437d-8cf7-71410815ed1e", "value": "384:D3uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:nsNs/zXtFCBn9kC+xbL42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647507029, "uuid": "b6a1a6f5-c917-4b80-9bad-9226e670019b", "value": 21657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647507029, "uuid": "78a691d1-beb0-469a-9351-a99d684a2ffe", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507029, "uuid": "11aa03f4-f40e-4926-ba3c-21bc33ba4118", "value": "Form - 17 Mar, 2022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76ce1b1-a60c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647533462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533462, "uuid": "39fbcd4d-9719-4e18-a8e7-7f30377f05a6", "comment": "Malware payload (Mirai)", "value": "26e99603ee638dd255e62cdc23f6b513", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533462, "uuid": "1d2d7341-918b-4255-ba26-5f7d790a6779", "comment": "Malware payload (Mirai)", "value": "af40cf0917b2a1b94cc39c7cc3927a210671644842fca19ff84288061b234f51", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533462, "uuid": "2cc5c7be-f006-4e79-af14-591f4b06e3d3", "comment": "Malware payload (Mirai)", "value": "0ca87e9947e5f6ea38738f93b4adc0ca81762d36", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533462, "uuid": "5bfd5a2c-d686-49ef-801d-f780bc7c55ca", "comment": "Malware payload (Mirai)", "value": "d698fbc75d0967dc67460d14648ff3ded6c17def8f7d5aa0561334dd56496acbce451811989c7b0b5a0ecc2afaf82f14", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533462, "uuid": "6b53e7e2-4fe4-41e5-845b-b8433ef1122d", "value": "T19713F7C5BD9AE760E400017660AA5FA2677ED4F93804DFFEC71DDB34AC46801AA076BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533462, "uuid": "e09b6c32-eeeb-40de-b20b-764727905f4a", "value": "768:e2Cz9JGJ2sHmfIZyqaAOU1kWGM3a3hvtBxoc7za:Fw96HGfmyqaPU1kW5YhtBCcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647533462, "uuid": "f350af6c-b483-48ca-93af-b7b98b3259ad", "value": 43308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647533462, "uuid": "de2c915f-df41-4d22-9ca8-c3a3113f3a5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533462, "uuid": "205d62ff-5dc8-40ab-8fe5-d40c922f7a79", "value": "x86-20220317-1611", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8e8fa4-a5cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647507028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507028, "uuid": "afb41b69-a18e-43d8-9ce7-ee488d7d1bbd", "comment": "Malware payload (Heodo)", "value": "45ec6d60961b3d8d02618c769045cb91", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507028, "uuid": "ea2b344e-6caa-49fb-9928-fd1ebb8b0521", "comment": "Malware payload (Heodo)", "value": "b0155b7f91b378725cb6dd875b522d1d412c3a4dcfcbc55ce2198a12d09b264e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507028, "uuid": "534b89a6-6ec1-4fd4-ae72-8f427d7bbd34", "comment": "Malware payload (Heodo)", "value": "433802a3d89af19753c5b7de5d93aba099c1bbc1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507028, "uuid": "aa5ff721-7c5e-44ad-9d89-540b33adfb6d", "comment": "Malware payload (Heodo)", "value": "4b452f38cdfcfc24659ab1fc1011223f68a30f75a1e0b9d9876f399be564f0b3bfc8fe598913b7af4844fc2f2f72adcc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507028, "uuid": "ccfd346d-29c1-4087-a8d5-c63b484e3780", "value": "T17FE2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507028, "uuid": "f7db6aae-77b3-4c1e-bb66-b6836d1e22f9", "value": "384:MjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:MjpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647507028, "uuid": "37c0f77d-268f-4ef7-9102-c9271454670a", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647507028, "uuid": "1819041c-1201-4c84-95d5-47607581af24", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507028, "uuid": "fe0a449f-1a84-4f93-aaf7-50c228a0e686", "value": "Dokumente 2022.16.03_0931.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed99413-a5e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518469, "uuid": "73644644-bf76-442c-8d03-56551946a8b6", "comment": "Malware payload (Quakbot)", "value": "97b6ba9cc03eae23375a97435a18d49e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518469, "uuid": "b09f267b-491e-460a-8a40-0712616a86cb", "comment": "Malware payload (Quakbot)", "value": "b01e1d80a49eff24c2432df06f59fff41cb9c634089dd2d7ba530de4f96651bf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518469, "uuid": "a43c6205-a263-4912-bfee-fb1a003a142e", "comment": "Malware payload (Quakbot)", "value": "0da8a447e11105962c5f6e982ae151b16fdfef82", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518469, "uuid": "bfb2a67b-121d-4cc1-8829-09c330d53ffe", "comment": "Malware payload (Quakbot)", "value": "e963509bd8d143cc3ce8fc94a35a555990cad0c06343713eb602e136be72610fcf31af6e0000eaa1ca73e52f74a96a17", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518469, "uuid": "114ee9da-5211-4d63-b96c-e012a9c4a148", "value": "T19615BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518469, "uuid": "2d21a511-a650-46b1-8dab-fa26ea4444ad", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518469, "uuid": "974094d9-0440-4599-81e0-35ac231dc854", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518469, "uuid": "e8921fcb-98c5-4451-a7cc-104d873b8406", "value": 960620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518469, "uuid": "f9703b81-1c43-4552-8a4b-b889bdc07a8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518469, "uuid": "90c74358-eb31-494d-adfb-9d40442df4b3", "value": "b01e1d80a49eff24c2432df06f59fff41cb9c634089dd2d7ba530de4f96651bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a55d77-a5bb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647498393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498393, "uuid": "3f315b84-08f1-43e9-9361-4c633347d7a2", "comment": "Malware payload", "value": "92f7367a22bceee62a867fd080cc9374", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498393, "uuid": "05514c88-07d7-43cd-8942-a4986079d5cc", "comment": "Malware payload", "value": "b08244867b687e32aa1690f2456f751c3d8f09491f68fca5215b2e30348e0b98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498393, "uuid": "d5071585-7334-4f55-b72b-b98be98cc1c0", "comment": "Malware payload", "value": "e725a05212ad54e10d8169f305a72cb2bced6cde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498393, "uuid": "044877e9-a62b-4143-a377-507f3c00a79e", "comment": "Malware payload", "value": "8e0d96b5dc37e4b43f37df833cf6a327c4770824fae67284d2242236f3be8ab8147ae8bd74fd6034b7768d8be4930e78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498393, "uuid": "b39cee0a-4617-4420-9f30-9f26dee3ed91", "value": "T119F1D851E7EC8237E97A0A316D736B0007BCE741DC23A7AE78C6411B7E526504B93B78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498393, "uuid": "0790c801-511c-40f2-9f73-ac4d61644e5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498393, "uuid": "03fbb441-f454-41d4-a060-311638f47d9e", "value": "192:KP92FlYMDzUAbN8ZoeaWsY6NQr1Heg8e9i:g2AMDQAbuZoed58e9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647498393, "uuid": "168a853a-0b0c-4f99-8640-a6f3aecee7af", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647498393, "uuid": "723c9c1e-9cbd-4a9f-aa87-9ba128fa0f50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498393, "uuid": "62fa6243-33bd-427c-97d9-6e560ce7bccf", "value": "67259493.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1aa9cc0-a601-11ec-9275-42010a9c0029", "comment": "Malware payload (N-W0rm)", "timestamp": 1647528647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528647, "uuid": "606c9a93-0a53-4174-b6dd-40b1df9e65ba", "comment": "Malware payload (N-W0rm)", "value": "71513e2b900fc13946ac30a5e93b6d3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528647, "uuid": "1806a760-a428-4d00-a3da-cc0ea590191c", "comment": "Malware payload (N-W0rm)", "value": "b12dc9f77dd4a3a212e426cbdb659eb2aaf9f53d2ab971330ae345e97d1f41a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528647, "uuid": "12c17c90-4eca-4820-9823-28bd81b25774", "comment": "Malware payload (N-W0rm)", "value": "dd9458f270a7177256336ce7b3499e20741632b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528647, "uuid": "1a9e444d-682b-4760-910e-afb802b1b9b8", "comment": "Malware payload (N-W0rm)", "value": "e57d0212fb49857625e9fc34bd882cfeb7a512273babdba1d1259fcc59907f623c3ceeb530f979ab54a78c64bfd1b3a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528647, "uuid": "886048d7-0d19-4df2-a437-549614862a12", "value": "T19784C000BBA0D03DF4B742F479799368A52E3DA15B2461CF22D62BEE56346E0ECB5317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528647, "uuid": "39d585de-8e5a-41aa-802f-6c85357ecd2b", "value": "b017e9be8dcb33abe5f710031058b5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528647, "uuid": "3d245b25-ab83-4262-9d66-1a1843210888", "value": "6144:WM1V9Sjldloxqs4Krlo8bvn/rzx1nXQTHmRYD1LBAxdopB+efT5:W0ajldlzsPrl5fTzxKFBAxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647528647, "uuid": "cda20420-d43b-443f-ac39-d06336d223bf", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647528647, "uuid": "3881da3a-0f74-4604-9387-4207fd17123b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528647, "uuid": "21c4e66c-1b51-41a5-b005-3ddac560a9c9", "value": "71513e2b900fc13946ac30a5e93b6d3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7761fb2b-a5df-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513974, "uuid": "e0fb309d-14fc-49a2-9148-4c56d8e8ab73", "comment": "Malware payload (Heodo)", "value": "46e2aabd9486fb0acd68d599a674b1d5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513974, "uuid": "24938a53-0e64-4dbe-a672-ddd65e1048ea", "comment": "Malware payload (Heodo)", "value": "b191bfd886484d4ba8ba822f2600c58448b2cc11aafda0a83c0a454804e2739d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513974, "uuid": "7762f3d3-a6f8-4a09-a6ca-abe4983c8891", "comment": "Malware payload (Heodo)", "value": "ba3fb8cebfe7a3564d081d655c026b31dc18b149", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513974, "uuid": "02d2fbe6-f3d6-4c85-8bfc-2256ac692263", "comment": "Malware payload (Heodo)", "value": "551278fe26e5d7652dac2ccbf4716c45b99b7847096b08442cd7c9f45adeb475eb3b202b439ae2c90a85fc904d4eb6b5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513974, "uuid": "fd232a85-15cf-4dda-bc02-d8be24d39d6f", "value": "T1E0058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513974, "uuid": "7e2b9ce9-d0c1-432d-9ac5-86cdb626a25d", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513974, "uuid": "fec74c80-d4f5-4947-b77b-b3144afa19ee", "value": "12288:Wvz1CLJyyvmMLSrBgj4ruGbPlVpqb+DlYzv:WJCLJyybLqBi4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513974, "uuid": "0ced9c27-d4c4-445a-b40e-217f3918dc01", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513974, "uuid": "4dc76ca4-b779-4be9-ae04-c21f0b052f7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513974, "uuid": "ff63fcbf-da66-4f98-aaf2-0215ab191e60", "value": "emotet_exe_e5_b191bfd886484d4ba8ba822f2600c58448b2cc11aafda0a83c0a454804e2739d_2022-03-17__104607.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a8c418-a62e-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647547716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547716, "uuid": "16e41ef8-4f6c-4ca2-b1a5-5958b255a20b", "comment": "Malware payload (Formbook)", "value": "38a68a5b4a7e0acb9d31af692bd45b49", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547716, "uuid": "5938772e-2e9e-4831-a44f-94b4976b859d", "comment": "Malware payload (Formbook)", "value": "b30f38a7b1c98ea7121fdece8c525e8bd7de24c9aa9f3b8f768148c85646672f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547716, "uuid": "e5708a6c-e6b0-4695-9442-2266c671b60c", "comment": "Malware payload (Formbook)", "value": "9c2dd8da3d8e8140bcc1147396f211cf9c0b14a2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547716, "uuid": "1f61a064-7ec2-4601-ad45-22b1239c789a", "comment": "Malware payload (Formbook)", "value": "aa418f4dde3cf6e9bf59c8dfaf2323dc84515ccb134b8596701ed307eb96fff477d32c13221bbeddc77d3dfdf2efacfc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547716, "uuid": "cbfe1e9d-cc89-434a-8ff7-4ebeaadd518a", "value": "T125A313413FC8A7DBA41CE2F724C95346C05E91B85337BC088FBF2CA53999B862565EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547716, "uuid": "104355f1-1e61-42f1-8291-a21f95e7e5cb", "value": "3072:K2av1TUD5VgeaAqTh6m3J+Oc8hNAtg4Lvb+D4KRF2:e1T6IejqTc38hNl4P0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647547716, "uuid": "2de773c7-9859-4e86-ac8b-1d4230606bc3", "value": 106188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647547716, "uuid": "bed73b9d-810b-4d7b-93ca-729304077ccf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547716, "uuid": "22a5f983-d233-4c61-bc8d-23dd29cb2dfa", "value": "F.T PHAGOCLEN PO#2020.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3744447-a5ef-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647520946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520946, "uuid": "9d7f1ca6-4c17-4b4f-bde9-670523acd26a", "comment": "Malware payload (Heodo)", "value": "a57562d87d1bc87395512f9313f2cea8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520946, "uuid": "1b1d8a7b-841e-49dd-bc5a-47b4c7cf44e3", "comment": "Malware payload (Heodo)", "value": "b33d85cfc9e615ddc445008bfe78f45e32fd936b494c38c740f5e2ae75d214ee", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520946, "uuid": "15fca1dd-a45d-4563-bf90-0dd026ab984d", "comment": "Malware payload (Heodo)", "value": "3371e7bbe2f40f17a195a2ed3db3d616dd0921cb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520946, "uuid": "3face3f5-f5af-4c13-bcbf-ca96fd98be44", "comment": "Malware payload (Heodo)", "value": "ea35f4d2f78bc4b7086b92add80c5dc0e70da190fd6317e2fa4bbb0ad68a4ea2715c25d266693395b90ae5954be21e5a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520946, "uuid": "77798ba4-6e35-4673-824f-c838bd7ce2a2", "value": "T1DCA29E2CE921744DE3BB683C420650FA924A1C022147B5ED3991F77D6B73697068FEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520946, "uuid": "5091a2b4-7837-4465-b38e-c9faf7f3b2ad", "value": "384:33uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:LsNs/zXtFCBn9kC+xbL42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647520946, "uuid": "1982593b-d278-41cd-8916-025888c52102", "value": 21657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647520946, "uuid": "c2db0b00-f88c-4e4f-8b8e-4f6153e4801b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520946, "uuid": "818da87c-e1e4-4455-b32f-6a9bc2b496a2", "value": "ACH_Payment_03_16_22.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2f2e70-a5e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647518386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518386, "uuid": "7987658b-0ae4-425e-8893-b93993be54fa", "comment": "Malware payload (Formbook)", "value": "33899614b3fe24bc02dfb4c1f84dabdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518386, "uuid": "8d9dfaaa-9896-4eff-bf60-653e68572ae0", "comment": "Malware payload (Formbook)", "value": "b36891ab4a7fa6be1680a65614dd5551a3fa8a89052c381a954601eedd82e62c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518386, "uuid": "b6445a56-89c9-4740-832f-98999eb73883", "comment": "Malware payload (Formbook)", "value": "8dbc988c06f51cce14e4cc95717241fb1521fac6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518386, "uuid": "746d9485-5b7f-435c-8555-7040e2166ae5", "comment": "Malware payload (Formbook)", "value": "9203fad3dcc1c6e7f4134d257cb42bb105d826fe15c84f5085de01833f7692dfcdc3b4b4a2388f39f0c2e9f61c502eee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518386, "uuid": "0e091dc9-6776-4506-bd9b-5056acb8423c", "value": "T1833523197BF49A26E1AF57F5E05309948FF4314A6107D79EEE82B4E40C637C80A2F16B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518386, "uuid": "6b712efe-d591-4e4d-a3d8-f7284b12b041", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518386, "uuid": "caf901dd-6119-4c2a-8987-1a93af2b3cd8", "value": "24576:e369+QVIUFEGtlpB97PpFf0esxYZFZfAn7MKycMxS:e3WHu7SlpP0esxYZf4ngKYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518386, "uuid": "5fc3f15e-be91-40bf-8e8b-b0bcebc44f00", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518386, "uuid": "bde8ad8b-f851-41c7-ab4c-eab9ac39d8d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518386, "uuid": "3018beb7-1b97-484d-abcf-118dbdeb3ed1", "value": "f5G3iGDs25iJjZE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884d9596-a61e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647541060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541060, "uuid": "df8eebab-89ed-4cc1-a91c-73858ab5382a", "comment": "Malware payload", "value": "a5fc74c817e3377d8058165994fcf082", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541060, "uuid": "639b3101-6069-4b9a-ada4-5f2f034d9384", "comment": "Malware payload", "value": "b37898842342a6b61356590fd31eeb54945f0762d68268db90680ce908d89881", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541060, "uuid": "33be589c-9016-46ef-b238-0d898ff623d8", "comment": "Malware payload", "value": "54b2001a038cc5ca6ab1c130c15240e1293f97da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541060, "uuid": "9e40ac6b-56b2-469d-a62f-cba671e70a7b", "comment": "Malware payload", "value": "1f2b4719bd6132cfbbbe0a8f8eefeeb20a109aae07dc0ade691fbaf88098642c0614cc2aed3bb846a7ba192ea9c7608e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541060, "uuid": "0536dbe5-95b2-486d-9adc-57e5a86cca07", "value": "T146058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541060, "uuid": "3c7f540d-5390-4757-8c67-af5a3e2de855", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541060, "uuid": "384553e0-0ff6-4f8e-95ea-01fbaff5725c", "value": "12288:Wvz1CLJyyvmMLSrBgR4ruGbPlVpqb+DlYzv:WJCLJyybLqB04ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647541060, "uuid": "39175400-11e2-436a-a719-f643ad911536", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647541060, "uuid": "75d08cb5-c00c-4062-a623-b5c0302b1f30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541060, "uuid": "79c639fd-8f72-497d-9228-9f75f9ca62cb", "value": "a5fc74c817e3377d8058165994fcf082", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "052d1ff2-a5d8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647510776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510776, "uuid": "1b38ccfd-e964-4ca1-8f4e-07e6fd939e2d", "comment": "Malware payload (Mirai)", "value": "4e462dcaa9c6993ac4607354577b1de1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510776, "uuid": "5a01fc45-4d9c-4610-a284-2d1a8ff5b5ff", "comment": "Malware payload (Mirai)", "value": "b42dfc716c1b8a6ed2e9466a994548c53cc275eb8bcdff364603e094df340cdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510776, "uuid": "bd320692-ebee-4e82-8e70-b347997e5d8a", "comment": "Malware payload (Mirai)", "value": "e518fcb5e6ed2af5e4e1d1eb69dc307763b25d1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510776, "uuid": "c86d5a6f-caf6-434f-9984-70ae8c00a3ea", "comment": "Malware payload (Mirai)", "value": "58c5cc3266885ac111999992b895389026e9e8229caaf60cdfb428720fb88d06d6fa0fc9e82ff2f509e631e26ccb50b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510776, "uuid": "3960d19d-b8c9-4e69-a760-4ac37da5f559", "value": "T1F19318B82995B37CE9F25079F84310DA2861061C379CD1E379D7A0BAFFB4B087169D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510776, "uuid": "81c404db-9beb-4088-9e1f-64fed5149ee5", "value": "1536:fnPE6/CGGsiCxnDgR4Npm7WT/WrWdQaizqWI:/s6qG5124NpZT/WQQa6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647510776, "uuid": "3ac0ced2-0464-499c-81ff-27df9a3f2773", "value": 91588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647510776, "uuid": "9180eeed-d32c-418d-a7e0-4451bb5f93fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510776, "uuid": "9ee5702d-5b0b-4f42-8756-026385c53850", "value": "4e462dcaa9c6993ac4607354577b1de1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5b953a-a5e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647518148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518148, "uuid": "32d9dbb2-dab2-41b7-b518-302c73f8e082", "comment": "Malware payload (Heodo)", "value": "d46f86e42f209e92ca5d9a4da0400f6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518148, "uuid": "085be96d-fdc6-45ac-a5c8-40382d766b73", "comment": "Malware payload (Heodo)", "value": "b4eb0f223fad26459bc88fa2b84b8e5874ce5b5b34642cb0423f8c6772019a7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518148, "uuid": "0c724f1b-b028-47d1-b062-b128e9fbc441", "comment": "Malware payload (Heodo)", "value": "9e9a149b5c446b2b94a335b0fca612a48ffc0ec6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518148, "uuid": "ef0d530c-a360-4087-9101-bf21e0a7a695", "comment": "Malware payload (Heodo)", "value": "8e62606ef68d0a4cc944515f7a3da28f49abc0620ed6be7e40a11f1b87972928b4fe9f8491ee90fd06b86ad09cee36f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518148, "uuid": "1d7f2f8e-7603-428c-9752-3bee070098cc", "value": "T186058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90117EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518148, "uuid": "7c4ef735-18d3-4d97-accc-ad739dbc8ace", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518148, "uuid": "849bae39-419c-43a2-b410-516108c07a10", "value": "12288:Wvz1CLJyyvmMLSrBgM4ruGbPlVpqb+DlYzv:WJCLJyybLqBZ4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518148, "uuid": "63ebb8f3-cdb9-43d4-9f19-88f5cc219d4a", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518148, "uuid": "e378cddd-adb4-46b7-9f68-a42ccb64e4c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518148, "uuid": "76c7572e-b202-40b5-a003-d5bc188de83b", "value": "d46f86e42f209e92ca5d9a4da0400f6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbcb26b6-a5e8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647517954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517954, "uuid": "8fa8eeed-5b2a-4273-8127-bde2d3da64bc", "comment": "Malware payload (Heodo)", "value": "a1be5abe895142ef9ba1e598e7788a76", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517954, "uuid": "673a41bf-cc3e-47f3-8ad9-ce55f899ee24", "comment": "Malware payload (Heodo)", "value": "b5cd9e2390685a01d746a3c8e248beac5c5ff093b703019dc876eb58e8713dad", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517954, "uuid": "4a44abe9-dd67-46d3-b21e-3b1fde6909f6", "comment": "Malware payload (Heodo)", "value": "cdb088fd03f0e56fb27a715be69b7058a2484511", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517954, "uuid": "bd41d500-1a11-4292-b9c7-0f9e91aa1f4e", "comment": "Malware payload (Heodo)", "value": "00c94e1be93c5038ee10f5dabafa0d2b6c4abad1bc00059c2b93564ab28b6b246b091a51d35f401cfaa3ddadba745458", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517954, "uuid": "137a3812-2009-46fc-a308-ae4f78c495a2", "value": "T1E7A2BF3FD131DC29EB7B9C7C820980F5E60A1D46200769DD2C51F75D6AB26BB038B9AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517954, "uuid": "1f9aaeed-fe76-4d26-b024-b6678acbb8b9", "value": "384:uHM0Vb1GNjDo4CGzPd6ZIwA1hKb5CzgObff9kC+xbX7qE7h:T0INfo4FLH2CBn9kC+xbLq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647517954, "uuid": "016406d1-3fd8-4ca5-beb0-1d9fe8a05201", "value": 21440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647517954, "uuid": "ba8aff13-5b7e-44ab-84da-92428f4bc631", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517954, "uuid": "5e38e2fe-cee0-42ab-a51e-33e4c22b327a", "value": "doc_7488325585.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec4454e-a62a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647546413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647546413, "uuid": "54a3eb2c-29b1-43d4-8587-e2bd8f92a851", "comment": "Malware payload", "value": "8b02bc3b8c7dbd028468890e02ded86b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647546413, "uuid": "dba7e096-f8d5-44b3-a78d-87d498be3040", "comment": "Malware payload", "value": "b647490526e98bfcc9ecb0e31e095ea3aaf4c955e00b934d18910d6138e9532b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647546413, "uuid": "831c0567-7961-469e-b09d-0225925d3abd", "comment": "Malware payload", "value": "0b4532b3ef57493fc6d780cf1f7cecf2c1860e1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647546413, "uuid": "661ccf12-d7d4-44ce-b6c6-3fa945ce4d1b", "comment": "Malware payload", "value": "cbd2f58b4fde14b7815649a716e2d9ecb07356d5a377b2700a47a3cf632a324be49e37653437c0b96151304a3d2ea07d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647546413, "uuid": "17047697-f521-4a7d-9550-f57ff8b9a00c", "value": "T12EC43B017896603CDFDA363601F7EB2531E75CB0677CB52E6EC168EC9B2628A051D63E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647546413, "uuid": "a35d9614-bffc-4bca-a417-173b9cb7fa19", "value": "fe91b35dbbcef6d3f3836ad3e8b836df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647546413, "uuid": "3d976de4-e1ba-4c3e-8600-6762c07db946", "value": "6144:xe4HnxyzcUzcUin5jBd4hp3CBj6O7O7OOuw/RRRI7E7E7E7Z94kx8888rLCkxEZG:56Kv+tEgqYdov6eimJEeTN+sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647546413, "uuid": "ad7c2c19-2134-4cf3-8ec7-a80ff97c5ede", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647546413, "uuid": "474059ee-dadc-4886-8296-f46123fa5127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647546413, "uuid": "4dbbbab7-339a-49c1-a530-b515f9a29e59", "value": "8b02bc3b8c7dbd028468890e02ded86b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab666c3-a615-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647537172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537172, "uuid": "1aa58ec1-8f28-44dd-98a8-8cea32159bc7", "comment": "Malware payload (Heodo)", "value": "4ad2fa7d4ff6e77382b07bca3cb624ab", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537172, "uuid": "2bbdcffb-e514-41af-b892-471536e2a55f", "comment": "Malware payload (Heodo)", "value": "b6517f9a089aef58b21746eb3072b010b1b884a61e09e7a7fc204a554dfaec12", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537172, "uuid": "c70533d2-1d60-40e6-ad97-199a8ac834c2", "comment": "Malware payload (Heodo)", "value": "b35514397c0e4da65d8620a3690b59e771242551", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537172, "uuid": "a2534fb7-13b7-4826-a601-94832026ed40", "comment": "Malware payload (Heodo)", "value": "e70385a5163b1f995671691e5d4bd75a137b1549755a139d1895789bf1dbe7d12b0191c28190e7a4dd2f906d37b95259", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537172, "uuid": "f8d5cd95-913a-4de0-bcf6-6f9b184681f3", "value": "T1B6057C5037818037E7AA58740601BA783D797BE38BBF72924E80957DEE704C3C768B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537172, "uuid": "496b9e2f-c57f-41a4-beb7-3e16458f85bb", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537172, "uuid": "1aa411bb-ca5e-4259-b988-f903a6e992fe", "value": "24576:xJjq8sc5JGxNNNNI+++++h3/UQUQiUj5URW2AeF+99V3kW5Qk45:xJq8s4uNNNNI+++++h3/UQUQ9v2AeEB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647537172, "uuid": "cc386ffc-cf31-4e0e-9977-52418a6d1e43", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647537172, "uuid": "909011ee-4f94-46b4-86db-d12895a7e0c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537172, "uuid": "5a4bfc47-9e2e-4bb9-a3ba-a082b775d566", "value": "emotet_exe_e4_b6517f9a089aef58b21746eb3072b010b1b884a61e09e7a7fc204a554dfaec12_2022-03-17__171246.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a043e002-a5e3-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647515760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515760, "uuid": "3651e4ee-eddb-4f1c-9ce1-ec794cdf63ba", "comment": "Malware payload (NanoCore)", "value": "203aecdff34cd31144d36d548c28de21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515760, "uuid": "4cb3f323-6c5c-461d-826a-84404a23c8dd", "comment": "Malware payload (NanoCore)", "value": "b670e88aaa879c857f3afa2ef2474b1b75659e23f13a3bde679290b6dca13e30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515760, "uuid": "59fbc3f9-715d-4a30-b0d6-f840b1fb396e", "comment": "Malware payload (NanoCore)", "value": "92c19eefdcfaefafac1165b03157a598f9f55f68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515760, "uuid": "e75c7ae1-ae44-49da-a658-291ba9594a34", "comment": "Malware payload (NanoCore)", "value": "d4008dcebf9da2079f9993ad85f6460c8b4127da39fd16b3df570c2dd0bcbb445d6464bd2a56a177cfd522765ad1ec08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515760, "uuid": "9fb45b5d-6eb0-436d-8a04-767f2befbcfb", "value": "T18735232D7B344A3AF2AF47F2909315408FB4B25A5416E39DDD82B4E81C937D90A3F25B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515760, "uuid": "590715b5-18f7-45c9-864a-fc30046b1f87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515760, "uuid": "c0ea9189-8f81-4064-be03-7d1e48e83121", "value": "24576:sZ3u9QxjV3mbgjaJEps4msEvVjHsO//JSHuV9bR4:Q3KsjxmbSwd4MVjHs+4Hu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515760, "uuid": "7e0a6d7a-2789-4aae-a1dd-1b96746365cd", "value": 1159168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515760, "uuid": "8428f387-779e-4da7-96e4-514458414ae0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515760, "uuid": "d0cecc97-0767-4215-99c4-45a12c15db80", "value": "order list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d20448-a5e8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647517763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517763, "uuid": "12238c5f-4f44-41cf-bc0a-dacd2109c364", "comment": "Malware payload", "value": "4aee2b0ace8bd367996becc7132c9c7f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517763, "uuid": "c512787d-bd09-4e36-ab83-8e3193d288ff", "comment": "Malware payload", "value": "b746180e317378820e6a7d2458db37f31a3540081c67364b79851d7cd83d6145", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517763, "uuid": "808000af-2829-49b2-86ef-fafc91dada4a", "comment": "Malware payload", "value": "06dbbbb09f6472f68e4103640a7621fe30ddc71d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647517763, "uuid": "b59a716b-bb32-4e5a-8c61-61dc8fd8e0a8", "comment": "Malware payload", "value": "05f59719bc917e060bd9aa6dfdebf91464cedc2459a8e130dae5e9e387203e61386f730d823808ca161d8fdad5dd1b9c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517763, "uuid": "0e5b6ad4-3d25-4d96-88d8-9c7784e8f73c", "value": "T1AF462346F7D5A45EE9F7C3388B39866B94028C5BC743DB4B4955B23C087BAD06E81EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517763, "uuid": "0d64a09d-3f77-4dce-bd57-7b12ce5bc201", "value": "98304:B86LDBkiKrW67xXbnq+0Nu4HmH4PLFyEccu8KzmIdhFCJDwSZE/+3oz:W+DmiKJJeTjvu8UmIaDTZE/tz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647517763, "uuid": "1104ae88-7bdb-4295-9a9f-e165ec101230", "value": 5515104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647517763, "uuid": "386baa12-9672-496b-95d0-0dab6517af36", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647517763, "uuid": "e227c41e-5875-49d8-8bcf-1e35ef4e4f83", "value": "postbank.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f76737-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "2dc8226e-1e6f-4221-a90a-b009901007a8", "comment": "Malware payload", "value": "a829d4c26bea678af3b39e6b9a683100", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "4b54392b-0a36-4f3f-aa13-e7d13f53fafa", "comment": "Malware payload", "value": "b7c82e5a07d555c037c0eb09851a6d7e0ec5f86609ace3fc3a47d0d52af4e8e7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "47dfe299-411f-4afb-b676-31e3189c0856", "comment": "Malware payload", "value": "06e9827d0ca2901a823b83753122df7f740ceeb6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "03ce7fef-71c5-4542-894f-c003bce17b4b", "comment": "Malware payload", "value": "43f4e5af57953929a659b8d1e7910fc1a53b54c797aa8b561d499a5429592a116dc5c78fa0c310d175bd14c9d8c9ee26", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "2c8f1e4a-bb5a-4d38-aa7e-facdd34be18d", "value": "T19D059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "2490247f-3fa3-4bf7-8d4e-64ef3a12623f", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "59165eb6-9539-4d8b-811f-dcd6dd4704d3", "value": "12288:V20BXOMcVzpWfmmnDD5X5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDdX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553505, "uuid": "b1d1d5b5-18cb-4c18-bd8c-b968ce62663f", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553505, "uuid": "89d0f951-01b0-43d0-ad5c-3bb8d0d750f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "a32c693d-4d8c-467e-93c5-650c2388e0d1", "value": "emotet_exe_e5_b7c82e5a07d555c037c0eb09851a6d7e0ec5f86609ace3fc3a47d0d52af4e8e7_2022-03-17__214456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136e7ac0-a5fb-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647525832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525832, "uuid": "11059674-bb5e-42d2-a2c7-0cc23144b7ef", "comment": "Malware payload (AgentTesla)", "value": "de298ad0c881fe2599060cdb9afd9269", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525832, "uuid": "f462a461-b50b-4c9d-b834-115279202efd", "comment": "Malware payload (AgentTesla)", "value": "b7f28aa8f0c20279194cbb1ef5288e42f29f9456f365acecdc3dfc8cdc87eab4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525832, "uuid": "068481a3-cd23-4105-90b4-0082cc6c4be4", "comment": "Malware payload (AgentTesla)", "value": "69984a43ada1e0e7d6261d2b897d3b6ff6369bc8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525832, "uuid": "417efa62-2017-4100-9e06-1f57d365d221", "comment": "Malware payload (AgentTesla)", "value": "88646cb6df2c398a82f9dd12274505601cc9b1ce1dbd561fd20a293d4617e437c2471081c2398f8e29ccb49fb7b6ce04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525832, "uuid": "cc92cd86-3c34-421a-ab39-c79bb4983f72", "value": "T1E6242A5A6755D521CB6F527EC01A821831F1E703972AD38F59A2D8EA1F832CDF90BCD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525832, "uuid": "0f67692e-f54b-4594-975d-cd7cb4d6b19e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525832, "uuid": "c7191092-0f53-4807-b819-b88afc91cfc4", "value": "3072:F++G5Nw3CUm5X96uKWqu6lkUtVU/qFp5CRP47vKA28FLdeDxhKk95rXlw4EvUOlL:cR96uKWqu6lXUW6kC8ehb5xGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647525832, "uuid": "f75c9504-9acc-4f31-bdf2-8cca0ac7419a", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647525832, "uuid": "2c9ff208-885b-4897-b856-a46009e4317c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525832, "uuid": "0ecc284b-1c14-4fc8-96e3-63cc56ae5008", "value": "YJCkVJeHVaEZaprzrMPyQWvMXwpFFxaGRU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831c68ce-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "98042e8f-a9bb-43d3-a572-ae8067cd55d9", "comment": "Malware payload", "value": "a1a30dbe3030e675c9f653092191ac4f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "d3ae99a2-77b7-47a8-9095-b4512f95a6f6", "comment": "Malware payload", "value": "b800a5810e7db5054215e428d4208ad7529cfa48f1be9f09ad65fdf9ef1e1e1a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "88760601-7fff-49b9-be92-098ee1325c1f", "comment": "Malware payload", "value": "bb5c0180f1fcb31de91ed3876b0ebd8c83c9e8f5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "506fe2b4-b1d9-48fc-b6d1-ab769956ab33", "comment": "Malware payload", "value": "210be176b165341936badd68fff8b900049b44a881eec255feb40f9759c50457b2ad962e6f29e54ef9b4ed908e69916d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "3a047f9b-316c-48ad-9efb-8def420aa415", "value": "T12E059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "cca65c20-0f87-4702-bb4a-c2914ac059c4", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "723574c1-3c33-4fe5-aa78-f05ce64834aa", "value": "12288:V20BXOMcVzpWfmmnDDmX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDSX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553507, "uuid": "a266e79b-e124-45b5-a597-8b206fab7dde", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553507, "uuid": "679984d2-58d3-4fd3-8532-608f6cb955e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "98fca7e2-b5d8-41ab-b8f7-07fc6c9e5039", "value": "emotet_exe_e5_b800a5810e7db5054215e428d4208ad7529cfa48f1be9f09ad65fdf9ef1e1e1a_2022-03-17__214458.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a12d0e-a5f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647524284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524284, "uuid": "739edb6b-2501-47e7-962e-d11ee23c4e89", "comment": "Malware payload (Mirai)", "value": "a20c7a277d8f89904f167b69c995b25a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524284, "uuid": "d2096517-b9d0-44cc-9a13-305a61e560e5", "comment": "Malware payload (Mirai)", "value": "b803fb1ef3087e3b4cfc8e722f6545e0f6d61d4431ce4422c9f6dbe5c5983168", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524284, "uuid": "418a8ccb-32d8-4522-9dfb-7d04444d62ad", "comment": "Malware payload (Mirai)", "value": "265c1e60a144cf7d9fdbb03cb43428fcaf6542c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524284, "uuid": "be30b2f8-3383-409c-9825-0503a1acf94e", "comment": "Malware payload (Mirai)", "value": "c31f080182a597ca7a3e9c441755428852c7f58a3432dcda44b2befcb9efe34cbd17366fea18b515f5abf16c806948ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524284, "uuid": "8a1d035d-319d-4223-bb91-8b541fb3a149", "value": "T109E32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524284, "uuid": "4446ebfe-34c8-49a1-980e-62fbb15422cb", "value": "3072:Cv/WwsLgaq353qHiCOvhOp9qkDQHbeskmhxQwoVSUNu:KPLaq351hOp9qkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647524284, "uuid": "1018f801-40d6-47eb-94c7-d63cf0cb8259", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647524284, "uuid": "8a3ca7a5-0937-4ded-949e-a13e944e9a3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524284, "uuid": "4c31f39b-8d69-4edf-a4d4-96a38bc15f3c", "value": "a20c7a277d8f89904f167b69c995b25a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4c812a-a5f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647524268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524268, "uuid": "44f18583-5673-443c-a4d2-5e9d81788eff", "comment": "Malware payload (Mirai)", "value": "bf908c76233331d9afac8d8b7cfc787e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524268, "uuid": "890d44ee-0fa4-4821-832d-0a214250a61a", "comment": "Malware payload (Mirai)", "value": "b82f679692f0408078f62ee739abba6bc1bea360f591860ef09d43d43a8a6dcb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524268, "uuid": "33d42742-6e22-4c29-b25b-97dce1514828", "comment": "Malware payload (Mirai)", "value": "ea266a360b029f754370219d2216e69d059f56e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524268, "uuid": "a6f284d7-9927-48f6-8297-2133952ba044", "comment": "Malware payload (Mirai)", "value": "a7c056197df730615db97b63dc1673331423e1993e9889d64e68572b34f8a7b30c6aca387b374519f60bdd1fdeeba430", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524268, "uuid": "b12f246a-2dd0-4803-bee9-ffa9912205a9", "value": "T14DB3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524268, "uuid": "c4bce6c6-ca9b-401a-9251-4a793f58b1ec", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZSoamm/QcuLB1niDNb:YuFX0GIk1MHyphHamm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647524268, "uuid": "1e5a8b03-7195-4e8e-ae07-850dad2459f9", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647524268, "uuid": "01adcf98-8050-417e-8afd-bd5426b3e4a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524268, "uuid": "1c1f3bbd-9f07-400d-aa61-bb3e7baa16ab", "value": "bf908c76233331d9afac8d8b7cfc787e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79aad1f7-a61b-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647539747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647539747, "uuid": "b2f2a4a7-3342-4fbf-970d-459a61bbac3b", "comment": "Malware payload (NanoCore)", "value": "5ad3e8c2811c34addec6ade19438db79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647539747, "uuid": "16e17237-ba87-4a4e-b94f-711cb7bf6d43", "comment": "Malware payload (NanoCore)", "value": "b845e15f0e6b3a7649227cf5fd3d23faabfd7821ec1941808d9d182f53ca9940", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647539747, "uuid": "c546ec32-612c-4c97-a281-2789741322b9", "comment": "Malware payload (NanoCore)", "value": "380a6758d347408b56d04b67fe75896b3eae35f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647539747, "uuid": "0f83696b-d3ec-48df-8c53-4f2e644dcb03", "comment": "Malware payload (NanoCore)", "value": "b9d648a13860ca4b26a0e396b0f865509d80344d055381c9002d6d72599b65913044024ed1633873c9d77474395da517", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647539747, "uuid": "1581fcc9-6fae-4e58-a1c9-694678704127", "value": "T1FDE23CC2F786C365ECEB163059379F000357FF267852662969C5BA0B3FB324198AB51B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647539747, "uuid": "f302f959-42f4-4f2b-adef-00e2c7e4649d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647539747, "uuid": "ce620c33-4e61-4a36-a920-1a6b56b234ca", "value": "384:tJwUb9xfCYFdpPnDHE3/Afi7B02PZpBvgOeHItoUtPx+0Kz:tJfbO4dpPDHEvAfS/PZp92fOp+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647539747, "uuid": "5c3e07af-8416-4f92-b964-071454815f66", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647539747, "uuid": "57b57800-30ad-473a-9b54-2406b71ecff4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647539747, "uuid": "d15609d1-66ba-476f-85da-07601a46c641", "value": "signed copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e20b37-a5e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647515795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515795, "uuid": "91f482c3-cd49-49dd-8910-f1e0d9d2b8fd", "comment": "Malware payload (Heodo)", "value": "4de3940813f16df48ad1c0aaf6c97d44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515795, "uuid": "aa8a109a-43b6-4dd3-baca-b93b0bfc3502", "comment": "Malware payload (Heodo)", "value": "b893c02bf7572d133f9dbe5ec87736595812a716f88fe0096812b66d7437ae30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515795, "uuid": "30faec5e-493b-49a5-8318-cdb26436843b", "comment": "Malware payload (Heodo)", "value": "b7f3222b661e9ae5537f4589f4465397b20d13e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515795, "uuid": "247dd758-1ad8-4e7c-85a4-dbc9e9bac801", "comment": "Malware payload (Heodo)", "value": "de5723c3969a2ed72176512a301ed99fc9407561e4b958dae285da3c370871b96429bf22967e22da9223c30fb3670f0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515795, "uuid": "24955f05-8eb6-464c-b641-553d8ce507ac", "value": "T11B058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515795, "uuid": "4ce6e64c-74cb-4764-baf2-d96f4b7c67cf", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515795, "uuid": "731cd5ed-50ee-4bc0-9261-596c865cd66b", "value": "12288:Wvz1CLJyyvmMLSrBgO4ruGbPlVpqb+DlYzv:WJCLJyybLqBv4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515795, "uuid": "6c5a4984-e6c6-4c8f-b9f3-a217ef8b2cd0", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515795, "uuid": "bdb1457c-afa4-4bdc-a940-ccd8e09f35c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515795, "uuid": "b7cf1513-70ea-403e-b1cd-d03e168469f5", "value": "4de3940813f16df48ad1c0aaf6c97d44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b797b0f-a5f1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647521523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521523, "uuid": "dde186b2-07df-475c-b211-b15bca3b00e4", "comment": "Malware payload (Formbook)", "value": "068a2c1d397ecd38aba855db9ff4a9c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521523, "uuid": "78b1aa1a-ad8a-4d25-8455-560570a66c4b", "comment": "Malware payload (Formbook)", "value": "b8ae965dc24d6b7149c486672bf33989d6c27f108a68cb447cf5308eb91b8217", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521523, "uuid": "2980eedb-2c1f-448d-90b6-c82c1facccff", "comment": "Malware payload (Formbook)", "value": "8ad4ff2730b660b5ef94370ad010c6a91d758745", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521523, "uuid": "1b3727d4-41f1-4e83-90f5-14c432c3c848", "comment": "Malware payload (Formbook)", "value": "9d6aa861a52b44f34a505fad4af611e821cac446dc27aaf796a211dc3c5f8dad56033a769243fd3dcab7b8b2c9d7e6a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521523, "uuid": "5ced10de-041a-41d9-a3e8-403cd0f95c17", "value": "T1D64512293BA88937F0AF57F4B05746809FF472062007D7AEEE82A4E54D527C94B1F297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521523, "uuid": "e8a54ea9-9479-4986-964d-a7c2687da295", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521523, "uuid": "49def38f-2cd0-4541-ba55-50523dcd1970", "value": "24576:q3u9JKIDK9BLxuKfgAMpFCJ5J0QBYbJLjfeb:q3KJK7LLxu65PJv055ib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647521523, "uuid": "09fd50fd-1707-46f5-b268-72b49d4c7786", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647521523, "uuid": "a0025510-dc88-4b63-9af0-48c250832de0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521523, "uuid": "96f9e10a-2c03-4084-a6fe-ce21cba360fb", "value": "Ordem de Compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd156a4-a5f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647524369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524369, "uuid": "43335901-9c6f-495a-8d91-3ba71e5adfb1", "comment": "Malware payload (Heodo)", "value": "476b46d346947c28df61b755bb8ff572", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524369, "uuid": "0a245b4e-bb33-453b-89a1-86413c07b16c", "comment": "Malware payload (Heodo)", "value": "b9fa5bef00c22d70e5d98ab874b1320c32c9042586bb7661d177c80b1f94a65b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524369, "uuid": "ca3dc7cc-2bb1-43d3-884b-d9657e748879", "comment": "Malware payload (Heodo)", "value": "35098931809c963c8501bd9500ebb00557f4edf4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524369, "uuid": "9b3d836b-833d-4bdb-a196-4198992c32ef", "comment": "Malware payload (Heodo)", "value": "d0ef0ffc03cb5bd821b82c765483aaef18f9c5f21aea3bc7683d78d4c8cf4a951d44f5594b385394d5e5c8dfa091e01e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524369, "uuid": "0d632a78-6a3a-4613-8270-306047895374", "value": "T1D9A29E2CE921744DE3BB683C420650FA924A1C022147B5ED3991F77D6B73697068FEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524369, "uuid": "77a9ae53-72be-411a-acc4-526f8f2beefe", "value": "384:j3uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:HsNs/zXtFCBn9kC+xbL42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647524369, "uuid": "db6913b7-a09b-4300-a9a9-b5797933ceda", "value": 21657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647524369, "uuid": "34b739f7-33f4-4735-97f3-d7bef65410cb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524369, "uuid": "ad68b355-c195-4b8c-a5a7-a7d18c65b594", "value": "Fakturierung 2022.17.03_0851.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dcbbc2a-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518521, "uuid": "cc4f812c-fbe8-45f4-8648-315da676e6c7", "comment": "Malware payload (Quakbot)", "value": "b67c87bae6fe29baee168e130a309acb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518521, "uuid": "2468f2a0-1968-4d13-8cc1-a6476a51d6e5", "comment": "Malware payload (Quakbot)", "value": "ba0033badf85c9c80a9c65680a5d140bc75105db252ec66b438c61b9109c044b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518521, "uuid": "5077c583-6911-48b6-be6b-c43bbcacac0c", "comment": "Malware payload (Quakbot)", "value": "1a9f97f59db8faa2f03e73c41a97a9115c864985", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518521, "uuid": "777b2692-90dc-4391-acd5-94f05c2491b3", "comment": "Malware payload (Quakbot)", "value": "64e9aa720e475c04dddfd50959d0dbc648ba964a13c9f0c19005ac194b3be5157171e3698446c6f96f2f82be43faae55", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518521, "uuid": "a0dd5aa1-5dff-4f21-a087-023f173efcef", "value": "T1B715BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518521, "uuid": "49d80246-49a8-4534-86cd-975d7d16ff6a", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518521, "uuid": "56c0dded-5fee-4d58-b737-f49cd1a08b95", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518521, "uuid": "d06c9205-08a6-46bd-89de-f7fe10761221", "value": 953249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518521, "uuid": "27c1a47d-de3e-4716-857b-7e74ec49ebf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518521, "uuid": "00bdbda0-eb42-4a90-acc3-e46524fafafe", "value": "ba0033badf85c9c80a9c65680a5d140bc75105db252ec66b438c61b9109c044b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7cd9318-a61b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647539825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647539825, "uuid": "8e22fd1b-0601-4b16-b607-bc65da7a8d01", "comment": "Malware payload (Heodo)", "value": "4e8a897f98590933c35d9d74fd45ec60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647539825, "uuid": "ea3ec5e3-8c0c-4ff1-88a7-15093bc45a58", "comment": "Malware payload (Heodo)", "value": "ba86482166d0606a4145ceb83bab3580d34b566a76535b603ee3cbc010205cf4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647539825, "uuid": "e3bc8163-210e-4db6-9211-610bc902b2f6", "comment": "Malware payload (Heodo)", "value": "ebf713945d093dcecb5318f28343f7b9712e6c16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647539825, "uuid": "1bbb437b-09ca-404c-8712-0a214c2206ee", "comment": "Malware payload (Heodo)", "value": "87205f49ef00f74bd6b1d114df28efbe18b9e50e5c08fba47afb59ebf3734b744bb8176a767ff2734dd0510d0fb31f65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647539825, "uuid": "06e855f6-306c-4826-98cb-84ede1b448cb", "value": "T1E1058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647539825, "uuid": "e80c0c09-f095-4b22-86dc-19c8971d72ee", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647539825, "uuid": "eab1566b-4514-4773-944c-761f14487036", "value": "12288:Wvz1CLJyyvmMLSrBg84ruGbPlVpqb+DlYzv:WJCLJyybLqBB4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647539825, "uuid": "1f56e621-dee9-4152-b0cc-a3501df1c79e", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647539825, "uuid": "4b7f39d7-4c38-463b-9cdd-8cdbe69ca281", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647539825, "uuid": "b7868ba3-24aa-4c02-addf-d3dd9828d6de", "value": "4e8a897f98590933c35d9d74fd45ec60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda29913-a63f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647555323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555323, "uuid": "d8a7934a-11c6-4741-8d7c-aa3357d1559b", "comment": "Malware payload", "value": "3928654fa177f1705a01c7feacc3ef8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555323, "uuid": "db6264b8-d54d-4f5e-9c39-98508b58c825", "comment": "Malware payload", "value": "ba9742a0580f6feff522700a8175bbfd43ae5564fa39e3bbc794f4336a0ae6f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555323, "uuid": "2d8a35af-eb48-48ad-b943-a7cb6c9949f1", "comment": "Malware payload", "value": "afb937056f65983aa7bdb92bc1846072a5756eb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647555323, "uuid": "5bab83d6-db86-4400-b726-695fee84eaea", "comment": "Malware payload", "value": "10dcac6a087e01daec1b988f1584f4a607b7c0dd4340fcad33f87584dc828204128f8e8dab430c421562181a9e08c499", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555323, "uuid": "4d917327-7523-4227-b706-591e3b76d63f", "value": "T171059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555323, "uuid": "96d311f6-7ddd-4418-8145-876bbff23db7", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555323, "uuid": "15c61f88-3edd-4236-af76-cc499091dbd9", "value": "12288:V20BXOMcVzpWfmmnDDmX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDyX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647555323, "uuid": "01ef2d86-13ef-4849-a6e4-f1cb51b1c80f", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647555323, "uuid": "daf371c0-371f-4957-8ae4-06cabed6e6a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647555323, "uuid": "18105149-fe10-427c-b746-20f24295c67f", "value": "3928654fa177f1705a01c7feacc3ef8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b1cc37-a5ed-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1647520064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520064, "uuid": "9d9c14eb-1998-4f68-a348-ff9ddbc1931b", "comment": "Malware payload (Gozi)", "value": "abc14693c2e9de73e05e4fd3b2d0985b", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520064, "uuid": "a1250274-34d1-4552-a8d6-f0fe9b12dd0b", "comment": "Malware payload (Gozi)", "value": "baee00cebd91c745753ee59d3abd4b655f4e90231a61c04eecf3f299297b936a", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520064, "uuid": "0fe5ddd2-c03c-46bd-b091-f59f237e6d0d", "comment": "Malware payload (Gozi)", "value": "4093042f5b36b8950d77c5a4a8221d08b2fcede5", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520064, "uuid": "eb1adbe2-3723-481d-8f7b-6538a7310357", "comment": "Malware payload (Gozi)", "value": "e40b18efe2d63ac40c9ec13256316af765bb17fe57f6718d2fcebaba32f81fea544c384902952a98e5f44fd80250ef41", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520064, "uuid": "64ebb129-7e65-4a6d-8f14-bf7bf9803043", "value": "T121E17ED77D839E2DD80301B193F26209E67CD34CA826356DBE2DD63E95A2254D1076C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520064, "uuid": "2d480de7-dc6b-47f0-92b5-a039b9d89235", "value": "192:Z1BmnVrdmChmrCJkVRZwwoaWIejt0jM5yzvNr1IaMDN5Abg9:fByhm7uxa7jQyhbMp5Abw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647520064, "uuid": "95117d1a-3729-4277-ac76-b5e02dcd38fe", "value": 6893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647520064, "uuid": "4a06718a-2e2d-439b-b3fa-10cb9e82ef44", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520064, "uuid": "9ace183a-c921-4a68-8420-62885b726fc1", "value": "comun197.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad803b7b-a5c1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647501179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647501179, "uuid": "346340bd-5a7d-40a7-869b-6059448da2a9", "comment": "Malware payload (Heodo)", "value": "ab40f62da5af25c97df8aeaed5a25088", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647501179, "uuid": "f79deb34-ee78-479c-836c-5aa69734840e", "comment": "Malware payload (Heodo)", "value": "bb006fe3980ef97c5018c1f522dc69615dcbb594d8b3810716eb5f30d7f686cf", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647501179, "uuid": "e3d543d5-c71a-48e3-868c-819c520ffd78", "comment": "Malware payload (Heodo)", "value": "7bd66819f5b818f4dc55a13bfaa0f8531eb560b5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647501179, "uuid": "483750e0-2800-4eee-b547-595dd4eaf0f7", "comment": "Malware payload (Heodo)", "value": "dbdefd3addef816570b5ff62000b863f82b4cca2e49009fe89b92ceb5707d6bf85cceb0a52764b947db988dec40e9ab8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647501179, "uuid": "506cc7ce-dd2a-4e5c-a07c-1bd154df78a5", "value": "T160A29E2CE921744DE3BB683C420650FA924A1C022147B5ED3991F77D6B73697068FEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647501179, "uuid": "fa71f8e8-d66f-47af-ad5c-4e26f38ea556", "value": "384:D3uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:nsNs/zXtFCBn9kC+xbL42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647501179, "uuid": "a5bb9df5-45e1-4d5b-83ee-d7d81bbbd0ac", "value": 21657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647501179, "uuid": "01777b9d-161b-4f99-89aa-fe9e2f88d4e7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647501179, "uuid": "e1050f73-1c42-4c02-aff5-61b34c345284", "value": "2022-17-03_1505.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ad73f5-a5bc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647498838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498838, "uuid": "7cc816c2-38bb-4f62-b8e7-2dd57aaf6c7d", "comment": "Malware payload", "value": "41109f1ea8a4d492e046e4c3ba07811c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498838, "uuid": "4dba7692-6285-4262-abfa-412b5d1c403c", "comment": "Malware payload", "value": "bb3d71f0ddeb4595eba5b41fdd8da05874c8919d52efd728acfa598ebb6b7e11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498838, "uuid": "35e438ca-2faf-4d1c-b4a0-9eb5ed972743", "comment": "Malware payload", "value": "3194da67e3ac08c62c79db74d789e90ae076fc7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498838, "uuid": "732ace6a-bce1-4e7b-a843-c910ac8eba7e", "comment": "Malware payload", "value": "ef928d0af1284baa37f17d23a238aa9e2c52cf1947cc99695b48b03a65da87b07aac27863b301117c873f83440a67479", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498838, "uuid": "a767245c-18ed-4fc1-a158-ee7783e8e1c7", "value": "T1E7A63314A3401CE9F1B1503275A44926D53678324720E98F6B68A23A9FB7FF5BDBEF40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498838, "uuid": "c18915e1-c548-4e77-902b-99d86e08a17e", "value": "c5640c7a22008f949f9bc94a27623f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498838, "uuid": "be96b1c5-01b3-41ba-8946-a0344eedc264", "value": "196608:QWl4XkYUGx7/ICteEroXxWVfEqlbkkwR7VTEiwYgFViv8kmmgMDXkjenZE:t0XUU/InEroXgfEqirRRozYgHiv8k4MT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647498838, "uuid": "7304456d-8355-45f1-a0a8-ced8e0138ef9", "value": 9705831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647498838, "uuid": "471ce801-2744-4476-ad06-bcdc0448cab1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498838, "uuid": "0245cc8d-08ad-4d3f-a421-ffb1e171a06d", "value": "69304324.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9c96b9-a647-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647558539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558539, "uuid": "d274fc65-f601-4ab0-ac30-66a75766004d", "comment": "Malware payload", "value": "f4312cfe3f174f8be90bc9836be2aa05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558539, "uuid": "208c3146-1df1-4930-842c-bc0d02dec26e", "comment": "Malware payload", "value": "bbb141851d66ed3abb6de768a9260ac19f882e3e9a05834ccb3007250a2b34bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558539, "uuid": "17bc3b19-2665-49a1-be90-a2566ea88ff2", "comment": "Malware payload", "value": "fe24e8dc14c829ef48ca4747d09f9cbc15951ae0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558539, "uuid": "9cc97cc9-6e61-4375-b08b-c206fd8725ab", "comment": "Malware payload", "value": "190585062574c9c4258653522f9af236b7bd3fef233209ba43299b306868900b431d76f8921e2d14e3caf34cf1defe36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558539, "uuid": "74fffa58-3e1d-47a5-a0a1-adaa78da7a94", "value": "T124059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558539, "uuid": "bc266f81-86e2-4f6a-8698-3ee38ffa6cf3", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558539, "uuid": "5076ace8-6a19-4b29-bc8a-7f6a04960e66", "value": "12288:V20BXOMcVzpWfmmnDDnX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDrX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647558539, "uuid": "21dd3d31-a7be-47b3-8ff8-7f88b66298e6", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647558539, "uuid": "61a0938e-b4a3-495f-99a4-30c20ced03a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558539, "uuid": "ed0e38ae-8106-45a7-87f1-733a43323575", "value": "f4312cfe3f174f8be90bc9836be2aa05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64cf4a4d-a604-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647529834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529834, "uuid": "503bbe84-de73-488d-9833-508b07d65a8e", "comment": "Malware payload (Heodo)", "value": "23b7a04e7b66451d33ed0e636e911ac6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529834, "uuid": "20a44261-75d5-412f-aa28-f56b175e647c", "comment": "Malware payload (Heodo)", "value": "bc012d9ad5b05f01d5508f0f2d90b900c6f4f8ddca6e197c001c199c4d3d872e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529834, "uuid": "8aa6c028-f7f4-4a0a-bbad-0220c159aeb0", "comment": "Malware payload (Heodo)", "value": "86b329ddcc7fdb25833e1d22e1bad353d13d0a38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529834, "uuid": "d0ffa1ce-d4a4-4e3e-8b3d-ec4fb1082bf5", "comment": "Malware payload (Heodo)", "value": "ae01c7426232dc0fb63568d54aa84909cd36476e457366df71c8b3e4f42eedb38c9b4d188dd9763792ce8a8c1b15ba4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529834, "uuid": "a09ec6da-0afe-4afc-94d3-36c028d343b8", "value": "T1DB059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529834, "uuid": "93285bc8-d589-4c68-9c07-08177692a559", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529834, "uuid": "5196e911-1d6c-4ecd-9471-12eccd2822bc", "value": "12288:KVHML2QJe6XxhqCWiQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqqQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647529834, "uuid": "dc893e90-d2d1-4f01-8e6f-94fcc39c91f4", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647529834, "uuid": "df1a75c3-101b-44d0-92a9-7ee53aa5f52d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529834, "uuid": "68664705-9641-41d2-a5fd-ab4fe2ba0120", "value": "23b7a04e7b66451d33ed0e636e911ac6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd031fa2-a5fa-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647525714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525714, "uuid": "2db063fd-766f-42da-88de-28bf5ab3bdf0", "comment": "Malware payload (AgentTesla)", "value": "7842b622b20f63fa9bdfcf6644564795", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525714, "uuid": "69cb7d97-6222-49a1-9b44-873f6dafd37d", "comment": "Malware payload (AgentTesla)", "value": "bcb6fa296b33b7d23cdce700bea67ea4cfd802891874065f8db37fe618fa3974", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525714, "uuid": "b64286e3-9e91-4cd2-8097-37acee8e28bc", "comment": "Malware payload (AgentTesla)", "value": "2faa88a69186ca821077acca5274106cfb8e8d78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647525714, "uuid": "33388bcb-8461-4ee0-92b0-494e583e5ad4", "comment": "Malware payload (AgentTesla)", "value": "e18d5e5157085dd57b18b6964db3b3202605c13f0497219b9fc88ca10a42e54c82ffa7d471901409052b195bfb131e7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525714, "uuid": "d5961c4b-9990-403a-839e-b840f451cfdf", "value": "T1BB758D9B32507FDEC576C871D554EDE096203C6642C782CEA4A30399D9CE696FE330AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525714, "uuid": "dd2a5213-20f6-4b44-a498-0dda557d0446", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525714, "uuid": "0a918d2c-9533-4f0c-84fb-2f4acbf1053b", "value": "24576:EPNdgf9pk2g5+nOsE1/+EcdHjCjAKg6djbkZQ/2FU+Fn37:K0/g5rsE1/VcT6jbD+F3V3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647525714, "uuid": "0c92cdbe-7f02-4c5f-b0e6-dd3be8cb634f", "value": 1563136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647525714, "uuid": "10d43225-a675-447c-b246-e31872d2d581", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647525714, "uuid": "561a2e78-2872-4d55-998e-f2e5246d1114", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef63219-a5cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647507034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507034, "uuid": "661cdc10-ba09-41a8-822f-ea2e6fcf46ab", "comment": "Malware payload (Heodo)", "value": "4125ac3fd74d16f35da25364000c5575", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507034, "uuid": "4e819d92-edd7-4f4d-ae04-b4dad41b4809", "comment": "Malware payload (Heodo)", "value": "bcccd2093143391a2b3b1aad55e3c212404297e3f6f2db42811193827075929b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507034, "uuid": "c3afa26d-b166-422f-9444-a771d23f701f", "comment": "Malware payload (Heodo)", "value": "6c0f440e57296d99d21f4b8bd365760c748adbed", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507034, "uuid": "22decbf3-1f44-4554-a6aa-1469bc0bc67f", "comment": "Malware payload (Heodo)", "value": "40cb5135bf5264ca65afcff11a04f122700b2bfef83ed05149a8089fe6f1cd29be89f811006d1e507f9b3c1a99391471", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507034, "uuid": "8dfc506d-1eb4-49db-8a9f-dff22d7437c1", "value": "T108E2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507034, "uuid": "efdf1980-a08e-490e-9494-d3daa461b8fb", "value": "384:MjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:MjpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647507034, "uuid": "ba91c990-07db-4599-bf0d-400b26472e10", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647507034, "uuid": "cf09f918-1de4-4fa4-8e12-5f5575cac2a7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507034, "uuid": "a76474b3-4b1f-4ca5-8d55-a9e9c9e799a4", "value": "Latest payment_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc12dd3e-a5d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647510760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510760, "uuid": "a811b3b4-1f07-4c1b-902d-4c28274ab465", "comment": "Malware payload (Mirai)", "value": "9cc402a00727020e4c0a09983dc49ff2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510760, "uuid": "9c258a35-bfa7-4ca9-8225-3e8544182b50", "comment": "Malware payload (Mirai)", "value": "bd4ff3f743590f399115aaf0fed13b77104f638de4204c8aee69686788aae4ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510760, "uuid": "a00d30b6-9f08-4d3c-a6a5-e0fa4ea0c329", "comment": "Malware payload (Mirai)", "value": "e6d69326424ce6a0cc88196901f14a0a36bd8ac0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510760, "uuid": "285aff17-ffe7-4b3b-8e1d-3b23ed4d4047", "comment": "Malware payload (Mirai)", "value": "4edbcac44bca1e03e8c5e50c4de66704f368bd9b4562793f7de16e34cd749e6020a782af54a04d97dfd91ee49ac2cea3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510760, "uuid": "628c523b-f752-4ae1-929d-c9c18463bc63", "value": "T150F2E19FC14A2DFDE97AC87B512F2F11A8321F5F10FAD80AD10AC580AD9657834C9EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510760, "uuid": "1e31040c-8475-4110-a197-338aae2c2576", "value": "768:yNT7UzGuGzNL4vQQ/mz0VqHXS2ZrjsMHe61FtohJBJgGlzDpUYsCok:yFYGzzNL4Y8mOWdZfsM+67+ZVqYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647510760, "uuid": "9bdc950a-60ed-4c97-8989-0d059dd6018c", "value": 35212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647510760, "uuid": "89dcce05-61ad-4472-bc2b-d953366e1f61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510760, "uuid": "0ebab02c-baca-42c5-9488-d747658c7cc6", "value": "9cc402a00727020e4c0a09983dc49ff2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a0366c-a5d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647510723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510723, "uuid": "b5219220-3663-4938-ac73-a6d26364d94f", "comment": "Malware payload (Mirai)", "value": "9075c34fae68b97cbc116b30d0bd9beb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510723, "uuid": "06c45ec9-c70a-45f0-98a3-26cf96f2852a", "comment": "Malware payload (Mirai)", "value": "bde6a3417af261303ff55323be807bf3fb2eb6e922c248e943c6c0ac6a724e1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510723, "uuid": "53f00ae8-28a9-4cf7-b948-8fc52afbcc8f", "comment": "Malware payload (Mirai)", "value": "dd16123d218ca09e5d11aed261ce7b54d6576090", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510723, "uuid": "ffd7a5f5-60a9-43ee-9475-3a5e7c795583", "comment": "Malware payload (Mirai)", "value": "5da7e6312cc56af85027d489fd5d47e8ba2920bc7be74a3cc94e6752e451ccda803cc999fac0c0ee06c668e6a22c0555", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510723, "uuid": "48212611-06f5-424b-b2b5-ad677a7f5a21", "value": "T1BF03F1B4644E5DF2E1F0ADF6B825D3CBC13A2B60C1BF627E015101115EE3A43C4A92ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510723, "uuid": "624793c4-f783-4be1-ae87-f2d2b1f205f5", "value": "768:8+raD4nACFqCCc3QbhiD2WXfzuspw3rU5qKlpzQ9pAq3UItRp:RcsqCCUGO2W7Tpw31kpzQfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647510723, "uuid": "601f5c30-9735-4190-b33b-8e10493d3165", "value": 38156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647510723, "uuid": "8a30d654-8fbb-4d1b-a1db-81e435b0fe95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510723, "uuid": "f065b755-0353-4a2d-af18-f1383d7ed568", "value": "9075c34fae68b97cbc116b30d0bd9beb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c33155f-a62e-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647547724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547724, "uuid": "259b4a50-9f3b-4d6f-b690-7f4690f5d49b", "comment": "Malware payload (Loki)", "value": "12b35b1034ec5e59974dc84e24939195", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547724, "uuid": "223eb39e-26b5-4ce6-b130-e5317531ef01", "comment": "Malware payload (Loki)", "value": "bdf000344d58cfa3846fdaacd7d68c69dfb0c9c27f4a211ff0480686206b995e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547724, "uuid": "30ffd2fe-2dfc-4345-8a94-e66921e79623", "comment": "Malware payload (Loki)", "value": "8ae3dcb1186c536336b5e3bcc2d86384840d2034", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547724, "uuid": "1cc5355a-807e-453b-aaa9-3dc29b5e7b43", "comment": "Malware payload (Loki)", "value": "f5c00d5acfe1d84bac0c1d755e4d34635e270a83ca14d4e343e0d842f51eae0a13b533f1af7324d5b6ab03b31d998b78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547724, "uuid": "5236f524-f0fa-4c4c-9089-10f0701e9a6a", "value": "T1D5D4BEC1DA8556A4DC59AB316A37CD3542237EFDA874A81C28DE3E273FFF2931026452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547724, "uuid": "5bd9d7ad-f0d9-4ed0-a830-bccd54fd8d2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547724, "uuid": "0068aca8-6758-417a-adfc-0c7e080a3c6b", "value": "12288:IYxq3V42FxmEZ/8HZMSPCq7L7fHIrwc/GOB5b/KZiaTP7r9r/+ppppppppppppp7:IW2u+mE8ZvrL7vIr5pSZiaT1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647547724, "uuid": "4ecd5ede-3ead-4161-9411-cd1e3addc5d8", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647547724, "uuid": "f43000c4-1bb3-4864-9cef-42f44698d377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547724, "uuid": "0096b059-d1db-485d-b3b3-579f3f2077b9", "value": "Odeme_Belgesi_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2510b1-a60c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647533470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533470, "uuid": "5271c75f-6d8b-4337-99ce-6a2ed54b99d9", "comment": "Malware payload (Mirai)", "value": "109479d75644db2d8d9377c1f3c7cb33", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533470, "uuid": "e331feda-f231-4185-b93a-d910a46a7469", "comment": "Malware payload (Mirai)", "value": "be1607ef91538034dd9be31e7ad7cf1faf83a536ae320d3297d2fd0b58fe88c7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533470, "uuid": "8ea9d6e0-2138-47e5-8724-7612db4ad085", "comment": "Malware payload (Mirai)", "value": "47ce989f8983a2c1a16059d81fdfb105c4e5f289", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533470, "uuid": "6e31c16b-2d30-4134-82c5-687375f73ab1", "comment": "Malware payload (Mirai)", "value": "5846f269d15f38da4fb787b75dbcd9d37ad35affa67257a3db79aff4d4a4a49eb9867e26e444502b85d3954bb34369a8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533470, "uuid": "523f4e68-1ce2-48a7-b76e-7063befb0d45", "value": "T10A430946FC518F20C4900176FE1F594D3B17C7E8E7EEA3265E28A750668B0778F6E829", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533470, "uuid": "dcde307f-d0f1-41ba-8c7d-66470df1e9e4", "value": "1536:gInG9LwFUQ8IViX5CSWh/lUAoiIxzyQmCrQ:KP5CSWh/lUAG8erQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647533470, "uuid": "36ce19f9-41e9-4973-9d3b-1cf3317421c6", "value": 57252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647533470, "uuid": "1cc4b491-65f7-4553-8097-ac3a1b3f4b72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533470, "uuid": "9f16d0a1-a475-4a8a-a303-2ae4a130efaf", "value": "arm6-20220317-1611", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d1745d-a626-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647544302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544302, "uuid": "4b0d2492-3404-4cce-a007-d3908965cb53", "comment": "Malware payload", "value": "b1bb3f6f30d31d926b7d5639fec74695", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544302, "uuid": "69f88b60-fd4a-4aef-9fa0-ecb97c39d0d0", "comment": "Malware payload", "value": "bfb19bf13b334b42067a00310655350df677412fdea8231e044ec22878838d82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544302, "uuid": "c5a7a3b6-a452-4bfc-955e-10b367b9bb0a", "comment": "Malware payload", "value": "d2034279942e6cebb1d37935f0f4ccdc929af144", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544302, "uuid": "1738d4a9-c651-4332-8a5a-339e37d40037", "comment": "Malware payload", "value": "89122395d633df21e696517f7f7c5eb77bce807bd4f820ffdeca9a2a4c9233c1c10439519d8de7c80338bc808da8e938", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544302, "uuid": "6c724862-5888-44ce-a5c9-69d955888e47", "value": "T114C42B017896603CDFDA363601F7EB2531E75CB0677CB52E6EC168EC9B2628A051D63E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544302, "uuid": "842bd67f-f944-48e5-a041-ef59d4b60066", "value": "fe91b35dbbcef6d3f3836ad3e8b836df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544302, "uuid": "b3743ba4-3f43-4e32-b634-d723b56214ef", "value": "6144:xe4HnxyzcUzcUin5jBd4hp3CBj6O7O7OOuw/RRRI7E7E7E7Z94kx8888rLCkxEZ2:56Kv+tEgq8dov6eimJEeTN+sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647544302, "uuid": "7b955c5b-987f-4a30-8ebe-76f6571cba82", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647544302, "uuid": "acd228a0-9434-4916-b2fc-88b25948cf91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544302, "uuid": "88fe8f10-c1d9-47c2-889d-dbc14a3ef8bf", "value": "b1bb3f6f30d31d926b7d5639fec74695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef5ab83-a5bb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647498605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498605, "uuid": "05978ff0-33ec-43ff-b7b4-91108be42ac9", "comment": "Malware payload", "value": "b7ab777c015e8f1b469d4a8224e0a992", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpyEye", "colour": "#7D73EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498605, "uuid": "bb7f5b5e-ccbb-41f2-a42d-30d2e650d228", "comment": "Malware payload", "value": "c05bde8b2d62b3eada3bec74f5471d683f1b6c01191dc397974dff8a978ed4d2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpyEye", "colour": "#7D73EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498605, "uuid": "543b0d54-8e1c-42fd-8e90-824e3b4caa4c", "comment": "Malware payload", "value": "ed43668aa1521b79356f88db44e1b4ed9ba3fe42", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpyEye", "colour": "#7D73EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498605, "uuid": "ae20c27e-eb3e-4ec2-aebd-f56ac7b5649f", "comment": "Malware payload", "value": "ed3de75aa1bb96325eb4866fa171319101c91b79f4193d025df69cdb7310d121c24302beefa3651b0797fe2c53e49dac", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpyEye", "colour": "#7D73EF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498605, "uuid": "f9eaeb2f-ac77-435e-91af-7fb3c319b9cf", "value": "T12DB2098073F80524DBFDEAB144F2565A86BB76CB5832DB0E1CD610C64972F849B32F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498605, "uuid": "e866a598-75f8-46a0-89f5-01baaa29b95e", "value": "384:AaonF/Rss5nwv6QYjkfTFl880Ze4mbatCZhoQaqGOLpRNkzORGQN0aWVu:AnF/Ks5nhQ/388Xb2XQW2NkIcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647498605, "uuid": "ff2e4db2-41d0-428d-9f29-7d4352ee7e5e", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647498605, "uuid": "b3352eba-6cc9-4817-a24b-6cab4ef5c920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498605, "uuid": "58167ad5-e9b9-40f9-9354-564991bbb4e9", "value": "98996261.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81363338-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553504, "uuid": "780c5433-f31b-460b-88e6-5d5115dcc609", "comment": "Malware payload", "value": "015d2f36867fa8d0adb013cf77865842", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553504, "uuid": "6b4a7932-07b5-47af-ba47-eacafabef3a8", "comment": "Malware payload", "value": "c0a5de416653f95261b7268bef5200c818441e5327ff012a34a8fb49c4ab5628", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553504, "uuid": "5f015d2d-735e-4c55-b124-d5d4d54e84bf", "comment": "Malware payload", "value": "725df8f99532e89b84740593a546adc558f70f76", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553504, "uuid": "0405f73c-4112-492a-9726-06d2909a3773", "comment": "Malware payload", "value": "c4e90a2f8f4f5086111eff53221dc1fd3d6f3f6fd285bfdee08c039345a46beb92bcf1581474cd7c605f51c5d59ddcfc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553504, "uuid": "673c21e5-1a41-49e5-bef7-23acd36e6496", "value": "T17B059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553504, "uuid": "0ba7acf8-d5dd-415a-9ae9-d96ef7d32226", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553504, "uuid": "d59442c8-8f76-449b-b682-a43509e65d6e", "value": "12288:V20BXOMcVzpWfmmnDDzX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmD3X6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553504, "uuid": "33afba38-4d4f-4427-a4be-3b7f57989ab2", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553504, "uuid": "27df4a57-19e0-4c4e-9dac-c16f08931211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553504, "uuid": "92572d48-24f3-4029-9d75-b9cf6ead801f", "value": "emotet_exe_e5_c0a5de416653f95261b7268bef5200c818441e5327ff012a34a8fb49c4ab5628_2022-03-17__214455.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683244aa-a600-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647528121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528121, "uuid": "aad4b04a-affd-4668-830d-c79529f1e961", "comment": "Malware payload (Formbook)", "value": "439e206078d5bdca2a9ebdeffa44cd9d", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528121, "uuid": "5c4f589a-12d1-4493-993e-9f1ed9a3c8da", "comment": "Malware payload (Formbook)", "value": "c0ac50708de024ed41f6bf74f00021df1b691ed8358009b863684d962e9c8c40", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528121, "uuid": "579f87e5-f657-40b4-a6c0-033ebad7d220", "comment": "Malware payload (Formbook)", "value": "33a4a80f7393f89b6ea5e1ff3583d6fd1e4df5d3", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528121, "uuid": "09e26952-a45b-47c8-9d25-127321a6305b", "comment": "Malware payload (Formbook)", "value": "17af242407598bff6606dcf12e0a929b51e54a733535ff5f5b903f1d2d5d31d140d4f7d48714e035209830bb10c99dd0", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528121, "uuid": "c9919ef2-3513-43bf-aa11-1097338b80d5", "value": "T16635333927D014F3ED77450083E0405EC2B77AEBE02A9AB0BD562517439A78A61EF9F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528121, "uuid": "da393fa4-22f5-4cf8-a5a9-a29de25ffb41", "value": "24576:qDbPEFScQU4BErWOqSZX9iBONvHHZIREX8xRHem:wjsjQ/mrWpk4BONvnZImX8zem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647528121, "uuid": "864d4289-afd1-4678-b6ca-3d77796b7424", "value": 1067326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647528121, "uuid": "3ccdebc5-04b0-44de-ac31-e46fa5464427", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528121, "uuid": "0c103a87-3194-43b0-8b25-738a67ab3e75", "value": "Payment advise doc.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "279cca8d-a586-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647475615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475615, "uuid": "418be9c1-69e6-4091-8924-de8196760ec4", "comment": "Malware payload (Heodo)", "value": "0d9803c3757e1fcf2a98afeed5dde816", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475615, "uuid": "6583efff-ff3a-400d-a45d-e3d29f0988c1", "comment": "Malware payload (Heodo)", "value": "c23262234d1312f8a98f2c022c7e0a8100887545c5dd8cd9656dee1a1812d7ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475615, "uuid": "fa321974-57ab-41f5-886f-9937521f4a83", "comment": "Malware payload (Heodo)", "value": "be9dacf9d3cf7baae1dcae8a0ebbcd9d27d00c80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475615, "uuid": "c77d717e-2361-4e33-badb-9cdb44be447d", "comment": "Malware payload (Heodo)", "value": "c645754eaacb16a167902af7dbce72c38cab2e5bfab428bd585bfbab8dac98904aef7ade2629361d358c9f256673616c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475615, "uuid": "e4cc82d1-2572-4994-a72c-0e0f240cf95c", "value": "T1CDF4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475615, "uuid": "88c8af81-bdcd-4bcc-baee-b93cd6d0bb32", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475615, "uuid": "74250063-277c-4c4a-aaf0-54013e9d590e", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPsXvkgKtuBdfMAofD:WCBAdKV9Xf0kf3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647475615, "uuid": "8d1f02a6-9f2c-487b-a13c-7c768a075331", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647475615, "uuid": "62580880-4fa6-4795-a1ba-1bfa0bf25e38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475615, "uuid": "d7df3685-86be-4310-8e85-54770980346d", "value": "0d9803c3757e1fcf2a98afeed5dde816", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3295810d-a647-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647558526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558526, "uuid": "a5f38331-b984-428b-b345-d3445bc085d1", "comment": "Malware payload", "value": "0746d48c211f1f15e58b9ecd192e7c40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558526, "uuid": "549cec5c-cfa3-4c9f-9973-2e29c27d9e2b", "comment": "Malware payload", "value": "c2e0ee1916e72a8a93ca00affd90baab6399485c608370baf7552f9218d14e0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558526, "uuid": "52a77430-fd1a-4046-aacb-88183d58bbdd", "comment": "Malware payload", "value": "9b5e00d170a0ad9e9bec298625a8cc8a30c8ac9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558526, "uuid": "92b6faef-09fe-49ca-804e-7c8c66eb62cb", "comment": "Malware payload", "value": "270adc1aebcf6990c8f1bcc9aa3c610eac488d06ce12fb19a1e15950857defebf87b0855348e4c25e72a8cd7e8534e5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558526, "uuid": "4a726b2f-0531-4764-a3eb-4b6018dbaabf", "value": "T1F3059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558526, "uuid": "ca2a4810-abda-4285-878f-54bfc23e1847", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558526, "uuid": "25a152ad-4be8-4b7f-83ce-ca0b4f5f43f3", "value": "12288:V20BXOMcVzpWfmmnDDIX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmD8X6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647558526, "uuid": "9582ff18-aeb9-44bd-8b58-7bbaf5f1caf4", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647558526, "uuid": "abf6b9b9-7e63-4d8d-aa0a-a7d367a891fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558526, "uuid": "763e18f6-b283-40e2-bc41-0480c1e16ad8", "value": "0746d48c211f1f15e58b9ecd192e7c40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec05cd2-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518630, "uuid": "69187852-1799-4717-ba62-6edc5954cb37", "comment": "Malware payload (Quakbot)", "value": "5d221e5e01bdd3f0802fc11f05d4852f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518630, "uuid": "5c8444f4-2229-4f9a-9fbe-149b51e1d21c", "comment": "Malware payload (Quakbot)", "value": "c2e855ce69264af0a757a61528cd8153854bd9ce46e8b491044feffa94f6cd49", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518630, "uuid": "8e79db83-2c2a-4422-b29f-027064b33573", "comment": "Malware payload (Quakbot)", "value": "4851630eec0c1cd9e589597efaa433a19f785b23", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518630, "uuid": "8eb45e33-5e56-46d1-a501-4aef64b12315", "comment": "Malware payload (Quakbot)", "value": "4684e44641bc2b8f93f43395805bac61d959363b8d3bcc26a5a6d1fa1a96bb84895bf2acc2985be80968202667cff7ca", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518630, "uuid": "94cc9b18-5ce3-4b7c-8196-c0787d974a7b", "value": "T1B615BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518630, "uuid": "fc37f982-7a8e-4f59-87c9-b38a626448db", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518630, "uuid": "bb632c3e-15fc-4f6f-af16-685df81b0e65", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518630, "uuid": "ed8d79d6-0d20-402a-8a91-df23e622bd75", "value": 942458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518630, "uuid": "63f1cf01-cc6a-4f9b-8095-f42310997c36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518630, "uuid": "fdc37fc3-c60f-4981-9d21-790ba44f1e0c", "value": "c2e855ce69264af0a757a61528cd8153854bd9ce46e8b491044feffa94f6cd49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3449df-a60b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647533015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533015, "uuid": "d4cee439-b5d1-4cc4-a681-b6683ce7edcd", "comment": "Malware payload (AgentTesla)", "value": "496eea252ac8b6891f4ae4086fee138d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533015, "uuid": "7a313fc0-620c-4527-a37c-6936792ad3a9", "comment": "Malware payload (AgentTesla)", "value": "c2f02ec0e7c7d276c44e839eeb1c2020bd08ebb785bef33f59bbe7631e0a774d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533015, "uuid": "c8be02c0-c397-4602-9c9c-18572a2f7587", "comment": "Malware payload (AgentTesla)", "value": "3eefe98c8f41d7d82fd952df6f749bc79a581ac4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533015, "uuid": "c720321e-715c-4dbd-8d04-9b6e553a76e2", "comment": "Malware payload (AgentTesla)", "value": "c1dadff08adb5e2a48cad13f61b034e32d537e87fd72e5f5535bcfb1664e97b82be793ab600a816a74138a18bbd5fb43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533015, "uuid": "85ea016c-d9ad-4ef5-84ed-9c36c94ee3ef", "value": "T18BF1FB05D7E84A31EFBA0B7218B393508335F7139C5BAF5F2590522B2D517D90453BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533015, "uuid": "65c4a696-c331-42a8-8f42-8b43f270a90f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533015, "uuid": "09c9f4c7-5d7f-4723-bf33-81466842b901", "value": "96:0sCkUrT/bJg0JWdHpkaROL2MbidgV0UulZOJeu6bL7+6jeFzNtz:PGg0JckUQ2MueqUYZUEL7+Ee/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647533015, "uuid": "b73dcd5a-2937-498a-88a7-ab8df6ce418a", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647533015, "uuid": "35b407ee-a023-47e2-b829-0f6feeefbb6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533015, "uuid": "40f7b8d3-be1f-43a6-99da-66a995e28288", "value": "DHL-Airway Bill.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab99134e-a614-11ec-9275-42010a9c0029", "comment": "Malware payload (Hive)", "timestamp": 1647536825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536825, "uuid": "e80a203e-f20d-44c2-b398-80db1f42f49f", "comment": "Malware payload (Hive)", "value": "fce6a04dfa8a955fbe626c3f04491444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536825, "uuid": "343cf6d4-7484-4d95-8721-2de884a7fa24", "comment": "Malware payload (Hive)", "value": "c2f351a42ecfd12aa3bc4562a05f2d54fefe977e2464bc2677823f5301d27afd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536825, "uuid": "d94ccd0c-2831-44bd-9ba6-0fba00f7f5ab", "comment": "Malware payload (Hive)", "value": "260b3a0c744f9e59ab5c3fe577870eed66d7b7b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536825, "uuid": "e57d182d-9053-49df-a165-4f49bb0ce886", "comment": "Malware payload (Hive)", "value": "71c9d7610805d4906e69417529dfed6928ce9683884d95c98bc65791c4fda0684141e14eeb7c011f98de74b74e3475bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536825, "uuid": "f3398f57-2100-4552-857e-bd63dd58e47f", "value": "T16B46332F495238F8E6C26D715B29F5E5644A78232E6A39118D0FCEE80A36CC3F6D5707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536825, "uuid": "f2f491f0-c522-4ab0-ac94-a2e49e513490", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536825, "uuid": "8fa50a2b-7279-458a-ab97-3d5614cc0068", "value": "98304:P0JLO7ji9TCg02KAcw0vDOiMPVgqX1E9qAhmdU46xHc2OSZ+8EP01lKUrtEr3A69:P0JLOLr/vgcqfqHczXPkA3A6g9bXjY9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647536825, "uuid": "e3399698-b9ba-4e68-b5c4-0da7ac46f6f0", "value": 5636608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647536825, "uuid": "5060942b-66b0-49bd-8a16-d47fe1a8fcd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536825, "uuid": "8f647d6c-2832-4004-a594-cadbc2d09380", "value": "42663002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df82261-a604-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647529822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529822, "uuid": "04c0cde6-0d92-40d7-a653-33a58f736297", "comment": "Malware payload (Heodo)", "value": "9a063a4c8f9a873b09489fdcea2f0c8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529822, "uuid": "485aeccb-0116-4ad2-8f07-bb26273b7fce", "comment": "Malware payload (Heodo)", "value": "c32785b8c0dd4b70adc564ef35e1342a95a32db7a79156bdac8cd1e4fc53602e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529822, "uuid": "3ce9c138-be78-40cb-9d83-0c64294ca2b8", "comment": "Malware payload (Heodo)", "value": "32212f3690f626b0561c8468f9a04b801c82898e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529822, "uuid": "033051a0-d2b0-4470-81c9-22cc8d2c243a", "comment": "Malware payload (Heodo)", "value": "4c9df7112727ed1dcf70be4c353901e92af249711414502911d3347b314868cbc16412f671863849112d3eac05330845", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529822, "uuid": "8ff9109d-b76f-406e-ba98-7bd42281236e", "value": "T104059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529822, "uuid": "572c80cc-bd66-44fa-bea9-04b3d1d59ece", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529822, "uuid": "b3ccc5f6-b1ed-429c-81be-d8dac963e408", "value": "12288:KVHML2QJe6XxhqCW7QHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqzQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647529822, "uuid": "73883a1d-134e-4aa0-b6df-fb6cec933463", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647529822, "uuid": "d256d829-f638-4e8e-9b3c-c5414ad65f97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529822, "uuid": "4dbc79f9-14e7-4414-9471-c9644fa135a2", "value": "9a063a4c8f9a873b09489fdcea2f0c8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33592ad3-a5aa-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647491096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647491096, "uuid": "e8523549-eccb-40d1-87b7-3ade44b7cc17", "comment": "Malware payload (Heodo)", "value": "87f88a1261d88eb8105641a7f573fa35", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647491096, "uuid": "b3770c6f-1415-4903-b31c-a26385b224e5", "comment": "Malware payload (Heodo)", "value": "c36e2c35601024a175ffd0183f12c7d15351374de7d746dd0302b27169e208b7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647491096, "uuid": "70eba825-1a6d-472f-986d-bcb237fdbc55", "comment": "Malware payload (Heodo)", "value": "d7576e2e2a14439901a67fc3717d90ae43463c2b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647491096, "uuid": "dad8d211-872a-4087-a55b-fc1d2a4804f9", "comment": "Malware payload (Heodo)", "value": "474e7b7ebaf0e0a6870fc5bb2232127242ac2746be3253ac35478d3e7691275f4c463bec2cedf4f385b21cd5c440e6a9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647491096, "uuid": "dffacb7a-82de-4dc6-a15e-59e2479dc5cd", "value": "T14DE45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339973A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647491096, "uuid": "6516b08d-669c-4113-83cf-e3c27e84e2d0", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647491096, "uuid": "c88e4252-c98f-4c63-9db9-00bd0dac153c", "value": "12288:jc899XKPmN4WMkof6ZPJSFTdtXlcIL9v6O8:7GP7MgFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647491096, "uuid": "972d6393-4d7a-479b-9cab-abf44bea9e80", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647491096, "uuid": "c4521cf5-8a62-42d6-ae98-e9b1313d01da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647491096, "uuid": "c4c7ecc8-9989-40d3-8003-089060cf81f6", "value": "emotet_exe_e4_c36e2c35601024a175ffd0183f12c7d15351374de7d746dd0302b27169e208b7_2022-03-17__042451.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54fba90-a594-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647481838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647481838, "uuid": "496b8947-1c72-4c96-b02d-5d10bfb9e2aa", "comment": "Malware payload (Heodo)", "value": "dab98f68cae93b1812a970e810cc07a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647481838, "uuid": "d20ed034-78da-4d48-bb62-74bc82c5cf9a", "comment": "Malware payload (Heodo)", "value": "c3de1ccfdc6d5430f61e3d168e1813b73be3891a7d102d71dda06658aa811908", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647481838, "uuid": "4358ece2-b937-4a27-98ef-aebcaf6ee565", "comment": "Malware payload (Heodo)", "value": "a58ec8e6edb66eea42a814d20c8eb3203a862329", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647481838, "uuid": "e3fddbb3-b231-4914-b45e-0b1cb9257ce5", "comment": "Malware payload (Heodo)", "value": "3329e679a34efed0418891983b857d30e58c68f27c899cf557dd6cef4c15f086f749c7c9725ba2be0189aa124ebbd689", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647481838, "uuid": "4e435bd6-6ae9-452c-bf74-c05a6f095775", "value": "T164E45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339977A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647481838, "uuid": "d065246e-f6a1-4f6e-af16-7ac2f392dc7a", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647481838, "uuid": "35e03fbf-3570-4c3d-9954-a9429f44d2ab", "value": "12288:jc899XKPmN4WMkoa6ZPJSFTdtXlcIL9v6O8:7GP7JgFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647481838, "uuid": "79fa5ffe-4819-40e3-bf68-be647d0d7a83", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647481838, "uuid": "682c215f-7d68-4369-9e90-88f9da73e8df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647481838, "uuid": "3cf1b76d-4e0b-42af-ae13-b97dd905f33b", "value": "dab98f68cae93b1812a970e810cc07a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1d4879-a604-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647529791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529791, "uuid": "fa6f1a3e-276c-43cc-885b-d5013fab1492", "comment": "Malware payload (Heodo)", "value": "f875218e4b27d121608d39316facfa52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529791, "uuid": "ed4e9caa-c46b-4ac3-85b5-328ef4a57f63", "comment": "Malware payload (Heodo)", "value": "c4410201c7c48a38218dcd68480551c4b9df570bea30b8d3b9578ef0e2567c8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529791, "uuid": "275b9484-4b62-4de9-9b13-913a34848015", "comment": "Malware payload (Heodo)", "value": "ab644d0b22a2dd04229115aeb9a1c1b0b1472576", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529791, "uuid": "2df682c8-a0ec-46ab-911c-f272a3ed71f1", "comment": "Malware payload (Heodo)", "value": "e8227859eb36715e97dd6c88d85c588124a82667fdb17a53d34c0fd8ddc049b2909118fde17cc485765615039e6b77c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529791, "uuid": "1dd963cf-295d-42c3-bb79-cd8ebe2bee85", "value": "T1B3059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529791, "uuid": "6faecfbe-8724-462c-9abf-609ba87dde4f", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529791, "uuid": "e0f385db-88da-41eb-85fc-42c7428351f2", "value": "12288:KVHML2QJe6XxhqCW2QHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhquQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647529791, "uuid": "95da34ce-e734-4ef0-b306-7fb11bb6a03b", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647529791, "uuid": "fa2ace5f-c3f3-4138-9ff7-2f1bd74b5a3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529791, "uuid": "7ca05c2a-97d5-4ec5-afef-8b54b83519f6", "value": "f875218e4b27d121608d39316facfa52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09a3530-a635-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647551114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647551114, "uuid": "1315537a-6e07-4d7a-8d52-b92440af1f9a", "comment": "Malware payload", "value": "994de6a3f96bd710d620e1396e1bec92", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647551114, "uuid": "ef163fee-8b36-40ed-8e09-c9a18721de26", "comment": "Malware payload", "value": "c50bca08a8e80850ec18d258ff937b7b72a500d9027c730c86b05aa73c938b5d", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647551114, "uuid": "d15eaa19-e65b-425e-af6c-f832228f10bb", "comment": "Malware payload", "value": "53489b26fcceff4ef3240b2efcbfb38a78d24c4d", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647551114, "uuid": "4c1ce50d-b4cf-4089-8d16-2d848a7e5cf2", "comment": "Malware payload", "value": "7700a123c97b3cb3549678c66d5c5a1c86be8f3864679193274805a808efecc33b101b6496862bf43614d29113e230ad", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647551114, "uuid": "686c3f2c-149c-408a-af5b-658bb05535ed", "value": "T194D59F45FA53A2AFCD9B197030AE733AD630481D011A8F77EBDC5D71AB2E7105A48E1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647551114, "uuid": "87fd18e9-a628-4f8e-886e-6243509e7016", "value": "676f66b42797477a467945daedd979f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647551114, "uuid": "eb181af5-1b5a-47a5-8504-e91492c1f15f", "value": "49152:0nD+4ZGKs6mI3TpA6VT+6dB2ars/YdNDc/RgaJ2wgI:6DHdr7pV9tjw/7vwwgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647551114, "uuid": "831c2eb8-c576-4241-8def-1086e4fb9572", "value": 2996224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647551114, "uuid": "4d467e3d-5243-4602-b338-2431c119cb7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647551114, "uuid": "55b885b8-8b5e-481f-8cf1-041634fe4767", "value": "53489b26fcceff4ef3240b2efcbfb38a78d24c4d.rl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0443e245-a62e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647547711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547711, "uuid": "fed53d8b-6553-4b89-8f25-f9f39746a3f0", "comment": "Malware payload (Heodo)", "value": "1a7b7b2d299f2897b8ef0a86f81783b4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547711, "uuid": "1c7e8478-a5a9-473f-ae84-f7e8141a5748", "comment": "Malware payload (Heodo)", "value": "c67be9eaf935a40ee49008fb4d73f5fde5b00bed6d81e699ba067de1b2357c35", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547711, "uuid": "da18d492-c32d-4ef8-9e6d-9ef836e04845", "comment": "Malware payload (Heodo)", "value": "980fcf2e84a8d82c70e90cd032c91871175612d7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547711, "uuid": "475b5780-b884-4a71-ac14-fd6921c49ca8", "comment": "Malware payload (Heodo)", "value": "5bd2fd9354a45b4035b99c9e20baf748b061931fc6b43ec2a9044fb2f988149114fe00dd3ee1ed63719f63f77d2650bf", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547711, "uuid": "c18c1c0c-fb90-4248-a8e2-6bddb88a07ef", "value": "T18DA2AF3ED221E818D67B987C830580F6E70B2C561007A9ED2D51F25D66726F7138FABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547711, "uuid": "7114fc45-4366-4fb1-8cb1-7383b1f2d260", "value": "384:SQZAVb1GNjJITo4CGzPd6ZIwVKb5CzgObff9kC+xbX7zL0crX:STINqTo4FL3CBn9kC+xbLHjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647547711, "uuid": "2b8956ea-fe99-4379-87eb-7cc57f86f6ce", "value": 21461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647547711, "uuid": "c9eb39e3-fe1c-4e04-a895-3fbc4518418d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547711, "uuid": "a2afd9b8-d730-4c35-a8d1-e0d27a2aa352", "value": "Electronic form.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b66af9-a585-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647475269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475269, "uuid": "8683d104-33b3-4124-a5ae-7db6489cfdc5", "comment": "Malware payload (Heodo)", "value": "a32e3a74945757699cdc2a8b44b9671e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475269, "uuid": "6c3fa2d2-99d0-488d-98d3-f33419c6bc4b", "comment": "Malware payload (Heodo)", "value": "c6a95fc6af7614c239ee421db78befae841dbda2510611796288d838d26da88e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475269, "uuid": "9e2e55d0-9ac9-4e14-8bfe-421e70dbdb85", "comment": "Malware payload (Heodo)", "value": "bc851581bbcbcf100c664c2fd1bb9c3b8c456952", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475269, "uuid": "0549fa54-99ff-44cf-8c98-1cc1dc99a33c", "comment": "Malware payload (Heodo)", "value": "295ab03077cb456a0f2e62322b19f945ccb278ce51a5c206a4176ce938512d633f2c536f56b6acf10d534a5aa60482a8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475269, "uuid": "b93c8e0f-2592-47b4-94b9-10c48c1a658f", "value": "T178F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475269, "uuid": "1fb32617-ed56-4392-8970-cf46ad706123", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475269, "uuid": "73a25025-0923-4fe9-a94a-eb8ad35a296a", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hQ8rLneTfABCJoWRWwfpW:BeCCF88j+Xl8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647475269, "uuid": "fe821d91-2f88-4d31-acca-cf1f156cc3dd", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647475269, "uuid": "53a0ffb9-e49f-4296-b877-867d42f4ca39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475269, "uuid": "53f093d8-654b-4bda-b647-cbcd47e9fab2", "value": "emotet_exe_e5_c6a95fc6af7614c239ee421db78befae841dbda2510611796288d838d26da88e_2022-03-17__000058.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1bd335-a58c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647478169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647478169, "uuid": "225018f1-a90e-4e8e-a514-0150e188cce1", "comment": "Malware payload (Heodo)", "value": "ba1592e358c544b252bfeab60efbf55d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647478169, "uuid": "9d7a0eb3-8400-49c0-b397-7dded32834a0", "comment": "Malware payload (Heodo)", "value": "c6daf8af0c4613f09fb234485125931c2040cda0f4a80aa85a459714e251e0d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647478169, "uuid": "a417375f-cf07-417f-8988-8d9680ab2499", "comment": "Malware payload (Heodo)", "value": "8aaec59c4e4b6bcb6e2696bdcbfb2ac58de1442b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647478169, "uuid": "1cb71d28-0702-42aa-85fd-8f7c0dd3ac7d", "comment": "Malware payload (Heodo)", "value": "cac23892f41cc488f33595fb28c96dc242e09b7a48e3481e215cee1f1531106e1070e309909a514bffeaae3b5d4b3be7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647478169, "uuid": "8dd79d4c-fbd0-4948-88f0-15fa835dc748", "value": "T1D9F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647478169, "uuid": "c39a6653-1248-4b90-800f-deb5688d760a", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647478169, "uuid": "25be3a08-ac1e-4580-8e98-69c386fe9dff", "value": "12288:WZjb8BOPxue5dKV9M/98f0koP8XvkgKtuBdfMAofD:WCBAdKV9Xf0kj3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647478169, "uuid": "9143b492-d603-4b6e-bf8e-641214e56fad", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647478169, "uuid": "a6bc85a7-2b7e-4b13-b57f-bca557941eea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647478169, "uuid": "8d15d618-4e6c-48dc-bd32-2cc7fb23dc03", "value": "ba1592e358c544b252bfeab60efbf55d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0351527f-a5bb-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1647498317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498317, "uuid": "ad41ff85-b684-42d5-b88e-d682fcc30508", "comment": "Malware payload (STRRAT)", "value": "98817e8c40f9c32744058de7fed19d11", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498317, "uuid": "15774272-c408-4925-be7a-18b204481999", "comment": "Malware payload (STRRAT)", "value": "c752d2827f3d223d9c2d368fa521d96660c4b9b2360c1dad3ec30e87b5a9491a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498317, "uuid": "4fe6c596-4a24-43eb-bfe6-e81e88ac541c", "comment": "Malware payload (STRRAT)", "value": "bf554d4a508e654859fa3324b63307b69d9e8aa2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498317, "uuid": "77e17615-6808-4e73-98f7-c2e1e980304b", "comment": "Malware payload (STRRAT)", "value": "3119d7148d933a7f9d55459d238c1f0275500d037b594717044b837a82a34918e04b764b7c90b578ab7ed1079dbb56e2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498317, "uuid": "c019fc54-0e52-49ce-9708-f71f3ae60ab0", "value": "T1720422249E5594A96A25E0F03F2F6D95CF8EEEBD8318054E004623C6F5AF9308BBD371", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498317, "uuid": "81f75dc4-2678-4e86-9779-2e3a701298f0", "value": "3072:jyxmWqzp3DEKwg9Z5l378jMU8kqvutMmUur63alIAw/Vg1iLZlz:Gxm5lgU1L8j8F2OmUur7lIvtSiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647498317, "uuid": "25b6ca41-f0d4-4823-8e2d-3d4634bd5ba3", "value": 181314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647498317, "uuid": "9cead4af-a33a-469f-9c9d-a52bed665763", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498317, "uuid": "e4847c31-2e46-4339-93c7-0584f3641394", "value": "SWR-8600243 ___ 0002018 __ FZ4062P ___ pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc38b7bb-a609-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647532155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532155, "uuid": "7aa4d9fc-944d-41f6-9b0c-bcc9d7d33aa7", "comment": "Malware payload (Heodo)", "value": "2aabf317002b64b8d6044662dd96d41e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532155, "uuid": "243e099e-cbc1-4839-a234-039712162be2", "comment": "Malware payload (Heodo)", "value": "c8614ed19831001ad54d367b77d046a8ea562a22b63327b1c650e2c53e41a158", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532155, "uuid": "01872fa8-97c5-405a-9da4-3b9601051733", "comment": "Malware payload (Heodo)", "value": "0cc55c3ee97224294cdcf3d6b8dc77caa6dd89d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647532155, "uuid": "1902ba3b-1baf-44bf-a3b3-144654abd178", "comment": "Malware payload (Heodo)", "value": "ee110ad87e2202080344055bd839652740a5f1be207b3ff70addbdaa9aad80128a06284e526c78a8dd473a6ce480c9c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532155, "uuid": "ed6f4fe2-7f45-486d-b8fe-c99a03cb9899", "value": "T1E5059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532155, "uuid": "9d264dc0-e50e-425e-b3dd-544fe02f62eb", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532155, "uuid": "ee73182e-f961-4e81-81ee-40a61fbd2009", "value": "12288:KVHML2QJe6XxhqCW8QHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqEQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647532155, "uuid": "715cc43f-706a-401f-8e44-ff3c9aabf174", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647532155, "uuid": "9200af5f-2374-4cc8-9b03-1345cad89447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647532155, "uuid": "bb7664a7-5c5e-455b-9275-9d7d1eb3f81d", "value": "2aabf317002b64b8d6044662dd96d41e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "748ac2be-a5f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647524277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524277, "uuid": "9ea559da-d513-4122-8fd1-f859d5bf5575", "comment": "Malware payload (Mirai)", "value": "02b0b977ce5d3a6c2f04b58b4900436d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524277, "uuid": "9b0cb773-b711-48ad-9609-a103d37ac436", "comment": "Malware payload (Mirai)", "value": "c966f81ddfd5c2a30fb5fdafea23f4a2c10341fcd00ba3265b6ffa972fa0a70d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524277, "uuid": "be037122-9618-4358-80ab-e154a9bb28ed", "comment": "Malware payload (Mirai)", "value": "c1217220781c69a0b32c0fa7aa57e2d0deed222d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524277, "uuid": "bfe3e4c6-9d5e-4773-bc8a-94b0b1b2affd", "comment": "Malware payload (Mirai)", "value": "d15f62ad3240186218c1f6a541d513d096d90d071ee61d3e48b542a7fe9b0963fbad4abb3a525cb5ed4c4a844262ac34", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524277, "uuid": "2102a142-6e44-47ff-bab3-c31fea0d3d14", "value": "T1FFB33B376251C97AC08356F427EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524277, "uuid": "2f7b8491-f317-4d99-b1e0-17fe0be16542", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAB+TRCm7FnVqfJXFWbNb:T9a2aLqkrMcsm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647524277, "uuid": "73945888-5d87-4543-99a6-058156b1f8f1", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647524277, "uuid": "8db5a811-62df-4e11-b928-f209a0a77b2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524277, "uuid": "b7c7f161-ec4b-482f-a282-0030db5fdf4e", "value": "02b0b977ce5d3a6c2f04b58b4900436d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ad08ad-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518606, "uuid": "54949431-f77a-43d8-93a7-13a89882756b", "comment": "Malware payload (Quakbot)", "value": "40a9bdba141a6c7de6459bed8149af8e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518606, "uuid": "b9257863-61d8-4844-8d8b-e3eea8bc4f78", "comment": "Malware payload (Quakbot)", "value": "c989a42a00d91281923d1d2baaa80fb3970ee2b6fef93436d4367d00f5d2e049", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518606, "uuid": "b0caa95b-6b70-4308-a1a0-e983ca8a9a21", "comment": "Malware payload (Quakbot)", "value": "245b05b56c79e85f3faf3859e939872bbf0c1990", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518606, "uuid": "63b90ced-94d5-42f2-90f8-a091362b913f", "comment": "Malware payload (Quakbot)", "value": "22568d5e0ff8087b40b42b6bb392b8a018157f5ab3e0fcc167fe583cd63fc9c13a7ac36f3990ad567cf8bc5a5156687c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518606, "uuid": "90807a4a-f301-4367-81b9-1736bd973f8f", "value": "T14B15BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518606, "uuid": "af776eea-623f-4cba-8574-8ed388b3f327", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518606, "uuid": "099c024f-c75f-4ca0-8c55-5b0f943f97e0", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518606, "uuid": "2d2c2575-d738-49d2-ba26-611937c0c1bd", "value": 944573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518606, "uuid": "b0e3a9b3-e9c3-42cd-b4d0-2524e74283a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518606, "uuid": "0cb1148b-cf8d-41bc-bcbc-2b0703dd9b8e", "value": "c989a42a00d91281923d1d2baaa80fb3970ee2b6fef93436d4367d00f5d2e049", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427de2eb-a585-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647475230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475230, "uuid": "e1df16b7-b770-459d-96ae-409208eb4317", "comment": "Malware payload (Heodo)", "value": "306d53081c154f268418a508ea3e6c9e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475230, "uuid": "dc2b0bba-daff-442d-bf17-9265a934ebb8", "comment": "Malware payload (Heodo)", "value": "c98d28313aa852abc73c4d854a5a57705502203f460fb082d1c139bcc1d9bb4e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475230, "uuid": "828e4b32-bb43-47af-a1eb-e8d56b4438e6", "comment": "Malware payload (Heodo)", "value": "fb46ca6da4be0f4d5c449268b4d637aa9c09d2e7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475230, "uuid": "0a04e834-18ed-46b6-966f-ee655c85a5c9", "comment": "Malware payload (Heodo)", "value": "d41a5df52acdbe9900d4402068ec51b71a64831dc8e82baed5786b0ab0ee3f4280d4b19939188aa0504118d414c4c3e1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475230, "uuid": "a04890e8-956c-4194-b56d-133ce57a449e", "value": "T18AF4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475230, "uuid": "9092d521-0aa8-4813-8cfc-1ddfdae8399a", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475230, "uuid": "9adf287d-9848-4bef-bdc5-a9b691ccde2b", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPHXvkgKtuBdfMAofD:WCBAdKV9Xf0kE3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647475230, "uuid": "d495d947-9c79-4439-86d4-a195b7c3520b", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647475230, "uuid": "c6ed05bf-c51e-4af0-a107-39e436a3d94e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475230, "uuid": "12ee96ad-06dc-4d57-941b-9d4e0f33ce1c", "value": "emotet_exe_e4_c98d28313aa852abc73c4d854a5a57705502203f460fb082d1c139bcc1d9bb4e_2022-03-17__000018.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36afc64-a611-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647535576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535576, "uuid": "7d35d00b-a809-431f-b7d9-b7d119abd233", "comment": "Malware payload (Heodo)", "value": "b6ab4c3ef4c1996fd9719fedc412425a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535576, "uuid": "dcf6fb69-cd88-4568-869e-35cf22ac943e", "comment": "Malware payload (Heodo)", "value": "c9e46be7231e1e04969844ab73f00302427bf35360c4f5cf640d22755650a0ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535576, "uuid": "ba377684-b9f1-4635-92d8-3fe66cdb871a", "comment": "Malware payload (Heodo)", "value": "9bdef7ddfa4d808e2c0a80a48760dde089da7352", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535576, "uuid": "b08cb716-0561-4c2f-8fd6-edcf2fd15a22", "comment": "Malware payload (Heodo)", "value": "749fe63332a4e17d5e7f33f009e43b807b28957889c9b525010adcfc0c4fc6fadf5516644b52e357314768a8987cb982", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535576, "uuid": "566fd4be-3f8c-4441-b6df-1794c4883bdb", "value": "T168059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535576, "uuid": "7d38a838-5c68-421f-a79c-5aa8ff082fba", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535576, "uuid": "4a04a8d9-daac-4101-8c36-577987c86cb3", "value": "12288:KVHML2QJe6XxhqCWpQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqxQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647535576, "uuid": "bbf15937-0548-4855-9b48-68b2969900b3", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647535576, "uuid": "16b8bd0a-3388-4210-9559-0f50a8147759", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535576, "uuid": "e05dce72-d64a-4553-80e6-1a1f6664cc9b", "value": "b6ab4c3ef4c1996fd9719fedc412425a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5cf19a-a612-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647536019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536019, "uuid": "bf9a4322-af8a-489b-a74f-9f88e66b91aa", "comment": "Malware payload (Formbook)", "value": "f88f6d3af7fccd279d4d42a740950c60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536019, "uuid": "527062f5-750a-4025-b4ee-a7df6509501a", "comment": "Malware payload (Formbook)", "value": "ca0cfe500b3f6a17dd31e684c1b32c9190b08480cfc630c23d1ce6cb6164918d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536019, "uuid": "b7938334-4c0f-4f85-b12f-a27d8586e8ed", "comment": "Malware payload (Formbook)", "value": "095f22bb233137ca2e1bc11369d4df0c364cbe0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536019, "uuid": "6035f337-66b7-4031-8f9c-dbc0f463b212", "comment": "Malware payload (Formbook)", "value": "e2aaa2c3c43072aa671e347cd1869d00d7a9ddcb0c2c72976c08176fb0c130466bb44934a8bcd6e0c1e2ee9c53fbdccf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536019, "uuid": "f4b5b4d6-8576-4543-891d-52aa257cfb5a", "value": "T1AA356CF6A2518832D4223A384C5F5FB9B4297E01EDE4A546EAE03F0D3F3C571ED21A56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536019, "uuid": "4c9b668b-69b9-48a3-9d24-d49525dc1eff", "value": "066f2adf6884c84166ea572f3442e2f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536019, "uuid": "1fa63f79-aba3-4f62-8d51-19cd7d016aa3", "value": "12288:RbojJKNbgMwT2NRAvS/yqenMbJjRsBp8oziAO8Iz2sVW3MFqI6F3HAhcAszeVQ18:elKiCRAvS6qOMZGBNgz/qTHAhU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647536019, "uuid": "c29f97ce-902c-4050-a6ed-8b386b04f3f3", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647536019, "uuid": "b902673a-f81c-46e1-bf3d-110411ec8fbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536019, "uuid": "3bacd44d-808f-4707-8f30-3fc290b26b02", "value": "Immyoao.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0952b409-a62e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647547719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547719, "uuid": "9487c486-f0a3-4d74-bd5a-a95b9f08aa62", "comment": "Malware payload (Heodo)", "value": "5abdb5f05923e6f5ff19f7c64ffda421", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547719, "uuid": "86b7c344-5793-40a8-9a0b-802a56c7695d", "comment": "Malware payload (Heodo)", "value": "cae30842311233cd522404de40a346376788c5fbd736a8eb6adbcbf36b0243fc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547719, "uuid": "480403eb-9081-40ef-86c0-17ceb840f4c6", "comment": "Malware payload (Heodo)", "value": "c53d17f356d4f790a0e67373dd20cf702cf1fc5e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547719, "uuid": "d541e9a1-bf9f-4c16-ad3a-69d9d631e55b", "comment": "Malware payload (Heodo)", "value": "8bc2380fb7a26ea6f1df64a8f53d8f461161da5b36d710fd8742e018e27a9008e8440298d5a982dba1f2d9a8346da113", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547719, "uuid": "f4a4b2e5-c15b-4c91-a073-70ac33b7091a", "value": "T13DA2BF3FD132981CE67F987C430440F6E70A1D86600765EE2C45F26E66726B6038FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547719, "uuid": "55477ec1-2ba5-4200-8f10-7d46ea316bcf", "value": "384:oHTyVb1GNjyo4CGzPd6ZIwGdKb5CzgObff9kC+xbX7zUSA:cuIN+o4FLYCBn9kC+xbLzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647547719, "uuid": "d829e661-5b86-4484-bf31-e3284243e6ee", "value": 21444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647547719, "uuid": "4ccd31ef-8218-466b-bf96-111580893453", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547719, "uuid": "b2b3e988-d6a8-4ad9-9316-a524ba9a1d2f", "value": "Inv UJ-9954_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2375d83c-a626-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647544327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544327, "uuid": "58fb1e3c-1c5a-448a-8e27-f2f066961a86", "comment": "Malware payload (Heodo)", "value": "75312c736259ca7397572a7c15965a2b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544327, "uuid": "7ff0de12-d2bb-4961-8370-da7a3df025da", "comment": "Malware payload (Heodo)", "value": "cb2519f41c3a01ce2acb45949dba217c2a59f358d0ffb3775e679e3a8d1b4de5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544327, "uuid": "c75ad61f-80c9-40e6-827a-18dc61cbd089", "comment": "Malware payload (Heodo)", "value": "78d5bf80139fc8fbbd49b452d20438bd8c4d7d28", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544327, "uuid": "bd7939f5-746e-45fe-8090-7e190bd71c3a", "comment": "Malware payload (Heodo)", "value": "b28ed5ee97596c2b01fd44453b4892097b2c7adbba30124573a436113920f4cb1bff504a3a0e5e5514930822f1406a16", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544327, "uuid": "dd963425-faba-4429-bd8b-70730d90cf0c", "value": "T19CD47B0023729872C3FF53760EE592F05AEE6DA1873101F735B872AD4A779D1A73492A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544327, "uuid": "0f0ccf7a-7777-465e-a91e-eb281c6379e4", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544327, "uuid": "cac936e9-375a-4c8f-9cce-e291e4d148de", "value": "12288:mc5R6LLnljSDIGRIyAAPIqjYtRL2CjzhmD/bwb1r8Hc:Bg4IqjYT220D/bwb1wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647544327, "uuid": "b535548a-b567-4c1a-8a59-59f2e11430da", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647544327, "uuid": "ebac2186-d580-4be9-b50d-e8fffe63b472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544327, "uuid": "b7fc663c-2c52-4648-8bd2-a7aea88d6655", "value": "emotet_exe_e4_cb2519f41c3a01ce2acb45949dba217c2a59f358d0ffb3775e679e3a8d1b4de5_2022-03-17__191159.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eacc7a36-a5dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513308, "uuid": "b0a05898-4915-4a32-9371-9706ca62c3c2", "comment": "Malware payload (Heodo)", "value": "eee6ee480378ab454beab4a972815dac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513308, "uuid": "282298f3-5ed7-4aad-a864-1ca3708712be", "comment": "Malware payload (Heodo)", "value": "cb79e562c58c71770dfa774baba70e923b9ee3d5d406e6916fadd6f669ff339b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513308, "uuid": "23ecab4d-9835-42f1-89aa-8758937105bb", "comment": "Malware payload (Heodo)", "value": "a3254593ef458d7a9e8111d96d3a46de8fdd13be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513308, "uuid": "a5063987-198c-4c4c-88a8-90815275acde", "comment": "Malware payload (Heodo)", "value": "a7f05e8e636c1b86998494f32ac9c5afcf9b6c9829829b941981afb85b15b5b589648373fe9d8a980305486e003df76a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513308, "uuid": "cf05b7a3-9649-4db7-8547-ec15ef674eec", "value": "T151F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513308, "uuid": "837cdefb-b3f5-4acc-a638-49750fafa5b3", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513308, "uuid": "cff571e4-6f9a-419a-b8d7-1d0c7f6ae5fd", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hY8rLneTfABCJoWRWwfpW:BeCCF88j+Xt8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513308, "uuid": "605c4bbf-5d69-40b0-bb64-3930c0436dfc", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513308, "uuid": "d265e231-ff6f-4753-95f5-23a6f40806fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513308, "uuid": "9fb726df-d193-497d-a545-4fe501a3d04a", "value": "eee6ee480378ab454beab4a972815dac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1270620c-a5f1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647521535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521535, "uuid": "88b1ecbd-f5b1-4189-ae24-4410b9fea072", "comment": "Malware payload (Heodo)", "value": "ea1977c36496161c31205838ccc2448a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521535, "uuid": "b5873f3e-d6a2-4f73-97f9-0fe54dd62fc4", "comment": "Malware payload (Heodo)", "value": "cd39177ca1f21d3fcb4abf278ff2845ea96703b5bc6f8cb712218a85610aacae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521535, "uuid": "9ee9dd5e-4c89-4910-89b4-0590086f14ff", "comment": "Malware payload (Heodo)", "value": "519b6dafd17a833a207ad6345afd4d2554cff092", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521535, "uuid": "04b74ddc-1802-43d5-9bea-e6deaa0388e2", "comment": "Malware payload (Heodo)", "value": "61f21ad9795739440b6aa29fdb8c15c3776b9eb93d313ea9a550bcbfe867f92a6979e28de52c251a6c91cbfd906e4c1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521535, "uuid": "e938ca6d-eccd-4dcc-bf55-fc735cb08296", "value": "T179058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521535, "uuid": "2fa53481-f921-41c7-b8df-021305c7f1cc", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521535, "uuid": "5ebeb43b-87e4-4195-afa8-02ebbdcc0533", "value": "12288:Wvz1CLJyyvmMLSrBgO4ruGbPlVpqb+DlYzv:WJCLJyybLqB74ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647521535, "uuid": "9d3035d4-41e4-4ff2-b191-80d08e7b3cf7", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647521535, "uuid": "2b408e68-cf40-48a6-b459-87c4c3b0e855", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521535, "uuid": "f0db3031-e022-436f-937e-50d1acb61c55", "value": "ea1977c36496161c31205838ccc2448a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0c561a-a5f1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647521553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521553, "uuid": "fae17c65-cbaa-4513-995a-ba523239cf44", "comment": "Malware payload (RedLineStealer)", "value": "afb5f20fcf96bed84adb7d81da96756b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521553, "uuid": "6614c76b-21e7-46de-b5e8-d25af7e2711f", "comment": "Malware payload (RedLineStealer)", "value": "ce3ce7731b94e9baa021d47e97b6b0cf0f3634579feba279871e4da58452f5b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521553, "uuid": "962a7c45-11c1-406a-8d0b-d070f386cc58", "comment": "Malware payload (RedLineStealer)", "value": "56a7f99fc287b488d24bbe9ebf2c97ec708f40e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647521553, "uuid": "f8af2b4e-e3de-40b5-8e13-b8b9f629364b", "comment": "Malware payload (RedLineStealer)", "value": "29e84fc83615eab9cd9eaa018e10baf0c9526f76ff5d9c5412dd23185773584561f82b2a4d15d14616781c782a773940", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521553, "uuid": "5297e08e-331b-47ea-bbad-35450a64acdf", "value": "T161A4C010BA90C035F5F711F8A9BA93ACB93E7AA15B7050CF53D42AE956346E4EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521553, "uuid": "556423e5-18c2-4dbb-966e-4fec03af4b89", "value": "0ca9b05a489def699a29df5061ef8fa2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521553, "uuid": "e2c46c1a-0022-4130-b85b-30b89d29b86b", "value": "12288:BsQsnalmbrampCa2w9UZB5hhsl0zeM0e33uZ2HPWQVHO48i:Vs+yraa2w9UZB5hhsS00eZ6BO4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647521553, "uuid": "2d375ee0-1610-4da4-b094-10e7811a96be", "value": 479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647521553, "uuid": "0c656923-8e2b-4f35-b78c-5bca07905ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647521553, "uuid": "d41fb782-45aa-48c2-b7c2-a4e15153a48c", "value": "afb5f20fcf96bed84adb7d81da96756b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813e341f-a613-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647536324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536324, "uuid": "7ccdc537-05ec-4935-8cf8-d0dbcd694a62", "comment": "Malware payload", "value": "079cf421e3011cb47bf4d36f90a39e08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536324, "uuid": "e3538081-4534-4fb0-89f3-c57d8e216a65", "comment": "Malware payload", "value": "cf3e6858eb5f697e4d33357a2889e68b53e0df960f161b4bea8e17b5f86b5f13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536324, "uuid": "d33ef5ed-0966-40f1-bb5c-0ed346e4da35", "comment": "Malware payload", "value": "db4ec92375ee5e4d917edba5709659bbd6257831", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536324, "uuid": "18d6726b-7af1-438c-91f2-5e51ccb56c2c", "comment": "Malware payload", "value": "a1751ccf109810558689fad4c854dec03317480d600a952e56fbd48263b8cb1fbef23ca0ccfb5a43d687b57e308b8e45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536324, "uuid": "99ce34f2-8ca4-4392-80d8-39eed88f3ee4", "value": "T1CA5639F329E027DEC16AD8BDC255B43ED67FF1364E1AB0A7946272B5A923C10B518F04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536324, "uuid": "766f9c8e-9e28-4786-88ff-ee6df0e31106", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536324, "uuid": "08d46594-b335-48fe-bce5-46c743e57940", "value": "98304:J+IO6sJwv3vD43ZM0d4Uv8YeKOsWzDMFSG5NHfEo0YCzP1+:J+V7Jw3vD4C55sWzDQSCNHb0n+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647536324, "uuid": "6f421b36-e5a7-4979-91fb-26c54077c0a5", "value": 5923860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647536324, "uuid": "fbe528fc-abbe-4239-bbf1-f6d7fb025f67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536324, "uuid": "534db4f3-0a2c-4fc9-95a2-19c31e591662", "value": "14167913.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410819be-a585-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647475228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475228, "uuid": "583869b5-12f3-4944-a0af-a0e9dba4bb81", "comment": "Malware payload (Heodo)", "value": "9aec31ef6d87624434bb9e0bc936e35c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475228, "uuid": "1796254c-8167-48f9-8fed-087d0fd33e83", "comment": "Malware payload (Heodo)", "value": "cff8437e88973cd0d75ef96944ea21cad8ce12022d670017d782a196696be82b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475228, "uuid": "6be62b8f-b7b7-472b-8270-9faac0e0326b", "comment": "Malware payload (Heodo)", "value": "ed2cb2c67ec1633844131a2024071b2d4bf0518e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475228, "uuid": "d0aabc0b-7126-4ed1-9775-79f5649b776e", "comment": "Malware payload (Heodo)", "value": "412bfb9adf394a68aaadf22337c7f4c406ac0f1b20ccf2a416bd3a996cd03c1caca5e11a9301d57123349008ee70cb43", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475228, "uuid": "00043b6b-f92d-4965-9d67-d28a129ef585", "value": "T1D4F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475228, "uuid": "4c4a3d90-92ee-42da-a3e0-5cc1e37e5eac", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475228, "uuid": "b3bb215d-e2c3-41b5-a444-ca18bd16ba6f", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPcXvkgKtuBdfMAofD:WCBAdKV9Xf0kz3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647475228, "uuid": "b263d947-26de-4c80-b950-50b717b70863", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647475228, "uuid": "6534e3d6-3139-4ae0-b2ec-c165e3074d5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475228, "uuid": "bcd1189d-0fe5-4069-b9f1-b5ed05523154", "value": "emotet_exe_e4_cff8437e88973cd0d75ef96944ea21cad8ce12022d670017d782a196696be82b_2022-03-17__000019.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52accb99-a619-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647538823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538823, "uuid": "d9f785f6-43f0-4ed5-a1a8-118a420bb2e3", "comment": "Malware payload", "value": "24a3fd38c812cc05eeaf6b8516d9178a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538823, "uuid": "854adb88-ec5c-4f4a-8aca-05d6eb8ecbd4", "comment": "Malware payload", "value": "d0207c5b377f887bbdc7e70a14c234c1b23dff15e8aee389c4595cdc0254c8a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538823, "uuid": "0509f118-8835-41ee-8313-33bc3399149d", "comment": "Malware payload", "value": "d12992554da14f84f652283c6bddc9c82daa9569", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538823, "uuid": "fc0480e4-43f7-4b15-9e74-1d1f2b882d7d", "comment": "Malware payload", "value": "5384e42a11bc11c0a05a8106cd8956cbd55097a66b31db6a7d6664cf465776597dd1bf51405aa45b99baf7ff07305d8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538823, "uuid": "556feeb4-a4b3-48bc-8984-fb1ea93e39de", "value": "T18532081EBBC8CD25D1BE973838B3855042B2D90F9101DE5F2EC6A9DE5DB3BC50522B86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538823, "uuid": "767b1fba-87d1-4291-aceb-41fcadd41480", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538823, "uuid": "63c81188-5c8d-4084-98ef-b3e83d659f3c", "value": "192:G58fG1iBuY6/nD/iAzJH1RoM2BkTmv3Pwa0cCT21kLhplsT8sT2Fz:E8fGQBuVnDKA9HLwk8wa0cCT2mlsTzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647538823, "uuid": "700ceea0-8a0c-495d-bd7a-3d4143bd6d19", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647538823, "uuid": "6fa2056b-8763-4bc4-944a-75031c99b6ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538823, "uuid": "cf1c29e9-c9fa-4675-8513-afe75a7fcd79", "value": "24a3fd38c812cc05eeaf6b8516d9178a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad42df5d-a61b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647539834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647539834, "uuid": "79dedbd8-f26c-4176-a120-8f382e6ba130", "comment": "Malware payload (Heodo)", "value": "160f83f8f40e2178ed8fd871a867d587", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647539834, "uuid": "25daf9a2-d8eb-40bb-8c76-8a861b0c72eb", "comment": "Malware payload (Heodo)", "value": "d08d09b7c729276daeaf6c7806e717dc549dff03ed7012eca4a382ae50c9a202", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647539834, "uuid": "52a2a2f8-8976-46b3-81a7-153861fc43a9", "comment": "Malware payload (Heodo)", "value": "6b153060db6263a4db33c803b5a5da25499a41f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647539834, "uuid": "b6e596c5-3333-44d9-a13e-2934924e37b6", "comment": "Malware payload (Heodo)", "value": "9a4f9ad194dc3ed82a227ad2e55325ff874a474fdd45817024a1579fe8c4da3cf10e86e414be1299335243e54e9d40f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647539834, "uuid": "78649809-2357-413b-a1cd-75a7ec8a245e", "value": "T193058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647539834, "uuid": "6c2bd9c3-e683-4b30-a43c-06833168d584", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647539834, "uuid": "f41ba819-49d5-488d-8525-3f5dd205b825", "value": "12288:Wvz1CLJyyvmMLSrBg64ruGbPlVpqb+DlYzv:WJCLJyybLqBD4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647539834, "uuid": "d6abba29-41b4-4036-b3e6-1ac42e416238", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647539834, "uuid": "37350351-5360-42c5-b59a-9900c630e163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647539834, "uuid": "22171652-a6d1-4e58-83e1-13f1503b2169", "value": "160f83f8f40e2178ed8fd871a867d587", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23271b6d-a620-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647541750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541750, "uuid": "49088965-dfa8-4d4e-8cef-3c9944515bd1", "comment": "Malware payload", "value": "b19ea2a8ffa853deda26235b5f858644", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541750, "uuid": "ffb21be0-0631-43c8-9e7a-7602a2dfee99", "comment": "Malware payload", "value": "d0fe24b326b242209b75fa169f5f9b3183563fc36a41db3274bef23963e5edd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541750, "uuid": "8cb8213f-bd9e-49bd-9baa-2fe6b591aa80", "comment": "Malware payload", "value": "9b07210681875ecf551646d0a386b7ae501b5076", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541750, "uuid": "2bfa411b-0940-4f39-990c-4cae4ccfb191", "comment": "Malware payload", "value": "2ad42d5c28c927795d29749284ce795bc53bacbabc5726c2bcac2a61ad8560a13d67b874671211ce7492fb92c37ec57a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541750, "uuid": "6ab0dd58-acdc-4b4f-9579-73df5ef3dc99", "value": "T107058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541750, "uuid": "18b9936f-fed8-48e5-b470-a1e7495d9685", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541750, "uuid": "273be590-4e75-4558-a85c-5f0a052987d3", "value": "12288:Wvz1CLJyyvmMLSrBgw4ruGbPlVpqb+DlYzv:WJCLJyybLqB54ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647541750, "uuid": "10af7f10-212e-426a-8818-082aaa12fa1a", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647541750, "uuid": "8e42c4f9-f7ba-46ec-8246-139ebbd647a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541750, "uuid": "f0fa6251-a295-421d-9bf7-869659f04de0", "value": "b19ea2a8ffa853deda26235b5f858644", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0dade5-a63c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647554109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647554109, "uuid": "10aedad3-19f2-497d-a752-fbf32d915e8e", "comment": "Malware payload", "value": "c05bbc42075de12ba1ee64afaedb9212", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647554109, "uuid": "4f7ded6a-f28c-475c-9b39-c35998adc110", "comment": "Malware payload", "value": "d212376ea840595276df0948db541783847fc983f58250042bef85634ce5c7ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647554109, "uuid": "9fa63285-ac82-491f-bfd4-b8664333a315", "comment": "Malware payload", "value": "fe3b85866047d48106858ca2a3a3011b87fb8372", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647554109, "uuid": "1a58e17e-9bc8-4fb7-b654-5f2ef8e5571e", "comment": "Malware payload", "value": "175b01f85aa9f673303c4ce7333b3dd0469887aa806c887abf04598e150c5b128b25c62333d8d9f445e1be9bbb9ee205", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647554109, "uuid": "bbd1b47f-0ede-4623-9060-94ee924b46b2", "value": "T1B1D1A401F3F84B77EEFB063888A7531152B5FB219917EB5E0CC0A18A5C263914A25FA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647554109, "uuid": "2d788fb3-7d30-45b3-9315-be285e743a09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647554109, "uuid": "4c9d7b8b-4f8d-496c-9103-65a49f809d03", "value": "192:3Mr2nlThPArxz5mR4ngKxdm30TqUgcd+:8r2nHAemg6Qxco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647554109, "uuid": "7da7c5b6-e355-4838-8226-c1b450ff17ee", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647554109, "uuid": "6bf591da-41a5-4d2a-bf5e-03f20962b1bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647554109, "uuid": "88bb84fd-03f2-46fd-8005-98875e03b319", "value": "Update_2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52aa335f-a600-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647528085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528085, "uuid": "17a25afa-7e74-46d3-9d25-4f42072dcb3e", "comment": "Malware payload (Heodo)", "value": "1119c9d4fc7a1199746b20b052324027", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528085, "uuid": "6cb9b5b5-a5b6-46a5-80a4-dc401ffa8c5f", "comment": "Malware payload (Heodo)", "value": "d2241057417d7484971bb416c7a3dd1b3d051ac8337ffb7dca59d170f5e52133", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528085, "uuid": "afb999ae-67b3-47c4-961f-b31c5cf2cd60", "comment": "Malware payload (Heodo)", "value": "3ffad641283920077eba3d818e48de25bfc0d9dc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528085, "uuid": "4d298173-dc22-41e3-989a-48704d980dcf", "comment": "Malware payload (Heodo)", "value": "367c96feb6f41671fce810e02329fa50578384e0537cb56a0e7d64716f524e0856560827b254af1620ce748ba3502ae8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528085, "uuid": "adae607a-454f-46a6-b3b7-bdffd374e89d", "value": "T1EEA2BF3FD132981CE67F987C430440F6E70A1D86600765EE2C45F26E66726B6038FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528085, "uuid": "35a0b1c1-13cb-43f1-b07a-192b5a049cae", "value": "384:4HTyVb1GNjyo4CGzPd6ZIwGdKb5CzgObff9kC+xbX7zUSA:suIN+o4FLYCBn9kC+xbLzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647528085, "uuid": "1bc63685-1355-4a57-a89e-587a673e5455", "value": 21444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647528085, "uuid": "7b7d38a1-145d-4b38-9379-6b1a8c4137da", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528085, "uuid": "0ba5339b-fc20-46d1-9f59-f6b7d5c8a3ce", "value": "Rechnungszahlung 2022.17.03_1123.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7fe862-a60c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647533467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533467, "uuid": "3d7a514c-6e53-4ee8-8adb-5057390620ee", "comment": "Malware payload (Mirai)", "value": "cdd43aafab8647d1fad2087775c22ef0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533467, "uuid": "962f245b-fc40-438b-a11b-5c21a22452d6", "comment": "Malware payload (Mirai)", "value": "d3a1e0301daf166dd907cefedfc391740825a2193f29396a22ab26711414e2ea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533467, "uuid": "d5a08287-fba7-4b08-8d7d-efd567459a3e", "comment": "Malware payload (Mirai)", "value": "3131f0384b83ed761998953fb36b8e82ccf9b80b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647533467, "uuid": "b6a694da-9821-496f-9a02-4e71d3a18972", "comment": "Malware payload (Mirai)", "value": "73eb12c45e749204714749cb87633b7ab5a7bc3645ab5bdcf6022e3d064227694a104cfcc6d396df2c9bea29bbb4c57f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533467, "uuid": "27bb2b0e-7359-4292-871e-af1d013441af", "value": "T181630719FF42AB00C4A521BAFE0F02493357C7ECE7FAB316AE246B5456864578F2F425", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533467, "uuid": "cb228e10-001d-4970-a30a-74b332f03a98", "value": "1536:VnnfJpNFpFL4jvmOqdl35ifZ940nUlUAMsNoBiVIZ:9zpFL4jvEQZ94CUlUAMse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647533467, "uuid": "b18bf3aa-657c-4984-a0f5-82ec95a3719c", "value": 70152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647533467, "uuid": "3f522274-89b5-4110-aaa8-4d32b608360d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647533467, "uuid": "16beba90-462b-427c-867f-de60d818ca6d", "value": "arm7-20220317-1611", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44cd2cfb-a64e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647561563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561563, "uuid": "16eb8868-7294-4a7a-ba64-47d20c891dfd", "comment": "Malware payload", "value": "96c4f7ba271cfe17aea96835ac243ba0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561563, "uuid": "8941412d-51d9-42ab-8d3e-ba78e8a637ff", "comment": "Malware payload", "value": "d3acd5a6833ffb2103254d82e28d50e03a0e5d76241bf99e68cbcd230e2cb0b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561563, "uuid": "07249734-cdea-4b8f-b4f1-1a4d5a653f0c", "comment": "Malware payload", "value": "aa409de27c10f193c5f653985f12a64158ef0bee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561563, "uuid": "8ef8996b-ad75-4ee7-b9ec-0d8c7c651458", "comment": "Malware payload", "value": "abe3e9d1dc8467445222b9cb190aeb6c0093214f16b1d544bc2f01a17fca924cb29c6612f94c2bc69ca0055ee5d472f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561563, "uuid": "39527053-6eee-425c-9efe-abcd24c43d3d", "value": "T176059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561563, "uuid": "e7bef1b4-3891-4274-ab7c-8646048ffc0f", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561563, "uuid": "303f4072-8a89-449c-afa3-bf1b97a1f4f1", "value": "12288:V20BXOMcVzpWfmmnDDUX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDYX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647561563, "uuid": "dbbc1b0c-732d-476d-929c-fd791403fbe4", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647561563, "uuid": "abd5329c-2655-4959-b082-e56e969d00cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561563, "uuid": "b972db92-1359-4f37-a17e-fec06db14eaa", "value": "96c4f7ba271cfe17aea96835ac243ba0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ce2a53-a5df-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513890, "uuid": "6096013a-81d8-41a7-b689-01960db1cb2c", "comment": "Malware payload (Heodo)", "value": "b15f78fb4f94f1f1778598262375d918", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513890, "uuid": "10c8cfc5-3b02-4a02-a7df-c34f38c27496", "comment": "Malware payload (Heodo)", "value": "d3c798475fad0a4f0fbeeda8345de7e0b37687c5a686265d40c983a075cdbcd3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513890, "uuid": "0db8e1c0-07f1-4395-8f63-e147aa0d05a7", "comment": "Malware payload (Heodo)", "value": "93924316877c3ac3d655daabf61a0d233b10d4b3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513890, "uuid": "722259ef-23fe-493a-837b-b29dde3f527d", "comment": "Malware payload (Heodo)", "value": "925d047a27c618da6d17d2b8bb4dcb45332e6b67e2f4949e1feb70da9a69eaea084b3bb2fdd658a896fe63c1b7a6f8a9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513890, "uuid": "7bd0dae1-18f8-4fb4-ba91-0d671ad024b7", "value": "T153A2BF3FD132981CE67F987C430440F6E70A1D86600765EE2C45F26E66726B6038FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513890, "uuid": "24813a57-bbd8-4ecb-9fd0-200fb8797838", "value": "384:IHTyVb1GNjyo4CGzPd6ZIwGdKb5CzgObff9kC+xbX7zUSA:8uIN+o4FLYCBn9kC+xbLzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513890, "uuid": "e3273f3a-7639-4bec-a2b4-a7d728adf50d", "value": 21444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513890, "uuid": "062ce4e7-2059-4323-ba4d-a0457e064fde", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513890, "uuid": "a1ed3946-4434-4f07-b18e-22dabbdf7e02", "value": "Rechnungs-Details 2022.17.03_1014.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c6b032-a587-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647476036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647476036, "uuid": "62a792cd-ec7b-47e1-b881-4be822354ddb", "comment": "Malware payload", "value": "772a1677335cb5cca55eba68227ea707", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647476036, "uuid": "846ea010-a153-4659-863c-89b460064ea4", "comment": "Malware payload", "value": "d4008efa1f1508269b6893673c92d3fe21ff16932ba96b0aa848ca8170f1bd66", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647476036, "uuid": "f72b65e1-7ffa-43ed-8272-c13305d9df27", "comment": "Malware payload", "value": "628b822e86ff579b1d5f01a02bc5a92458027d48", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647476036, "uuid": "09d0432f-4013-4d25-a2fe-7e52050ba2b4", "comment": "Malware payload", "value": "0a14057c45e0ddfcbbfe41c2b5acb265ea2ff416957498a3a602f7e68b0f7ef2db8cbed500488127ffb8d96ce4afb317", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647476036, "uuid": "c1534566-fd1e-43fc-8406-103635febb30", "value": "T15564AE62B5E5807AC2F321B14A46626FB3F5EB00473A6FC35BD10C586B39593D33879A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647476036, "uuid": "fdd1d26c-bdc3-4434-97df-f4ad7132eecb", "value": "6144:WZ7T8DsyVvuJb8fTSeOPwSyeuRJ0tvZVKudKV9M/9KnAuMW4w:WZjb8BOPxue5dKV9M/98f5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647476036, "uuid": "a4cb6d4e-5cb1-4ec3-9f5b-5c1eddd0c5c7", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647476036, "uuid": "d79ee234-a8e5-41fd-b9ab-02ca83080414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647476036, "uuid": "d585d86d-90a5-4747-9f06-ba0cecccbe4b", "value": "emotet_exe_e4_d4008efa1f1508269b6893673c92d3fe21ff16932ba96b0aa848ca8170f1bd66_2022-03-17__001350.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86ab42b-a594-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647481844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647481844, "uuid": "a29aabac-aa7f-477f-9f31-c3efbed2ed83", "comment": "Malware payload (Heodo)", "value": "eed2932090b282b679ece4691df66556", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647481844, "uuid": "660b9370-25e6-4ba9-a9f6-5556d0280c08", "comment": "Malware payload (Heodo)", "value": "d424cf401c8f97f1bca90a05b4f4344775c8f83de1e56187e28724165eea8f85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647481844, "uuid": "481cb852-0e13-407e-8061-e3a8bbae63b5", "comment": "Malware payload (Heodo)", "value": "baecbb9185da95972cf5ef4a04370b59d754c137", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647481844, "uuid": "d50b9251-af2c-4fe4-ac6d-0e9322ed8d22", "comment": "Malware payload (Heodo)", "value": "9e1e3ca5bd54261f093dcc6ac62fbd652b5e811fbaf3468fa46a22af99ef9580dae91a93ad5ffd4b620abf7b62ad7851", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647481844, "uuid": "a996aea1-8fed-4bad-9289-4021d3ae43ce", "value": "T137E45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339977A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647481844, "uuid": "b1f6449c-b243-47f7-8931-a737a5ed0e84", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647481844, "uuid": "5743fda4-8671-4cf2-9319-93b0cb3e251f", "value": "12288:jc899XKPmN4WMkou6ZPJSFTdtXlcIL9v6O8:7GP7tgFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647481844, "uuid": "3236a530-01a3-4f6e-b6b6-38df82b501e2", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647481844, "uuid": "39460585-025a-4844-8d77-6d5677bc436e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647481844, "uuid": "7dc2131a-6cd0-4d47-b4a7-d1aff9adf824", "value": "eed2932090b282b679ece4691df66556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9692c6c-a614-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647536848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536848, "uuid": "01ca65e0-fe0f-4acf-a5f8-3dd11e3b3206", "comment": "Malware payload (RedLineStealer)", "value": "95c1f8263d7051bd02c3abf434d2daee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536848, "uuid": "32216b83-d69d-42c3-b2dc-de6faeb7cb8e", "comment": "Malware payload (RedLineStealer)", "value": "d4eadcf6c9d8f710a62a0a0c57869a66936dc42a6c35bdad71f542756936c2cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536848, "uuid": "cd33efca-f60f-4322-a12e-ec3ef3aec348", "comment": "Malware payload (RedLineStealer)", "value": "2db3605f475efbb8bdfa77ff6b28a60eb3a45c8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536848, "uuid": "29977dde-7606-45b7-aa46-254ade641d20", "comment": "Malware payload (RedLineStealer)", "value": "9503f1bc6065850458d6a437e063c01c8a7e1f42b68955542c7f2539ffbfde1db46cb0ec2c9094aef5e1dd89ebf06906", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536848, "uuid": "1f7b0350-f3a1-448c-9a13-9d6bdcd3ff3a", "value": "T182A35D69B3DD4628E5FE4F70A9B1515143F0E1A26C03E7DF4EC4E0D91A66B80DB22BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536848, "uuid": "cad093b3-9a71-4033-a326-104af1290fe5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536848, "uuid": "e01a41f6-9e3e-48fb-b655-e7424895a097", "value": "1536:Z0DWkCr/G2IxbAlcZy6R6LVfclKslIQI+0g26zPbuTxkrsHybnLv:ZGCr/GvW0whclmh0vwHyTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647536848, "uuid": "7afbf50b-397a-444d-89c2-5613b230c24c", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647536848, "uuid": "9acff9fb-f9a9-413f-ba73-57f59b819093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536848, "uuid": "ba76bdc9-c30c-485d-8f7d-47f931c6b37b", "value": "69750850.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb79c917-a5a6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647489607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647489607, "uuid": "762db405-e6a2-42ec-8ea4-269de4d08dca", "comment": "Malware payload (Mirai)", "value": "642fca26486a8b47446a6f3f1e0268bb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647489607, "uuid": "5b11a7f3-1ccc-4d43-a53d-cb3f72d2f42b", "comment": "Malware payload (Mirai)", "value": "d4fde88d6ef2c313f4360e8df9312760fb72438d9a60ab6b9bc87e69aaf974c3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647489607, "uuid": "d51a9f1d-7b0c-41b4-8658-9b3fefb14c1e", "comment": "Malware payload (Mirai)", "value": "7b59c14d868e3c8fe65a0a3c6ae09f5d9548663a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647489607, "uuid": "ee7e5127-c271-4000-b640-2c5fe59288fa", "comment": "Malware payload (Mirai)", "value": "604c76a49c2770a6e2f570b15b3db610915880b0694baaa0dd94e3a6333b100fd135cdccf6692cc8b0b37a2630b679a7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647489607, "uuid": "3a7f0fee-93ee-49cd-aa9f-346a52f8da8d", "value": "T10323F12370EF68F0E961FA3959BE58C4D215ABF803F93B9501904369E2C71DF684A783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647489607, "uuid": "323da02a-6700-4ad5-9474-f4b2c6437a91", "value": "768:YCkau+Tivn1SHCpYbZuAZCIAbR7ac9/uvtgybsAECA6dO9DZ9q3UELqGxs0bC1WC:hTi/zEEUCIAbR7l9/uvtgy3DZdUYLun1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647489607, "uuid": "b147c01d-3056-41f2-972b-e24d081c3ec3", "value": 47836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647489607, "uuid": "29e55e2e-7ece-4e8d-9885-7daf3078220e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647489607, "uuid": "acfd482a-2358-4326-a2b2-f163473aec6e", "value": "Rakitin.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b892ccc-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647518651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518651, "uuid": "e9729820-ef47-4705-b523-74c2060f9f53", "comment": "Malware payload (Heodo)", "value": "c195bcc22ac91619a141b512dc910868", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518651, "uuid": "9854ba5e-64ce-494b-a85b-801ed6b0d2f3", "comment": "Malware payload (Heodo)", "value": "d58435acbee226578b1197f72d399c6354ade07a6933519f440a73227df7424d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518651, "uuid": "9d693ff9-185e-451f-87d9-9325f06e2b99", "comment": "Malware payload (Heodo)", "value": "423cce1552d20b781a3c75a50b347adad2ff772b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518651, "uuid": "975354d1-668d-40c1-a166-62944a8ba54b", "comment": "Malware payload (Heodo)", "value": "6d4c568726b5ddd2d0a098ecca36bc0beac25ee3a81946afbe61a4a81742ef89e9c9d8ab1eda0126c14769d88bf94214", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518651, "uuid": "0da7c06d-fbbc-4501-90ab-3000645fc790", "value": "T153A2BF3FD132981CE67F987C430440F6E70A1D86600765EE2C45F26E66726B6038FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518651, "uuid": "030d4258-b61a-4627-9114-ca84da03e779", "value": "384:kHTyVb1GNjyo4CGzPd6ZIwGdKb5CzgObff9kC+xbX7zUSA:QuIN+o4FLYCBn9kC+xbLzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518651, "uuid": "d1f91c63-90e4-42b8-871f-d524e7a1e777", "value": 21444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518651, "uuid": "af41dcb3-3c14-4a75-81c5-7f7964ca3aa6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518651, "uuid": "041452ca-6054-44d7-bdd1-bfa3fbeaaa2e", "value": "Angebot-LVA-540187039.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad8819b-a5eb-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647519026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519026, "uuid": "f4c5497d-40e3-4a93-a905-4418ec0c19f8", "comment": "Malware payload (Formbook)", "value": "c9808367c365097eef55f60c311f6672", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519026, "uuid": "e7a1a448-66ad-43f8-a89d-1f1212ba8e81", "comment": "Malware payload (Formbook)", "value": "d674ad918b0c38a26ec796220f99d14147297ddc01dd8e09c9b9b0dec8998cf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519026, "uuid": "ae10d2d0-b8ca-4929-8395-b3104cc2ed19", "comment": "Malware payload (Formbook)", "value": "cc90860db94105af836fb85ac7633715d0bb2a22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519026, "uuid": "8daf9418-3419-43b6-8434-d193debb24b0", "comment": "Malware payload (Formbook)", "value": "11217c9aa3586e9ff1acc6871d2331af31c1622cb0cf8d805ed3f3bd83a0e4e9e480c4777b38b1e15e1f4faeb12efaae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519026, "uuid": "bf5b8771-9ca8-48c7-9452-e9fd99af29fd", "value": "T1E335125E2B748622F57F47F4902305E487B47605A00AE3DEEE8270D81D237DA8E6F5A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519026, "uuid": "3f3f07e0-cc6c-4499-bbf3-be5686accb20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519026, "uuid": "3def5d5d-5e0d-445f-a3fa-3eff3ab864be", "value": "24576:O3D9rlz7M3iYZqoVTQmYjudPpqbx1iA5JDRTM1HmQ8j:O3JrFA3ibju50l1iAbDC1Hm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647519026, "uuid": "23c42e28-5b31-47e0-8eb4-9e6da74b2e3d", "value": 1119232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647519026, "uuid": "8c5fb06f-b499-40a2-9e05-9b73af30baaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519026, "uuid": "011920e3-7a28-4409-a8e9-a185de6d0152", "value": "BreJAE3rdav9rNH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd534ab5-a5e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647518493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518493, "uuid": "d88341ff-3e76-4f9b-bc54-f621d5dad7f0", "comment": "Malware payload (Heodo)", "value": "ef4da6bcee05e16a78f67e5c1552e63c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518493, "uuid": "092d317e-65ab-4143-95f8-6ba7447a35bf", "comment": "Malware payload (Heodo)", "value": "d6a13c45738af7d2ceb0001327049eabfb61d5f90a13cb218b2ed54641dc8600", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518493, "uuid": "00f93ae1-d557-4621-9cf0-1e3d2a0d0936", "comment": "Malware payload (Heodo)", "value": "9f6419bad2e9e1fed50ab0227a001489e5a1a5d9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518493, "uuid": "fa32046b-db3b-4c49-813a-53e6561858ad", "comment": "Malware payload (Heodo)", "value": "e4f35cf05d37cdbd4920284279721364ffd3cb821246debcb8f881a3fe49beec700eccb15f88e5864100699c0cbde65a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518493, "uuid": "de50cf3f-f2dc-47df-90dd-365041990db4", "value": "T1D715BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518493, "uuid": "e03e7061-6ad2-427d-aef3-65d211cd9214", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518493, "uuid": "a634e644-acb5-45d2-9482-20034d88867f", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518493, "uuid": "e59bd264-8ba6-494b-a76a-24edb66378d8", "value": 954608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518493, "uuid": "bd1c1259-e589-44b2-ae9b-8b61ad1a9a0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518493, "uuid": "ea4a15d3-860d-44ee-9c7f-f4f51c5ddd4a", "value": "d6a13c45738af7d2ceb0001327049eabfb61d5f90a13cb218b2ed54641dc8600", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86e4baf-a5e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647518485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518485, "uuid": "e82c4a6f-0d1c-4d7c-9006-cdcd050eb8ea", "comment": "Malware payload (Heodo)", "value": "fcffff374192cee185d85d068f4d5952", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518485, "uuid": "ee7ea733-21b5-444d-b614-d9ded292d35e", "comment": "Malware payload (Heodo)", "value": "d7a6796c3f0fccf0566c5c604f1c980fe8a17e2a0d762b9e2d70b28a9f2fbd4a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518485, "uuid": "bb5d6c81-08ce-4d00-ad08-776c9460088c", "comment": "Malware payload (Heodo)", "value": "7b51508f246641440b3831a40d941811ad95d1cb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518485, "uuid": "daddd9b1-a7d3-4444-a43e-0c090c6216bb", "comment": "Malware payload (Heodo)", "value": "3e57e03c2ce5e349adc754093510b0049e22c7dd40559bf23ded9fd3b132474af4b320571c1805d32b5d15d0587f254f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518485, "uuid": "7f80603a-491b-4f70-a390-65411327abe6", "value": "T1D015BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518485, "uuid": "8ad0f1bd-44ed-4cea-a66e-07a90f11c52e", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518485, "uuid": "8f195857-ec6f-4050-880b-4559587f8b91", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518485, "uuid": "f2a0a4ed-7ad2-4dd2-80a4-9bc252faeee0", "value": 958829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518485, "uuid": "011ebc04-dd05-4db5-8906-4978231b755f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518485, "uuid": "2aa261b6-3998-4f23-8d00-06295f5eeb19", "value": "d7a6796c3f0fccf0566c5c604f1c980fe8a17e2a0d762b9e2d70b28a9f2fbd4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578e33b0-a5d8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647510914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510914, "uuid": "19acf9a1-358b-4559-a5b8-74dfd1e7ddfe", "comment": "Malware payload (Formbook)", "value": "784396a4670881b864662a1b30f3875d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510914, "uuid": "ae6994bc-2ddc-4c96-b7e0-c5451a205154", "comment": "Malware payload (Formbook)", "value": "d89f28603b8948dd7217e42366328a6e9bd05d59e5de67a4c39f207f8a520d43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510914, "uuid": "11cd17f5-643b-4972-85fa-1aa64c4d7e5b", "comment": "Malware payload (Formbook)", "value": "c558912539ec6c112aae32f65adc305df8c22718", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510914, "uuid": "02153b57-5511-4867-a721-d2d0a969ede4", "comment": "Malware payload (Formbook)", "value": "908d2508690b457496a509f8ffc22553c889e0435b877d85151564ac324d4824ed32845387681f26327490cb6e01a651", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510914, "uuid": "958e28fb-31a0-4abe-8844-9adb89e1e7b8", "value": "T1F135222D3B704657E1AF5BF6A06314804BF4724A2403D79FEE8271E91E537C88A2F697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510914, "uuid": "b738ac36-d7df-4a74-8528-152fa4a556a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510914, "uuid": "3e542bbc-ac81-43f3-a85d-3ed8ee09795e", "value": "24576:S3W9yQOT4hCxXRC8awzuX2kHD+xdZ3LVziKOni:S3yyh4IxXRC8awzBkHD+xDMKOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647510914, "uuid": "2479463e-99d2-46c6-8dd3-6d79998dfe9b", "value": 1146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647510914, "uuid": "6bbd18f9-0e6e-4a33-bca7-6d82fc7e8969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510914, "uuid": "546dff50-0b79-4366-98b2-b82541e06cda", "value": "INVOICE31722.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f24eed0-a619-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647538817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538817, "uuid": "5093be12-fdfe-4276-9edc-81c37231a414", "comment": "Malware payload (Heodo)", "value": "1dee3c5f6e91e2b0628a61e6f4395052", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538817, "uuid": "41475c6b-9faf-4feb-b38e-6487c055cc31", "comment": "Malware payload (Heodo)", "value": "d8f1c74a539880e67ca1254f385ac234359648f832f48b7d088dc29fc568d5e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538817, "uuid": "9f74e2db-3fac-4e37-add0-2383e5a52a57", "comment": "Malware payload (Heodo)", "value": "8f00abcf4daf2bacd60afeefb80d7c41404f8c18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538817, "uuid": "c273b9b0-e617-4860-8350-bb1d30dade05", "comment": "Malware payload (Heodo)", "value": "1fc330463beec16479061bd32378034b0fade894a1a8a4572aad9bc6b9f3467859fd77d9068ca197a45483379724aa6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538817, "uuid": "17fd54da-c3c4-453e-839e-8af3b5dc7acd", "value": "T101058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538817, "uuid": "bb741d5a-6030-43c1-b8cf-de9e9fc40b2b", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538817, "uuid": "b12dfe3c-7bc4-4534-9f64-4efeee8c7e84", "value": "12288:Wvz1CLJyyvmMLSrBgb4ruGbPlVpqb+DlYzv:WJCLJyybLqBq4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647538817, "uuid": "332a00a3-8465-42bf-9071-11a7ed8887f9", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647538817, "uuid": "5874a1ad-fc63-450e-b5e7-e7cf9bf719f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538817, "uuid": "5798fa1b-d6da-4e0a-9f99-9eebafda1b5e", "value": "1dee3c5f6e91e2b0628a61e6f4395052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dfcc2c3-a601-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647528561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528561, "uuid": "4670bf21-ca80-4823-9801-48b9b924463b", "comment": "Malware payload (Formbook)", "value": "cdf55ed6d4b6226f656ccbd5ac6f6a36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528561, "uuid": "37b02786-0f3f-489e-8a70-d9f21fc4e9a7", "comment": "Malware payload (Formbook)", "value": "da30dd86e912cbfcf0cb4306265cedf47604891dc868db7c59dd92d47ad32063", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528561, "uuid": "742a6568-166f-4cf5-8d7c-b25022992598", "comment": "Malware payload (Formbook)", "value": "ab366dd1e83767d123ca9dd16641aefd8a81297d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528561, "uuid": "1013bfeb-c26a-42f6-8e7d-b305d9b74fec", "comment": "Malware payload (Formbook)", "value": "b7c3512fc8dcfae16fda95a968cbb6a8125902e7f1c05cfa2d42f0699d47796331e319130a89604f8fdc6f0cf29de98c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528561, "uuid": "22742762-34d8-4c4c-9d8f-e4307140321a", "value": "T1C3C49C3F19686373CA7BD7758651142AF691C1EB7902AD18EED31B800D231CA7FC662E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528561, "uuid": "983ee4b8-0875-4938-8c6d-da772f6d40bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528561, "uuid": "427a1ec9-cce1-481a-95b0-b63be5cbeca2", "value": "6144:nLxWy/E+/IV/bcEHs6bJBtCUYCt5UzXKneVVl31dpbCb2vqbi+d9dkfwmdLF6z:LkycgEM6ftxmzaQj33Mb2CbnTVcAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647528561, "uuid": "bd0880a1-b3ef-4753-ae26-742ed6d0d403", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647528561, "uuid": "cdcd0f31-f142-449c-8412-bb544d66fb81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528561, "uuid": "d8eb3154-c246-48f7-b146-bbfc867a39b0", "value": "YfBbaU7UiZbHjbn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6cfdccd-a5f5-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1647523583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523583, "uuid": "0c694bd4-77d2-4a0d-ba61-31ef219156ec", "comment": "Malware payload (BitRAT)", "value": "f52e56a246eed27f5aadb3260af1c340", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523583, "uuid": "1753887b-5a50-40a4-8215-965fcf8f1272", "comment": "Malware payload (BitRAT)", "value": "dae84e7d788ebacc7079cc34a271010ec37e05eef3a679a8732b736e94eb3057", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523583, "uuid": "2bf24435-aaa0-4e04-89b4-1f6fe30e5bc6", "comment": "Malware payload (BitRAT)", "value": "f9fe092c18f17c432023c741472a7c9f36e55e41", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523583, "uuid": "9d269233-1977-4d6a-9d1c-3026f10a70bb", "comment": "Malware payload (BitRAT)", "value": "0ddce003bda23b2b68f0718bd89fe88b48ecac8395061c576d2644f7d00f815d72da4de575fbea9378dea12d4e2c51a5", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523583, "uuid": "5a929e03-532b-4923-aef4-18734aec3203", "value": "T16306CF02FA46C562D2170230E96E77BE053CF9354B2085C3B3946E6859B66D17A3BF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523583, "uuid": "71df68b2-7ada-4553-a4d9-2b0661a72b43", "value": "71955ccbbcbb24efa9f89785e7cce225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523583, "uuid": "46808518-d7be-4451-b95e-c27c796866e3", "value": "98304:877Pmq33rE/JDLPWZADUGer7B6iY74M/YmlwXVZaFB:K+R/eZADUXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647523583, "uuid": "d3a706c7-65db-47c5-bb83-4aec1106793e", "value": 3943424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647523583, "uuid": "afba872e-3564-478c-929c-2dd0fc2ceeb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523583, "uuid": "748d355a-0af6-42e5-b368-59057dad1325", "value": "d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e0f55b-a5bb-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1647498674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498674, "uuid": "96f5d769-ea1c-4a19-bec9-b2a7c9a26607", "comment": "Malware payload (GuLoader)", "value": "182ca83b3e4a9e0ba74ca2de5d961003", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498674, "uuid": "edf8b9da-19a7-45e7-8100-6fa36ade59dc", "comment": "Malware payload (GuLoader)", "value": "db56a39c633c2a3ed93fb4def625ac2211c4f073b2e800d03d84b53494c3b8b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498674, "uuid": "6b28ab90-92b6-4220-b596-86983a0b17ce", "comment": "Malware payload (GuLoader)", "value": "2454469bcd033d01a36d7fe014ce7b58e8a328dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498674, "uuid": "7b06a333-5b4f-4380-8a52-d868950dd47a", "comment": "Malware payload (GuLoader)", "value": "c67bd76032732b0cf9c0b761209eee9b45a062918dd39f975860a4c64bec0a58b8aefa3254d9e892b9abb2f4f569113a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498674, "uuid": "83101a9d-e5d4-4e3e-a04d-e8bacd9dd588", "value": "T177B402B1F29480D6E85203742877DE260E76AD7BF471AA0E22873B6C6DB3393551F607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498674, "uuid": "de4fdb6c-7d3c-49e7-aa32-ff559ad941f9", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498674, "uuid": "579865f0-229d-473b-8d57-c2bc1ed19c2a", "value": "12288:UbjjKx3iUpd3eqDtrIhtS9dAebzzXcDkgL:UbjjKxXp/DtMhtS9dAozzXcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647498674, "uuid": "4546727d-101c-4c3b-9aef-d57b24e1e204", "value": 505136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647498674, "uuid": "455a53e1-ef1a-4460-ac95-c3e3f905c241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498674, "uuid": "dd3937e2-9970-4d05-993e-7ad0e12ce6ca", "value": "Remittancescan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc042bf-a5bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647498657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498657, "uuid": "6fe3afc7-9afe-4e0d-bc44-5e30ed9489b1", "comment": "Malware payload (RedLineStealer)", "value": "cbf937f2765f81fc3d24d433edc434ef", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498657, "uuid": "db74eeb3-0d9a-4c80-a8ea-c8be96d448b0", "comment": "Malware payload (RedLineStealer)", "value": "db66fc3c896813280ef60ba06dd03d7a7ba5b554ae4f18472168e868a4a6ccb3", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498657, "uuid": "e2cd29bf-12db-4b9b-8f2a-78d3f84d142a", "comment": "Malware payload (RedLineStealer)", "value": "1709b65696a5c73a0f4acbac2c2e16be05bbfc54", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498657, "uuid": "28d0acd3-4257-43a5-85e9-e18cacc1a616", "comment": "Malware payload (RedLineStealer)", "value": "44be10152d7b7998be582be0c58d091ab5741901553d3657734a66bed5fe8fc4d839f4c11e1090546f668ee887163e80", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498657, "uuid": "4a4175b1-9ef7-40ce-ab25-1217968cdd22", "value": "T19913F265BDF19E44076BD593F48062DF814ADCAE6EB8303D92C9B152494CAB47C1FA1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498657, "uuid": "74b8de60-1657-48a6-8c0b-c182d15a251a", "value": "768:yH75lLfSG3uLLE87jt6aCmuwkHLuTRzNOfhwOdrurdXXFjsca6wuQ8oTRO8kwIbU:yH75BSG3Iomjt7Cmjlh+wRCEwuW08fcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647498657, "uuid": "12811c9b-accb-4b30-b305-07c4ddbd2ca1", "value": 44340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647498657, "uuid": "85e94517-518d-4887-b7f7-57349db8c461", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498657, "uuid": "f35cbeb4-a549-42b4-9150-5897d26865e6", "value": "89633589.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0376963b-a62e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647547709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547709, "uuid": "ab8183c0-0157-40d2-a696-4d35930292e9", "comment": "Malware payload (Heodo)", "value": "d9dd11dd36f0fb0fb36ed817f984d99c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547709, "uuid": "4bf5cd05-3fec-4328-9ba6-aee1427c4efe", "comment": "Malware payload (Heodo)", "value": "db70f1fe40d999fa3535eca4f9aeba6027b8e51736983a9b349533088a1e273c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547709, "uuid": "5d49d8b1-aa22-4183-8bf1-d383b30d1b43", "comment": "Malware payload (Heodo)", "value": "41900699ea80400d84db3d2322cf4c1bbd72b8bd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647547709, "uuid": "607b84f8-ff60-4719-82a0-4d9f5ce64c53", "comment": "Malware payload (Heodo)", "value": "f6a4a6a0e8197b45c6fcde45b9638f4dc7bf56c565cc79f2303d7ec164074264154a76c7bba06c525bb97bc463c4f143", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547709, "uuid": "1869ebc0-41cd-47b9-900d-4408270b53bf", "value": "T12EA2AF3ED221E818D67B987C830580F6E70B2C561007A9ED2D51F25D66726F7138FABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547709, "uuid": "ac1ee163-53c1-4063-8025-f2437efbc4c1", "value": "384:iQZAVb1GNjJITo4CGzPd6ZIwVKb5CzgObff9kC+xbX7zL0crX:iTINqTo4FL3CBn9kC+xbLHjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647547709, "uuid": "35a10d5c-857a-4ead-965e-5df7b0286c07", "value": 21461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647547709, "uuid": "3ddc08b5-706c-496e-819b-842f8f479ae5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647547709, "uuid": "109822c7-3f55-4344-bba4-1a83b2335c10", "value": "Change of Address.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525a3228-a5cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647507040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507040, "uuid": "4ff2cb32-2187-4535-8df3-07cfe44b9e88", "comment": "Malware payload (Heodo)", "value": "9df8eca1ea5deae9d4d4da4e1652e82e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507040, "uuid": "6c107ed5-c1a9-41f4-8085-addba4568831", "comment": "Malware payload (Heodo)", "value": "dc1753b4f31d72e02114796c544c985869a0ad7604369516642efad22a0804db", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507040, "uuid": "363100db-09fd-40d3-966a-e223663b135b", "comment": "Malware payload (Heodo)", "value": "0b2f97f1b592feb1d092e924a54f6e6e24fef25e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507040, "uuid": "8dd28a4d-6258-4635-aeb7-1e0dd3b03afe", "comment": "Malware payload (Heodo)", "value": "4b8a9a818d6cea060e418ce82eb73f7d0ec6c2e037061b21fe4a3e77c2dae48db8dbeb34dd831a2089bd1d743e20831d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507040, "uuid": "a2e3b80d-8109-4dc8-aeaf-555474c14310", "value": "T12BA29E2CE921744DE3BB683C420650FA924A1C022147B5ED3991F77D6B73697068FEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507040, "uuid": "9c58a17e-9583-4308-8de4-f170fa8b6f73", "value": "384:H3uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:bsNs/zXtFCBn9kC+xbL42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647507040, "uuid": "fa321029-b88c-4e44-af07-17e0d651f0a2", "value": 21657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647507040, "uuid": "62c67f27-e633-44a3-a348-ae1a8f867768", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507040, "uuid": "8112dfc2-d137-43dc-9d1a-fd2c96f84a3d", "value": "Payment Report - 2022-03-16_1950.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4aeac91-a5e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647515768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515768, "uuid": "2e9d53a8-c923-4e70-bdf1-6075db28bc3c", "comment": "Malware payload (Heodo)", "value": "b9b8228da3467af825cac0e39f23657b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515768, "uuid": "6b6bad6c-4e63-44a2-84fc-ad90d22af6d1", "comment": "Malware payload (Heodo)", "value": "dc208ad78e603846886cc36afd030bc5561e9a39fa9142aa4ea366a08bc166c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515768, "uuid": "781c4f07-9b14-41d1-ae43-f49acd1f15eb", "comment": "Malware payload (Heodo)", "value": "1df5f3225dacee7df0ff5dd06af37747c818e603", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515768, "uuid": "f0744ecc-91a9-4721-a6ba-c36ab1122fc1", "comment": "Malware payload (Heodo)", "value": "7a2926e878bf43bd46556f7455e2152f7667d0a7cda583610ff691cb283cb7fab68bc536960cadf589bb4c40da9db0f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515768, "uuid": "38671bb2-3ff0-4003-a6d3-deab1e27dbf0", "value": "T1C1058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515768, "uuid": "eca7d604-ef8a-425a-9528-02d0735a6169", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515768, "uuid": "a54fea91-e562-4f0b-8228-aff4d6ea7484", "value": "12288:Wvz1CLJyyvmMLSrBgT4ruGbPlVpqb+DlYzv:WJCLJyybLqB+4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515768, "uuid": "e2f08eb3-09d3-4390-ac05-4024e238401b", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515768, "uuid": "d9ac28e3-3c45-4270-9e16-ff3fc3164637", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515768, "uuid": "f603661c-6fb2-4e24-bc30-378552d03e5f", "value": "b9b8228da3467af825cac0e39f23657b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b9aeaa-a5df-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647513860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513860, "uuid": "8cbfc8ab-dd27-49d4-b0ed-0402f93fc7fd", "comment": "Malware payload (RemcosRAT)", "value": "4cfaf2bef55e8ea1a50afb1d95b67983", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513860, "uuid": "cfcc596a-0787-41f8-8f1a-cae91254c0c7", "comment": "Malware payload (RemcosRAT)", "value": "dc49e679a8f14b6c628039f81d56f9ceda64f57c571116d06a1898502e8bf46e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513860, "uuid": "b2e9c0fb-3997-4cb0-905f-a98e6756fcf0", "comment": "Malware payload (RemcosRAT)", "value": "0ba925a750a6e4501ddaebfbb45bebedeebc58ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513860, "uuid": "39a3c04b-9f29-4184-adb0-c0f3f2e3ec9b", "comment": "Malware payload (RemcosRAT)", "value": "dfcc3cbc12ac69097c7df1a454231a8e961ec2bf1cab69f34b3393f7cf98dda280e3ef2889d3f7444cd0a9e2fafea8a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513860, "uuid": "344f81b5-a532-4d1b-9b3d-dc88c67af32b", "value": "T1D3355BF2E2508832D02236788C5F4EB9B82A7E00DDE5A547AAE53F493F3D571EC11A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513860, "uuid": "349cc823-60f7-4ee4-8979-41be505a16e6", "value": "066f2adf6884c84166ea572f3442e2f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513860, "uuid": "2f3b63de-e99d-474e-b53a-eee76173ac6b", "value": "12288:RbojJKNbgMwT2NRAvS/yqenMbJjRsBp8oziAO8Iz2sVW3MiqI6F3HAhcAszeVQ18:elKiCRAvS6qOMZGBNgzsqTHAhU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513860, "uuid": "775c8779-aa85-42c0-8d11-de4a01dda539", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513860, "uuid": "3b1df89c-b2a8-41be-a52a-0837aa6d5cd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513860, "uuid": "03fb5353-7f8d-4b4f-8487-ea92d99e9b9b", "value": "KGA20-AC-B6 RFQ Simay No.6315-22 6313.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b58de5-a5dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513300, "uuid": "952e7b04-7b0d-4275-8b4b-5f656011b845", "comment": "Malware payload (Heodo)", "value": "f38d60a08d23713c90012f03f7f68925", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513300, "uuid": "aeff07b2-c885-4836-a896-4bf2a04381a7", "comment": "Malware payload (Heodo)", "value": "dc697519e9d20715bba36df0b54a6f2dd51ffca197952bb2c22744dc3467d82a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513300, "uuid": "aeceb79c-a913-4940-8cb0-d327813e73bb", "comment": "Malware payload (Heodo)", "value": "c400e20dd85a2e6bad5818e168c937db8021e1e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513300, "uuid": "8c3b65dd-b56b-433e-8c8c-0c05253133ee", "comment": "Malware payload (Heodo)", "value": "67548136ebef54b0549e4d62ab88c4ff827e7241e10a689eacff3478136b959387c403706251b53a864796e5e63edf6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513300, "uuid": "e667bb7a-b38f-471b-936b-703fc8df2a92", "value": "T1EFF4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513300, "uuid": "741abee8-7f8f-4b72-b994-92042960eb6c", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513300, "uuid": "75ee18de-1e6e-46f3-a980-b0cb3377458e", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7ha8rLneTfABCJoWRWwfpW:BeCCF88j+Xn8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513300, "uuid": "08c00e7b-eb21-422a-bad1-2e5643005f4c", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513300, "uuid": "99d4f9fd-2894-454b-bd6b-7d3d40234548", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513300, "uuid": "327d7200-bf4d-4674-bd9f-5eae75dc3eda", "value": "f38d60a08d23713c90012f03f7f68925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a387ed-a611-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647535586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535586, "uuid": "2c85e1ad-9245-4a5d-9b7f-5917af990c6f", "comment": "Malware payload (Heodo)", "value": "735ef70462447e90f7412aba5c357243", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535586, "uuid": "82d9e13b-7ec2-4e7d-a213-2a5b4c1379d3", "comment": "Malware payload (Heodo)", "value": "dc9fb940d9c26374d53e1d2e109511325bfb352ed44a66ad38b12bd7898ffc58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535586, "uuid": "5e777c7e-b98d-4fd3-928a-37235499f1fe", "comment": "Malware payload (Heodo)", "value": "174cfb8678dc837733df6609c532ded94ae2c323", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647535586, "uuid": "0014aabe-15f8-43c2-a669-ffde3ebf2615", "comment": "Malware payload (Heodo)", "value": "e0043ad8ec274333002612da687886ef96fc37be7fd9c28f08ab6e30914da10e3fdd8c3f62a038eb201170ac07662188", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535586, "uuid": "3f32b888-4a98-409c-9a1e-24c04c877c3b", "value": "T114059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535586, "uuid": "c528d5ed-d8fc-41ee-95f5-2e9e5553d5b2", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535586, "uuid": "f6d518b8-de43-40bc-81ca-5308c1ee7726", "value": "12288:KVHML2QJe6XxhqCWBQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhq5QHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647535586, "uuid": "694c4a41-c86e-490d-8340-1fda98750d9b", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647535586, "uuid": "c2c88cba-42a9-47c3-b306-5eda6cadf814", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647535586, "uuid": "a7689ba2-633c-4457-838c-058da159e0cf", "value": "735ef70462447e90f7412aba5c357243", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11baef45-a601-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647528406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528406, "uuid": "ef53b55f-8da3-4929-8d80-3eb65b0af989", "comment": "Malware payload", "value": "94f6bc89fa152c3625b04c7704876525", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528406, "uuid": "4944c933-48b7-49c8-8b4d-f3495c49c0fe", "comment": "Malware payload", "value": "dcad37f585b0a4b6105f01a7bacaa4640dd170c86fb1798e57458c88873c9fc3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528406, "uuid": "d70b6165-ea9c-411e-8d15-f73d650f22a8", "comment": "Malware payload", "value": "c95e837fe21da1e2d667390b696bf65c1ca57c9d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647528406, "uuid": "e9902638-1693-4b85-8246-9775e10901ff", "comment": "Malware payload", "value": "9eb000e66a6332b18d248e74b20667829df3febed6ff1ad5247de4cb47c2350b020f328cc2f6aab53f70d42a36aa2d8b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528406, "uuid": "0a77420b-2ff0-4c92-8dac-9bb5bc3f0fdc", "value": "T1C7F50187E785A46FC1F792364637466A16078C668B83D3975B58F23C0DBB6C04E86FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528406, "uuid": "e30cc336-3ff8-4822-bd90-ad69a3ec4847", "value": "98304:R/VUGzdu/Mx+1gcRQ1rSUNhpzmjUx4+6pv82mVFJ:BVUGz8VPQ1BhV6mJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647528406, "uuid": "0dc0accd-c2c2-45ea-a137-0b827535de25", "value": 3521812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647528406, "uuid": "7043d2cf-ba97-47ed-89ad-ce14354ac36c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647528406, "uuid": "59f1457a-6ddd-4191-ae97-04636609073c", "value": "sicurezza.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0ccfae-a626-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647544318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544318, "uuid": "784b0c50-fed5-4665-960e-5be3d58be35c", "comment": "Malware payload", "value": "f47d9fc3c2916a31408e70a908247263", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544318, "uuid": "c9d81a02-72c2-40ef-85e6-d8fff81d71aa", "comment": "Malware payload", "value": "dd3201f1b1f7a2606b596211b6e46ce87137e8b5fc49a68580cf71acfc79cfb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544318, "uuid": "2c134f99-d8f4-4f56-be4d-68ad590e57ef", "comment": "Malware payload", "value": "421158d17e615d265fcab1ee8e3cab1a448fc1d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544318, "uuid": "7e515cf1-db33-43ad-9eab-ac804f6f1593", "comment": "Malware payload", "value": "387020a2c2346cacedb0564275d28561b84b6ad37fdb98f63c24bd2e8b9861c394eba650919a330a175526320fb11ef7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544318, "uuid": "e53bc9eb-f2f5-44d8-994c-5ea6e754b5af", "value": "T1D7C43B017896603CDFDA363601F7EB2531E75CB0677CB52E6EC168EC9B2628A051D63E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544318, "uuid": "e00180df-c35f-4143-a5b6-a5f6aaf5afb3", "value": "fe91b35dbbcef6d3f3836ad3e8b836df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544318, "uuid": "38e28962-a668-4bf2-9f57-0e7382f26876", "value": "6144:xe4HnxyzcUzcUin5jBd4hp3CBj6O7O7OOuw/RRRI7E7E7E7Z94kx8888rLCkxEZp:56Kv+tEgq3dov6eimJEeTN+sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647544318, "uuid": "38c0014d-4e25-401c-bc9e-7b4040309f30", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647544318, "uuid": "2fb6fccb-869a-4a62-9015-6966effc8872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544318, "uuid": "1cac550a-ec44-4231-9ef4-29f36bae81bb", "value": "f47d9fc3c2916a31408e70a908247263", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af3fbd0-a5d5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647509738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509738, "uuid": "58be675d-9e7c-4bc3-9340-195f13f38a91", "comment": "Malware payload", "value": "5b9210ea3feddbae15a0b5bed07f9c26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509738, "uuid": "429fdff9-309f-4268-afd6-89e276db46a3", "comment": "Malware payload", "value": "dd5106fd29cee271ce8a0547581ed58170872c9ec1d9ee34118aa3305ed02400", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509738, "uuid": "db06af06-7475-431e-921b-0d51a40b10ae", "comment": "Malware payload", "value": "853ad7e29081f36fb80c5637d8cf5c7f190679fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509738, "uuid": "cc35abe2-b399-4c5d-afa3-dbb86550b9cc", "comment": "Malware payload", "value": "5f784ff678d07f9932fd25730036ee56c6c650cf62820185e98cb3d3bbe8cf5c9f963f1e16b1107d221283cf3ea5e998", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509738, "uuid": "8237060e-df30-45b9-a8b0-27a28fef2878", "value": "T150059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509738, "uuid": "9f1bc081-31a2-48a4-9b45-1e240a1267c6", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509738, "uuid": "0354a157-b6c7-4d34-9a45-b95ccffa51fb", "value": "12288:KVHML2QJe6XxhqCWDQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqLQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647509738, "uuid": "813944f2-c0be-4d50-a2f3-0250a2c32e46", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647509738, "uuid": "752cc97e-c03c-4d6f-a005-4f4608ede3b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509738, "uuid": "6f6bbf22-96c7-4de4-b665-fb13ed8ae8ae", "value": "5b9210ea3feddbae15a0b5bed07f9c26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09bd0732-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518514, "uuid": "89955c2f-81a5-4a62-8fac-653ddb903f49", "comment": "Malware payload (Quakbot)", "value": "42c309174a0cb3aa35420623d81da343", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518514, "uuid": "0c64ef98-531c-4fc0-85cd-940f572a194f", "comment": "Malware payload (Quakbot)", "value": "dd7598c5f92ce5abb839953f944925714487e412c703c3090a5e89f2750ea5b5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518514, "uuid": "b3c0563f-e94d-411b-8557-4c520d2b23d3", "comment": "Malware payload (Quakbot)", "value": "a04ac1bc7135a1e4bc5d67ec467b59ad73a06f6f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518514, "uuid": "4b378d0e-2a1f-4cd8-92fa-2c2982e226c8", "comment": "Malware payload (Quakbot)", "value": "35d9227c566f3326dc6eb2b4f0ee67177a203a4a3dc6b2f10f3449a213d1c1e880253b167c2372eb303824e511cc9229", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518514, "uuid": "55be590e-13af-4764-adaa-5c0706d0cd6d", "value": "T1D415BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518514, "uuid": "4689028a-8f95-42e1-aa9e-cc0e63bbd077", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518514, "uuid": "c12c07dc-3d8b-4579-b4a3-d3a3f68e54e7", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518514, "uuid": "8e5f680a-3778-4e07-a767-9acf6db63962", "value": 954572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518514, "uuid": "bc68e9f7-2d22-4845-a584-b39375747ac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518514, "uuid": "0a621271-8a93-43d8-9117-6be4f3372174", "value": "dd7598c5f92ce5abb839953f944925714487e412c703c3090a5e89f2750ea5b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f90152-a604-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647529812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529812, "uuid": "4d140028-a84e-4d71-a15d-5fe49923d9ee", "comment": "Malware payload (Heodo)", "value": "aff942527dbf4d9e84be578549a722c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529812, "uuid": "047d27ce-d92f-44dc-9d46-eca284f31dbc", "comment": "Malware payload (Heodo)", "value": "ddc2267d0508cacb7ee0f9f5df4120cc35297957cb8ec40985dbf738613f81f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529812, "uuid": "4676c05d-b191-404d-aaaf-9afad0601c4a", "comment": "Malware payload (Heodo)", "value": "61902d450855558aa6e5f6e78ec1f36e5f4eeb1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647529812, "uuid": "28fc190d-9752-4cef-86db-c1fcbbc4421d", "comment": "Malware payload (Heodo)", "value": "2db77047da0d4fa0f49c0496159a7057c8ce1b1eae804d77956e08f8c9cd038fdd45f7722f6df67aad8b72658a5d6b43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529812, "uuid": "e80b6c28-c94e-4ff5-b834-30d09c79358a", "value": "T163059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529812, "uuid": "646b3e24-0c66-4cdf-9c6d-739afb0363f2", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529812, "uuid": "e31a94ce-b683-4050-a808-60b71e75b1f3", "value": "12288:KVHML2QJe6XxhqCWYQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqAQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647529812, "uuid": "692ae9b1-077e-414e-a0d4-cd452b65601a", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647529812, "uuid": "cc1d7d0c-81b4-4acc-ad2b-e37bf7410344", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647529812, "uuid": "e04865e8-295e-4578-9237-2cfb2ce644fc", "value": "aff942527dbf4d9e84be578549a722c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d01933-a5c6-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647503182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503182, "uuid": "b17266b2-4b58-4401-819d-584952fc179c", "comment": "Malware payload (NanoCore)", "value": "11052fb67d1365ea9ea1ef0d2f7cdf17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503182, "uuid": "ab4b83b0-f18e-42dc-8749-721a0c2be7a5", "comment": "Malware payload (NanoCore)", "value": "dee03714f1675e36fd1e7aff9905c114458a0910bfb391d83047f5921b0ff8cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503182, "uuid": "f3f615aa-ec42-4a3f-9f60-6e366b142b41", "comment": "Malware payload (NanoCore)", "value": "ca55421d4a5e128c7c89f6927a1275679162152b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503182, "uuid": "1efd1294-c624-4418-986d-aa6481df6dd4", "comment": "Malware payload (NanoCore)", "value": "8df76b23794cc70c08bf2a52c448d8317f94b0a6b2aca67946e6d43da7a48da74388b46d08311f3f3a440cf430ee52a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647503182, "uuid": "859eb26a-0831-4ace-be35-8f923b4e3d77", "value": "T1A5134B86B2498261DC9B4639C973DF400253AE1378829629F89E7F17BE73382DC57707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647503182, "uuid": "340f6cbb-8b17-4f43-bf63-6fdfd91e7d24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647503182, "uuid": "65c0c7f1-5c04-4cbc-9157-6fc45993faab", "value": "768:6mnP9BAxuLIgXrWEPzKLSfxsIJhHpvAfu/QZp92vOp9d:nFUczzQ6sIhvVST2vg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647503182, "uuid": "0070cbb5-0044-4d54-9a38-6f911c0321a4", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647503182, "uuid": "bd6ad476-7bfe-4d0b-92f7-b7b09074ed5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647503182, "uuid": "818fbb1c-1a03-45c8-b53e-3d27667caf2c", "value": "payment advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d00d7c-a5ce-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647506774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647506774, "uuid": "9c65fe48-dc1c-4451-b9b3-237d77078ee1", "comment": "Malware payload (Heodo)", "value": "ecdb55f8a5f4829f37f278b74d98c672", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647506774, "uuid": "2671e917-5c2e-4c02-a4fb-d44e91f9d376", "comment": "Malware payload (Heodo)", "value": "dee5f3191498f62f1fe367ac7be9f0f83986f759a068f464b041af706cdb84d0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647506774, "uuid": "497e12a6-0cd8-4c06-9768-6b0fdb07d6e4", "comment": "Malware payload (Heodo)", "value": "5d77a8e5dac78a8401e0098bf0c87ae7251b6e5c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647506774, "uuid": "8167234f-2256-45c6-80e3-be56007d1244", "comment": "Malware payload (Heodo)", "value": "1bb318e40f53db7f8ad4494dfc7ea336b5f687878e1197b6b4cd13362c7b21476fe5b3c9fe40c9e808b4af82050fbfbe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647506774, "uuid": "ed8d9f71-6131-415e-99e9-02d0d3fa4e35", "value": "T1B4059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647506774, "uuid": "23bbfd17-471d-4b40-9cee-c7a40093c07a", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647506774, "uuid": "09dddb33-32ca-417e-ab83-69c09dd5af87", "value": "12288:KVHML2QJe6XxhqCWfQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqnQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647506774, "uuid": "2c4f26bb-3adb-47c3-b42f-2846fed36440", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647506774, "uuid": "e6f006fa-8bf5-4816-9e9d-3a530c5eef8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647506774, "uuid": "3a6fb8b6-55df-4958-827f-a29e15be8142", "value": "emotet_exe_e4_dee5f3191498f62f1fe367ac7be9f0f83986f759a068f464b041af706cdb84d0_2022-03-17__084609.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "219050b6-a608-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647531439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647531439, "uuid": "e18bdeb8-5ca1-4259-97dc-e1fbe24e76c9", "comment": "Malware payload (Formbook)", "value": "c98f33a2980ce1424f062168de4de39d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647531439, "uuid": "c723ce69-8379-4b3e-b249-ce42a45303df", "comment": "Malware payload (Formbook)", "value": "df1510f64189b49ffeb4630c74af81a86888114102b493f52b5ad1c1cb58d121", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647531439, "uuid": "42b1de9c-5be2-433a-a2f1-5117658b4aa4", "comment": "Malware payload (Formbook)", "value": "024bcc9cb9a78c98d85f5956c1db14f9f2cb3c4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647531439, "uuid": "d9344bd4-e0e0-47f6-8f15-b0757ac3c1ea", "comment": "Malware payload (Formbook)", "value": "bc2ded3216bbf610e7a283f0a8c19fd528e7f450322771961678c24b89689da227a9116bc2b50b96ebe1f603582d1bcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647531439, "uuid": "5987b6f2-3319-4ab9-883f-36dfcd8205c8", "value": "T1D625120963AAC317D5B407F9D9A190E913F4AC56E493D38FAD8679CF3D7B3004A6062B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647531439, "uuid": "78e8ee07-cf76-42b6-9356-f09996a25b60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647531439, "uuid": "ad2e8fe1-e97e-480b-9f42-6b47908e51cb", "value": "24576:3Xk9wihqicCLLFQUkvAVQYDBfj85gHJnv6KIDjwUw3JH/K:3Xswih5coLWAGifQ5al6KIDjQ5H/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647531439, "uuid": "ff8559ad-2aa9-4197-a9b8-b58291525505", "value": 1028096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647531439, "uuid": "377bf224-ff20-443d-9ba0-ece06df99414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647531439, "uuid": "7e9e4372-9230-46d4-a6a0-6437c454c8d5", "value": "New Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29bbd61c-a586-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647475618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475618, "uuid": "26e235cf-9c98-4e21-ad4f-781ae7dde977", "comment": "Malware payload (Heodo)", "value": "2ef18cf4fe542d5926b3461000eb9ca3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475618, "uuid": "0f617425-2728-45a6-8df2-3e8fbe619404", "comment": "Malware payload (Heodo)", "value": "df26e59378761f0b30608d2ddd00d2ead605692d1e3b27efd70e1cb9a4008574", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475618, "uuid": "60e52415-b964-49f7-abbe-0cdcea217005", "comment": "Malware payload (Heodo)", "value": "06a4a2b42197e7b76943922b5941ec51189a9be5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475618, "uuid": "b5aba825-84a8-422e-be84-9e9128d85aa7", "comment": "Malware payload (Heodo)", "value": "3ca4d5a338991baa917be7c48988f072ac6a3f13443d14ec3388014fbb94648503a3f67cc62aa19120d619f96d51bea7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475618, "uuid": "1141c913-5389-4a57-8160-e3d5d260fc0f", "value": "T1D0F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475618, "uuid": "865e43b3-8969-45f0-9ca0-7545d05e9c15", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475618, "uuid": "4c76b7e2-a148-43d0-960a-09cfbad1175a", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPBXvkgKtuBdfMAofD:WCBAdKV9Xf0kS3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647475618, "uuid": "4d2937c6-5f30-4d77-b9b3-8ab0c291ba45", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647475618, "uuid": "c497b3ce-30be-4273-adc9-00e4c9426164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475618, "uuid": "fe31b930-841f-44a9-a858-86795d962056", "value": "2ef18cf4fe542d5926b3461000eb9ca3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9698694b-a5d5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647509731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509731, "uuid": "1afb5389-79be-4fdf-9ae8-384f0b687aca", "comment": "Malware payload (Heodo)", "value": "dc56bfceb05fbc08375850481c8b9493", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509731, "uuid": "32d4fb07-6f90-4706-8f86-cc30beb528d5", "comment": "Malware payload (Heodo)", "value": "df2b0d848dfd3cb1bb2d53efb6716bf9849002c78207b6751565806905d3ad1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509731, "uuid": "a5d02d17-4ea5-4f2a-8aac-b2d20ca36fe0", "comment": "Malware payload (Heodo)", "value": "f51532f30cc7a5ffefefb730c3ab7d10ef143d40", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509731, "uuid": "c59bcbc9-b73e-4a4c-9e5d-a07f049c0d40", "comment": "Malware payload (Heodo)", "value": "e7a6a00ec9734a5369d63f99ea5b4f227e21bdfca7733865aef8114f1c650786be6ec32841d6cbaddf5cb8efcaa6c3e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509731, "uuid": "38c6ada3-6e18-4282-b216-805b0188757b", "value": "T19F059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509731, "uuid": "950cb963-2f94-47bd-8ea4-9c2b4f083564", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509731, "uuid": "a6d318f5-3e6c-47ad-8464-e23f264cc0c3", "value": "12288:KVHML2QJe6XxhqCWPQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhq3QHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647509731, "uuid": "fbc96beb-dd70-47c5-8c50-d3f0146c1ff7", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647509731, "uuid": "56dab8c6-8b15-4df3-aa82-318e123cf4d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509731, "uuid": "413b56bf-2135-481f-ada6-49b285a5ee79", "value": "dc56bfceb05fbc08375850481c8b9493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5f742b-a619-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647538839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538839, "uuid": "5c2f7d7e-eee4-48b6-b073-619b30862b1f", "comment": "Malware payload (Mirai)", "value": "0607c11762fec2b27a68881620bbc809", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538839, "uuid": "1ae9b86f-3fac-4fdd-ad20-4d0e5531f4d0", "comment": "Malware payload (Mirai)", "value": "df5b136720f4fec84c93047a6d143d00f4a46b5510bc0031d6d98a884f3cfe1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538839, "uuid": "59eba394-3d0a-4692-bfe3-530d334efa40", "comment": "Malware payload (Mirai)", "value": "ed55f417f906688656f69588da17f239e1a62840", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538839, "uuid": "9dd4b642-9d34-4601-826e-48b5bedbb078", "comment": "Malware payload (Mirai)", "value": "9486b026d8496f30f289cd3acf1f45a35b6420593bacc42b06e1062b148dfa1ec542b54c30108315d8f5ef86d575ecd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538839, "uuid": "a7f95b70-3f88-4683-ab0b-b071744228c2", "value": "T14AC2CF4C69942588DCAE4EFAB0EE2321CD51E1C673EA4BDE67955880F36F003B90F039", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538839, "uuid": "43e58eb2-19c8-4573-a0fd-d2edb106a5ed", "value": "768:6z+GQDBtqA2oXyDTv9Ig7zuAplp7JhiWMEu:6WGRD5/3u+ptW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647538839, "uuid": "a7754e17-a85b-48d1-be8c-ab3b606e2bbb", "value": 28164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647538839, "uuid": "aec7ff71-14dd-4158-8cca-e8f706b600d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538839, "uuid": "e34d73da-c97f-41b1-91c0-b357d1d7d2f5", "value": "0607c11762fec2b27a68881620bbc809", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3fd620-a61e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647541065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541065, "uuid": "01ae12c2-95a8-4368-9516-88c01be9fcad", "comment": "Malware payload", "value": "3473cb128b77406d61ecc3c71d53169f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541065, "uuid": "6dd9934c-0cd3-4e18-8e83-2cb4a54465ac", "comment": "Malware payload", "value": "e02363aaa9a398133bd8941917a77b5ff96341263e3e7b3432f5b38d7b00f1fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541065, "uuid": "105a5e84-fb09-4e78-ae27-e2eac871e996", "comment": "Malware payload", "value": "e3757e449a5cf6a4ff6df35873b6650abfa62660", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541065, "uuid": "a6bc4a08-5895-4591-8804-0cabf4f4fab3", "comment": "Malware payload", "value": "a6110743165e72b2a61dc7da29d986a90a6418f0bfed39860f4008f48ea6b47fc338a7101a35f57212b3e49429bac00c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541065, "uuid": "900d73b1-c80c-48b8-813f-6a4e3e4ed664", "value": "T106058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541065, "uuid": "0ff1d677-7201-4f33-bb82-4e82b345fbb6", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541065, "uuid": "c2eec94e-300d-4b29-a5bd-cd2426ffe259", "value": "12288:Wvz1CLJyyvmMLSrBgm4ruGbPlVpqb+DlYzv:WJCLJyybLqBb4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647541065, "uuid": "17c8ea59-d49b-4a64-ba71-c743534723c2", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647541065, "uuid": "9eafaf7a-9c59-4f10-a4aa-ed8399bd108c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541065, "uuid": "1f1bf6dd-9ff6-48be-b4b7-54860a6cfa1d", "value": "3473cb128b77406d61ecc3c71d53169f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563f3c91-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518642, "uuid": "dd83f146-17a4-42ff-b4f0-a68cff27620c", "comment": "Malware payload (Quakbot)", "value": "7f591904a407f4de49d3e4cc09c47c95", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518642, "uuid": "09df574e-dd46-4162-b82e-5c0e2319d769", "comment": "Malware payload (Quakbot)", "value": "e0c2799f4144ca39fe82c77c4721ffe122afe96c59dd3dfc2cc98f150ce7fbd4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518642, "uuid": "91d58ceb-5ee0-4896-81fe-5e73b7862194", "comment": "Malware payload (Quakbot)", "value": "13ad8acceb74dc8b7511aff16ce998a16a03251a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518642, "uuid": "829aaccc-4949-4868-9446-ea52f2db6245", "comment": "Malware payload (Quakbot)", "value": "9e7bbcf60ea67a81078974d1b2f7b7c0ac0d42e844b3ac21ad8916a04881923079dea20718b0982878f5ab7bab8a9da9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518642, "uuid": "c5b2c9ce-bb23-4ec6-82b2-275d363f3488", "value": "T17615BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518642, "uuid": "2f62a87e-9133-4179-8bf1-27192be5d558", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518642, "uuid": "5dcbac2f-a09a-476b-9b07-d1c721b51ba6", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518642, "uuid": "f6400a09-c3dd-4056-9cb7-585694115a77", "value": 941828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518642, "uuid": "fcee96cc-be24-4c77-babc-6b0a8ac9ea45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518642, "uuid": "21225a57-cb0c-4c9e-9998-18f34abf99ef", "value": "e0c2799f4144ca39fe82c77c4721ffe122afe96c59dd3dfc2cc98f150ce7fbd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e58bc0-a630-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647548567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647548567, "uuid": "d4afdb2d-e527-454f-b95f-7a414c4d01c0", "comment": "Malware payload", "value": "25d7a2941e6e0972112b530cd2afff77", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647548567, "uuid": "f4272597-988f-4961-ba95-df07b5e3d203", "comment": "Malware payload", "value": "e14c50c63abbd6e3cfbc72e29a594ab6d39d9222609428e2118a350a127004ef", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647548567, "uuid": "2682cbcf-caef-420d-8d34-0d6e6018b8fc", "comment": "Malware payload", "value": "30572b74915ada9d9d238ab0a8ba16b33247c146", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647548567, "uuid": "83470ce2-5613-468e-9cb3-210f7241148c", "comment": "Malware payload", "value": "df88c50d4f1b74f7cc511a6d0e1d3a6df352524daf01b8ad396b9a4644234f20971448a030b8ee85844ebe566b314a88", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647548567, "uuid": "c51ad3fc-48d7-4c20-a7c5-2d3834e9ec8b", "value": "T156A2BF3FD131A828E77FA87C920440F6E7071C4A1007AA9D2C55F75E65776BA038F66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647548567, "uuid": "6b6ada81-21c2-4e50-a85d-705ea1e2bfe2", "value": "384:/A2Y5Vb1GNj20o4CGzPd6ZIwLJKb5CzgObff9kC+xbX7k7aU2d:42EINro4FLAOCBn9kC+xbLkWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647548567, "uuid": "a768377e-d982-46b8-81f6-ed7bdc3d524d", "value": 21452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647548567, "uuid": "0a3839a2-238d-4e60-948a-3fb0fd16bb7d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647548567, "uuid": "d0c05699-21c4-4474-aa0d-d0921fbe24e6", "value": "MAJ173502821CI.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8259e2e4-a5d4-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1647509268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509268, "uuid": "8f9ac72b-a4b8-4a15-9400-8b3e50704670", "comment": "Malware payload (Gozi)", "value": "ee121ca873e9fe218239b5061de46095", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509268, "uuid": "209369a3-531f-4a14-9926-d649f53fd93f", "comment": "Malware payload (Gozi)", "value": "e1fbf062be70edd5ad7baa515a9306cee616045ff9d07608f713f9969b9af71e", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509268, "uuid": "c1aebfc4-7bf2-4635-8f82-a7682c77d2d7", "comment": "Malware payload (Gozi)", "value": "0705fff523a16a7391ad9665fb667825c7697948", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509268, "uuid": "8e4c62c1-16eb-4f6f-a798-0f22bcf193b1", "comment": "Malware payload (Gozi)", "value": "13ecbb0106289a9a414ff8b9c0144d8d4991ccf8f59422555ad321387036927991609adae67f678e0898350362bbb60f", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509268, "uuid": "047fc006-19d2-403d-b8d9-d028fcd1bc12", "value": "T1FEE1AF53E2417B84CE558030E21FE6C7E688994B726108998617FD7892EF4E40FBEDA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509268, "uuid": "c6c061b2-5f30-4bde-9dc8-99327347b982", "value": "192:M5A3s8EOTR9Il+IxcpEOL6FLZSYA6Xqr1GEkeE6CttO:M5c/EkIxcp9W1SYq4EGttE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647509268, "uuid": "0eacfe15-1055-4bf0-bf79-a4b0cf92d4e8", "value": 7005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647509268, "uuid": "3bb4ff1e-cada-4915-aae7-eacd7837fb9e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509268, "uuid": "be31d3b3-4801-42b4-9195-37ec17d6d579", "value": "impresa116.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2227e19f-a626-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647544325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544325, "uuid": "ed97e2bc-223f-421c-b452-d5aef98aeac0", "comment": "Malware payload", "value": "ec75121a979d96d86e377981b706a11d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544325, "uuid": "91093e26-1359-4253-bb5f-784971495aad", "comment": "Malware payload", "value": "e3d652bb95d57a7f7fe534d3cbc21d4a6a4418b13d056fd12419cce9414d8d5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544325, "uuid": "8ec791b1-a99f-4217-90a4-5a5476a8213a", "comment": "Malware payload", "value": "06ccbff50857347943a6f61308ece8e6678829bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647544325, "uuid": "41185f98-867c-4cec-9f8b-91ce25c0d0ee", "comment": "Malware payload", "value": "ddca218fc74faeed72f83b510767b91fdb05400cf4ff6d1e3d00f91e097226b767740acd790f425794b326a44270b65b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544325, "uuid": "4e19e7d7-e7a2-418d-826f-9d056aea4b86", "value": "T181C43B017896603CDFDA363601F7EB2531E75CB0677CB52E6EC168EC9B2628A051D63E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544325, "uuid": "77e28dfe-d42e-4f45-807b-ae5cffc7f468", "value": "fe91b35dbbcef6d3f3836ad3e8b836df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544325, "uuid": "2335596a-dbed-41ea-b244-506b14901450", "value": "6144:xe4HnxyzcUzcUin5jBd4hp3CBj6O7O7OOuw/RRRI7E7E7E7Z94kx8888rLCkxEZy:56Kv+tEgqsdov6eimJEeTN+sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647544325, "uuid": "e6198fa3-7abc-4b7e-8288-131632a97e62", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647544325, "uuid": "88119bc2-aca6-4f53-a311-aac50177d60c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647544325, "uuid": "58fe7816-c6d6-4b26-903a-6a2f366b44ef", "value": "ec75121a979d96d86e377981b706a11d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a47cace-a5bb-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647498382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498382, "uuid": "d47d4375-4684-4f5e-8f45-fd3b448a0386", "comment": "Malware payload (Formbook)", "value": "5ef4d2cc1fde72b4ca26840b611f35ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498382, "uuid": "6b254500-bd3a-4f70-b086-89248761e477", "comment": "Malware payload (Formbook)", "value": "e45373d8dcd92089d13cf4a9337f7f945818a98e8d10710b5ae51e59bbb916fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498382, "uuid": "3686b76a-c35a-437b-88a0-f30a710c0a16", "comment": "Malware payload (Formbook)", "value": "222de76ad9c1b575f23ac386118278daa891996b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647498382, "uuid": "3f714662-b094-4537-80d6-6c517a45a1c4", "comment": "Malware payload (Formbook)", "value": "4504ce52a4a3d494c1a77051d8c1030d141de2f5a7bec6bd7394d06ee5fe2a68b1c85fc32bbb71d8ebbc6180179de3a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498382, "uuid": "3c748dc8-8e28-4a21-8bda-ab8a6d26cd20", "value": "T10D159FB917B4D91EC511CB7CCC5A52203AFCAD878928AD9BDB089C5AD983F0163F19CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498382, "uuid": "504fc78f-8aa7-4165-8919-4a74354281ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498382, "uuid": "d6801ae9-1962-48ae-a517-9cf3150bcd69", "value": "24576:mlcgUmNo/6Q0EiCMgn7Xh29ghNTKpxki:Bg1O/TWCrxhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647498382, "uuid": "aba19321-8f7c-44e2-b270-de7944a19089", "value": 923496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647498382, "uuid": "5f6b6c8e-f029-44de-9c41-2ca17d8794cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647498382, "uuid": "cdc69982-cf3a-4d1b-988e-1e470aaf73fc", "value": "New PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c91ee11f-a5e2-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647515399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515399, "uuid": "bd2d1299-1f78-4f02-81d3-6c6b5cc6c3b7", "comment": "Malware payload (AgentTesla)", "value": "1a7bc4f53b0cc6b1ee8085c7f1a2e4e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515399, "uuid": "3f36f629-efd3-4c7f-bd0e-718d1af60229", "comment": "Malware payload (AgentTesla)", "value": "e462b233f83c4034bb7009f9cea2e28e03c1b3ecb2720035e9b86b699f35d3c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515399, "uuid": "062c9b44-42fa-40fd-bfeb-c95a69a83259", "comment": "Malware payload (AgentTesla)", "value": "613141d0bb9cee08e20fbe1f1934949265c6b2da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515399, "uuid": "e6f16643-14e2-471d-9c9d-0394bda097d3", "comment": "Malware payload (AgentTesla)", "value": "8adc790bff660b61259706e486bcf100171905aa0bb18cdd88b8e2894fc128de7957615af5a4fc946bf6bb1ec0506971", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515399, "uuid": "01bb592f-38f5-4c87-bac3-a4432b8bf399", "value": "T170742387A85D9695586727AD12187EBCAB264C1FF52E991CF23C3441EF429C0CD363F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515399, "uuid": "f4901dc9-a8f2-4341-b7b0-7eb440790728", "value": "6144:sDjpM8/gbxYtQvS7HCoHPtK1sTF8Xm8t76FFnuT/OGdcHvjyb2Va0M5o:4S8/gltvCHCokSxu5BO5uTGVOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515399, "uuid": "9a086b40-b0ae-4770-bbe2-4abdf398b476", "value": 347707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515399, "uuid": "77d4c8d6-26da-427b-a60e-d52e84608a06", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515399, "uuid": "491ae185-5d40-4470-9ad3-cb14d6654009", "value": "documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c122aa6-a5e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647515753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515753, "uuid": "14728335-91ff-4b17-8162-014615ec1b35", "comment": "Malware payload (Heodo)", "value": "55acd7db491d42153a363d4a2062ea7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515753, "uuid": "e8af3137-b02d-4c42-8215-44fbc33d1139", "comment": "Malware payload (Heodo)", "value": "e485bdb4dc1cb0985d9548a9d3228ffd6ea3dbd1123311e16cd13ef1909371e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515753, "uuid": "4dcce684-9900-46af-8f30-cf2742196ee5", "comment": "Malware payload (Heodo)", "value": "379937522423c533f044e345ca7dbede78a94da5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515753, "uuid": "db3be5b7-97b5-447a-a018-19806a9d5060", "comment": "Malware payload (Heodo)", "value": "af3c32291f7f1343379c2f68cf508bfac7e955aadc25dc0bb451239a1d01f2f83c442c3df131b16bf36a69383b9c3665", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515753, "uuid": "e62a94c6-d94d-4fcb-a4c2-1eb9be7b8434", "value": "T1AC058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515753, "uuid": "ad821442-f007-45f5-96f5-957f4c34c0aa", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515753, "uuid": "53991a7d-58dd-445b-979c-2cf50b2d1065", "value": "12288:Wvz1CLJyyvmMLSrBgx4ruGbPlVpqb+DlYzv:WJCLJyybLqBM4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515753, "uuid": "aacecb99-03ab-42a4-a1c6-366323329607", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515753, "uuid": "e55be406-5faf-48a6-bb0c-36913a8d2e5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515753, "uuid": "de6d7c98-e4c1-4a82-a246-b373f5f42db2", "value": "55acd7db491d42153a363d4a2062ea7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5918a36a-a585-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647475268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475268, "uuid": "ad1e1524-662a-436c-90d0-e5a7539f60bf", "comment": "Malware payload (Heodo)", "value": "f2a026f01f8dc52fb3e70010e1e21f5f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475268, "uuid": "06b841d8-35a5-4b6e-884e-61cdf222e72b", "comment": "Malware payload (Heodo)", "value": "e4d40ee903a91d8d35c592790d38781eb44ea17ef543ed7b48b451b689aaffe5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475268, "uuid": "3647cba2-79a3-46cf-89c3-c570cabe363d", "comment": "Malware payload (Heodo)", "value": "639e29fa67e9a80e86c29edb3c586be45c92bcf7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647475268, "uuid": "048c1a97-5b35-45a4-be71-c25d87488aa4", "comment": "Malware payload (Heodo)", "value": "e61ddd819ec4b6f6a2218b005d3afa59d94241d8d0fbd803db31539471e94208a4ea20ea0a39a6d1f82de0dee955919b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475268, "uuid": "afd82221-0a09-4f7a-a42b-6df55f90c772", "value": "T1FBF4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475268, "uuid": "6e077899-b1ef-4e7c-8db9-c304ecef54b9", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475268, "uuid": "06b2d826-8cd4-4fa7-a86e-4a6a0db535ab", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hZ8rLneTfABCJoWRWwfpW:BeCCF88j+XE8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647475268, "uuid": "127210be-d68b-4820-8e9a-9d767dda6c58", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647475268, "uuid": "557649da-ab94-4dac-9c93-714c2d3e0340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647475268, "uuid": "8635eef1-d69f-4705-bd9f-e6a49550cc58", "value": "emotet_exe_e5_e4d40ee903a91d8d35c592790d38781eb44ea17ef543ed7b48b451b689aaffe5_2022-03-17__000056.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d2b395-a5de-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513354, "uuid": "39a12e9a-2fc1-4da6-b7ab-085084bbbf09", "comment": "Malware payload (Heodo)", "value": "aab5da5c42e4b619f7d5201cfb61d4af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513354, "uuid": "5c04cb78-5c31-458d-ab2c-638d1638693b", "comment": "Malware payload (Heodo)", "value": "e52cb4a5edb5a48ef771d78675911244bba0524aebd0a1067787cc47d8b50747", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513354, "uuid": "e321553a-2a7b-49eb-84a8-eac471ddecc2", "comment": "Malware payload (Heodo)", "value": "8ba03ee1ae3d49bbc180b06cb633d8e2f801fe10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513354, "uuid": "96e3813a-7206-4114-9aa0-9c268f9860c7", "comment": "Malware payload (Heodo)", "value": "56afa94c6bb777c9277ea3e9bb5e8193672bddb3e0a5771ff9099f5cfb55ca7ce3a5ea2c7900c2778869669ce7e5ff6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513354, "uuid": "b7d82568-3863-449a-b2b5-a57cb45799ae", "value": "T132F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513354, "uuid": "0fb92112-9a6f-494a-baa5-d073b492b3ea", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513354, "uuid": "33710f0b-3bcc-468d-8f6c-b7cef797e788", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hS8rLneTfABCJoWRWwfpW:BeCCF88j+Xn8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513354, "uuid": "efc76fb8-07e6-41a8-ab1c-1a841df126f8", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513354, "uuid": "12e7c32c-e1d2-4387-93c1-f8f6553f202c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513354, "uuid": "5266d3eb-14fd-4185-93af-45c631ce181b", "value": "aab5da5c42e4b619f7d5201cfb61d4af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5113442-a5fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647526559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526559, "uuid": "9e09d4f9-ac78-4e51-8f18-473a204e0fa9", "comment": "Malware payload (Loki)", "value": "5b76a93234758479a35ea8e8a2f2551b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526559, "uuid": "f76dd897-abea-4147-83aa-4057f3db75d3", "comment": "Malware payload (Loki)", "value": "e5529caf2db829418b3ab8e8b4953b226ef26317a71848762b43e4bf12bafc06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526559, "uuid": "9b369421-c1e9-4d9e-92f6-cdf3fdc7c44b", "comment": "Malware payload (Loki)", "value": "e64873ee94e31c63687caaf9d8692fbde3bfb5f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647526559, "uuid": "936559e0-ad8a-441b-b023-56d06c9a2e0f", "comment": "Malware payload (Loki)", "value": "2e4c9a3da59390bbfaa28daa6ad6714742a9c494a0587ba8ffb97cbd50dc6a7d809f6b68de9d63eba9889bdb9a80440b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526559, "uuid": "c180c9d1-0393-4e4a-a1a2-12c05ccb2bcf", "value": "T1F0359D2632D84A11E2BF577AC1B49913FEB27D415629EFEC648231DE0E1E7029D38763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526559, "uuid": "2147be41-f9ae-4e78-868a-c0d833191833", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526559, "uuid": "0e29a159-eaa4-4d99-8743-256017dc9066", "value": "12288:rQ3Djjytk6V9NbUP2TJ9GvVpU6TkDiuQh0jdLFSNqzYoqr1oRby5TN1Zx:rQDjjGV9NbUP2TJOHU6TmQh0t8c3CRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647526559, "uuid": "31c61975-57b7-44f0-8e76-afb866b3c49d", "value": 1076224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647526559, "uuid": "134fdea9-e119-4eb5-b4f7-f5316de3d813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647526559, "uuid": "380505ae-20dc-4a53-a696-6450eca9f1fc", "value": "PO51728.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8db73c8-a606-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647530941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647530941, "uuid": "31e9a0d6-4d47-463e-a4a7-e68831c7b57a", "comment": "Malware payload (Heodo)", "value": "33ada4dffa1416ab3488113972a5d881", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647530941, "uuid": "dd6bdfe0-9d38-42ee-8671-37adff288a8c", "comment": "Malware payload (Heodo)", "value": "e62c356ef67275296a51b817ff0184b0991846b4f7b29b52b4aac9ccd844e990", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647530941, "uuid": "8735e89e-21ae-43a3-b997-3c0298fffec9", "comment": "Malware payload (Heodo)", "value": "1a31c161e831569c41a7f8733c31193516c83e42", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647530941, "uuid": "1fb0e6b2-a2da-4bbe-882a-cc6a12d2b8e2", "comment": "Malware payload (Heodo)", "value": "c07f248336825f708e94c0b1446aee37aec835a6ad1b516ad5f643a08c6c54ba35aa380592c556ec801ee1526fc35b9f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647530941, "uuid": "fd78ffb6-ec12-4241-8a92-ab83b470bff2", "value": "T114A2AF3ED221E818D67B987C830580F6E70B2C561007A9ED2D51F25D66726F7138FABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647530941, "uuid": "a5d85ea5-46bd-4ebb-b01f-aa86b76acf20", "value": "384:CQZAVb1GNjJITo4CGzPd6ZIwVKb5CzgObff9kC+xbX7zL0crX:CTINqTo4FL3CBn9kC+xbLHjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647530941, "uuid": "9d288468-bac4-46af-ad84-c9b4ea1969bb", "value": 21461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647530941, "uuid": "bb9e8b64-26f3-4804-847a-607642b46174", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647530941, "uuid": "b211acf6-e053-4d6d-a4d0-099e5fbc4e83", "value": "Dokumente 2022.17.03_1559.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b35576-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "f2edec1c-fac4-4c79-8c48-76b3e70fe7e1", "comment": "Malware payload", "value": "fb746cb1eeb121ec378cc12896c1e79d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "5e5c07d8-a37d-43ae-abb9-499d14c619bf", "comment": "Malware payload", "value": "e664bde553e4f69f6b3c130dad670757483e89ffc3bd8f3f8a57187e5c8ae657", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "2082eab0-75bb-4eb1-920f-6cae580931aa", "comment": "Malware payload", "value": "2e669796dbfb4109198965b90de7148fd87c1dd6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553505, "uuid": "7f7bb656-632b-4c58-a782-32bb105b3ec4", "comment": "Malware payload", "value": "db3eae698703a3dc7c61cdd48b9618044ac0e1a91e660a3f1d6e7d1baf2215b96914abf403f3fa59c535d380b3e817b6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "bd521374-6cc4-413a-a85e-0b0b8cb1e116", "value": "T115059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "9e431cc2-6b32-451f-a5ca-b2edbdb17c20", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "9aeed583-e699-4b38-b8c8-aef05d245d5c", "value": "12288:V20BXOMcVzpWfmmnDD5X5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDVX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553505, "uuid": "dbe2f919-065a-40f1-b01f-4e06cbab9a92", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553505, "uuid": "96baa1b5-0832-4658-9683-afe5c18a47b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553505, "uuid": "c3ddf881-8602-4457-8bf6-f2f6342c0eb3", "value": "emotet_exe_e5_e664bde553e4f69f6b3c130dad670757483e89ffc3bd8f3f8a57187e5c8ae657_2022-03-17__214456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4615cf7a-a5cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647507019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507019, "uuid": "888682f9-d40e-461e-a5e5-69460349fb78", "comment": "Malware payload (Heodo)", "value": "951c153a14813bc2d8599526157289fb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507019, "uuid": "156e7111-ce40-4057-811e-ab204dd4dfb9", "comment": "Malware payload (Heodo)", "value": "e77671a91cf8bdd6ca35d8d93b228add6d7470855b7b2f4b0bc1ff67cac4dbdb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507019, "uuid": "f295f6f9-0f14-448c-bed9-70b662b17e65", "comment": "Malware payload (Heodo)", "value": "49fb4e5e3f60e99a336f3f7f2b46b49bd840df43", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507019, "uuid": "87c52d30-ea5d-4806-9486-fa6bdd4ca10f", "comment": "Malware payload (Heodo)", "value": "f09642da4220bf0209db848c78bf67026f5be715606fee72761087b8339cdce2ce2d704a12a8eaf5175a3bb4e3c2d9a6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507019, "uuid": "948cfd08-5c56-466c-bf88-c8f0220bbbbd", "value": "T1FBA29D2CD921744DE37A683C821940EED28B1C067047B9ED3490B67D6B7B297178FAED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507019, "uuid": "629e0f5e-89ec-41a4-a9f0-1365bfab1e0d", "value": "384:zhuAi/NjZS8EibbwBlwegASYrLb5CzgObff9kC+xbX77NWu:ztsNxzXQFCBn9kC+xbL71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647507019, "uuid": "6e1fed80-3a62-4a53-a85a-d64f8627e094", "value": 21667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647507019, "uuid": "f1c5f01d-ad9b-43ad-b3c8-2a9ebd747ed0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507019, "uuid": "1aa27ecd-c605-4ab4-8805-3b66052f1cd9", "value": "1703.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a17e91-a647-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647558533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558533, "uuid": "89a4e9fa-7aab-436d-972c-8e7cf228edc1", "comment": "Malware payload", "value": "a6d658ae932b0e4027bc197ab6a12f15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558533, "uuid": "fc402a65-17f2-4e5f-9ec6-522f77adc2b4", "comment": "Malware payload", "value": "e77e58748274cb5cbbf2fd6cb8a9f59d574649b265e085723274055d181df855", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558533, "uuid": "3b09528b-06d2-4e2a-8b20-35e58da2b5f3", "comment": "Malware payload", "value": "f9b81a8297c3083a3259620c3787dcd045f24caa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647558533, "uuid": "cb18f879-3500-4b11-9fe6-a555b5eef5a1", "comment": "Malware payload", "value": "9a1f876ebd9b2dafd97c840d1917b479fa81bc3d6433033b021a6b6f39dab1bb290604c0265c5a100fc922807069664e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558533, "uuid": "95782de4-40cc-4aa7-bd34-4b550224abd8", "value": "T1AA059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558533, "uuid": "5d8e7e8e-b0e3-4b5b-88b9-fcdc61436963", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558533, "uuid": "c1f0720a-2470-4506-87ab-9ccd998ea591", "value": "12288:V20BXOMcVzpWfmmnDDhX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDdX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647558533, "uuid": "24185a7a-638b-4696-88b7-94582b379d69", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647558533, "uuid": "e44505a4-0c2b-43c0-b7e1-d0eb553973ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647558533, "uuid": "81a088a6-8a25-490d-8018-6a34441cff79", "value": "a6d658ae932b0e4027bc197ab6a12f15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c00feb5-a619-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647538812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538812, "uuid": "61f9be08-899e-4298-9b4b-989a94b38a1b", "comment": "Malware payload (Heodo)", "value": "52ba30da45fc8e86c92cbb2ad007e405", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538812, "uuid": "f20a8d3c-ecd6-4f71-b1c0-6679e99fb983", "comment": "Malware payload (Heodo)", "value": "e79a33c4a6a3ba382b7980926d38cd1e27715d6c43fb05989498c8c0f875894f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538812, "uuid": "97b33d15-64cc-4781-9702-1b4f795eb5e8", "comment": "Malware payload (Heodo)", "value": "cea1b491100720fb71f7ce54a90f2de2d4996f20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538812, "uuid": "48b39349-09a1-4afd-8c15-27692ef9d152", "comment": "Malware payload (Heodo)", "value": "8f312b92c3a887c455d24ef723ad5404146acbbdbd5fbf6e30d56387ca1768a0add157750e68f64f3bd02446bfe67bd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538812, "uuid": "107f3ca6-9063-4c4b-accb-51097bf29e34", "value": "T137058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538812, "uuid": "5de6a0f0-e28a-441e-b848-8e9d357a26d2", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538812, "uuid": "8ba8aabb-31d7-478a-b654-b2faf58c0dbb", "value": "12288:Wvz1CLJyyvmMLSrBga4ruGbPlVpqb+DlYzv:WJCLJyybLqB74ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647538812, "uuid": "6a57d7f8-7622-450c-af55-7607844789ab", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647538812, "uuid": "1de9017f-aa21-4ee7-a06c-94940b1f349e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538812, "uuid": "704cbb9f-cdf8-4943-90cb-9d34dfda590b", "value": "52ba30da45fc8e86c92cbb2ad007e405", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49047410-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518620, "uuid": "6146e442-139d-4d4f-8a0a-2416239d4c26", "comment": "Malware payload (Quakbot)", "value": "f058a56c9fbd5b244f59ca69cf6e7f69", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518620, "uuid": "5c653c60-de54-491e-9030-cba69f2ff27e", "comment": "Malware payload (Quakbot)", "value": "e8519e764f1040539006fec7670781f2e609370579327fb9c3a0fea3de47d41a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518620, "uuid": "7dd91d6f-3775-4e63-a95f-6f4aba5fe42e", "comment": "Malware payload (Quakbot)", "value": "0db6835c52822b0cbbb8a1d820cd657f797fe18f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518620, "uuid": "2d4b9b39-1926-4af6-886e-ed4355aae33c", "comment": "Malware payload (Quakbot)", "value": "baba0b11d385734f1527f25fa0b66121d4e5e0c36554f2d249b84fdb43d2a9a944f88a8e4a8c3d52aecc140afb619c59", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518620, "uuid": "77f5e3f6-29c3-47ce-be71-961badd08269", "value": "T16E15BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518620, "uuid": "a5a95793-51b4-4361-b896-569c6d77ab04", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518620, "uuid": "8394f07d-fdf4-4e42-ad39-68e235fded5f", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518620, "uuid": "9d405f7d-0549-438c-ad60-1e9d3b778dd6", "value": 944258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518620, "uuid": "554bca00-dee8-4bab-a587-8dbc842f771c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518620, "uuid": "2243381b-a605-4e1f-8214-5d836b2291b2", "value": "e8519e764f1040539006fec7670781f2e609370579327fb9c3a0fea3de47d41a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c77f2d4-a64d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647561066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561066, "uuid": "b7c7d3f2-7d82-44bd-a7f1-bbb849b7f61f", "comment": "Malware payload", "value": "fb0bb71cd6904de8391c74559472cff2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561066, "uuid": "4ccf5ddb-60ea-4a03-8fe7-9c7d2e3127e8", "comment": "Malware payload", "value": "e8654d5e701fe597a385002225f6d127e225cf7e6bcb0e41513db7999ea1ed2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561066, "uuid": "d6d7d34f-22e5-4707-ab0f-32d7f02068eb", "comment": "Malware payload", "value": "4e7da9df0cabd86378bf3c3910d39e5a3e9cba41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561066, "uuid": "12ac30cd-a001-41e1-94fb-0106740c15b7", "comment": "Malware payload", "value": "ed921fbbe0bc461df7e6ad8f193ecea83e21be3231fd907f493237c8ee0b8f7fc851eef1fc632b43083bdb2a4176eac7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561066, "uuid": "4a41dc16-ae65-4cfa-a9ff-885a9d425f6a", "value": "T19C23017D8C2D0FF7E34BEBB5800D5129594207AA0099D39F94D6A8ABF67E0E45328CC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561066, "uuid": "6b0bb3bd-8fb0-4294-a89a-de9fc8f4410a", "value": "1536:gSoQ6g7Cce108O1R2cyl8RPJkB0V0X/Z5DAsuq4ZvJ:gSRre10jRul8cOKPZ5Dwq4ZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647561066, "uuid": "b5bbf8c2-9fc8-4612-ae8b-a64eb807b179", "value": 49704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647561066, "uuid": "076a5522-fc01-4fa2-ab3d-ad33493279be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561066, "uuid": "24342160-948c-49e6-b426-2f18e28972dd", "value": "fb0bb71cd6904de8391c74559472cff2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830d13c5-a63b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647553507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "c9e85e8c-108f-4092-b87c-1d68c43dd0ed", "comment": "Malware payload", "value": "7f2ff43b0526323ffbc4b8f465d277a4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "3b769f73-36a5-4d40-8328-956cdcd85691", "comment": "Malware payload", "value": "e8c79ff47961e9c3ef0e273fefef30fb3f47dd5b4d55f2d5088a4dd70ad9ffcb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "5bfffb72-0089-42f6-a196-ee66fd049437", "comment": "Malware payload", "value": "c0fdca34553a2478e1c82ca93e5b93f5d462da80", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647553507, "uuid": "a1dbb6b4-f35f-46e0-9af5-44b5729cca54", "comment": "Malware payload", "value": "526f911260f538c04aae3d9f63bc6f43940eb94f06688e655e0244bb7ee8585de3cc77b1c397806a96bea6017117c33a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "0947f9cf-a922-4517-b209-bda7bcb85978", "value": "T1AD059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "2072bff8-88e9-4f45-bb29-085e6330407e", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "0d9ad5df-a72f-479a-a161-54ce4ec70bce", "value": "12288:V20BXOMcVzpWfmmnDDYX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDEX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647553507, "uuid": "c8f23d1f-86c1-4bf2-82bc-13fdcec745a1", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647553507, "uuid": "5284711a-fe29-482d-ba03-be766a34f270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647553507, "uuid": "d936a2a9-b63d-48bb-94b4-aa3544f66628", "value": "emotet_exe_e5_e8c79ff47961e9c3ef0e273fefef30fb3f47dd5b4d55f2d5088a4dd70ad9ffcb_2022-03-17__214457.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86be785-a649-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647559583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559583, "uuid": "28c4686b-771d-4389-930e-21dfbf47f579", "comment": "Malware payload", "value": "5e464d6c839bb616ae5e92ac8b7c26f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559583, "uuid": "e586cb6b-0325-410a-8e7f-3f80617ae4aa", "comment": "Malware payload", "value": "e91564971b2f20ee86fa463eab7f9c2b83b9220f937138a1a3d5b478de66890b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559583, "uuid": "62e6f566-c437-40a2-97b4-2e50f6570f17", "comment": "Malware payload", "value": "d391d7f0cdb675cafe671c5f5f6006da78122a8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559583, "uuid": "6d67b1d7-8109-4bdd-bf5d-a16059b009c9", "comment": "Malware payload", "value": "8461bb0acc54ffbd34ed63fea2987d88872bc466355920a432afbdb3d84d9c0de8c8ef0edb448cf43834abdc83050546", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559583, "uuid": "45f810a8-379f-4722-81f6-d5734d361202", "value": "T1C2059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559583, "uuid": "aaf8a82b-f08e-4e2f-9479-744836e5b050", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559583, "uuid": "f6f9882d-960f-4e07-9347-930eaa996739", "value": "12288:V20BXOMcVzpWfmmnDD2X5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDSX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647559583, "uuid": "fd129610-7f22-465d-b0a5-278b4ae95954", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647559583, "uuid": "c78520d4-abc0-47e0-8817-037cdc00143b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559583, "uuid": "1462c984-45f6-4e7a-9bcb-806ef765ad74", "value": "5e464d6c839bb616ae5e92ac8b7c26f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f4ab95-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647518533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518533, "uuid": "369e1fb1-4aa5-45ee-a69c-0b2cc0835d9f", "comment": "Malware payload (Heodo)", "value": "a63cef9ac7fd095953c62235bec73ea1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518533, "uuid": "6ba1f43f-317f-49c6-b9ec-b23b5d49af66", "comment": "Malware payload (Heodo)", "value": "ea2f40034708a10661eabebcb100712b04fb8c04e0107664e18b790dc595927b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518533, "uuid": "23876f01-26dd-495b-9b37-8da1f48a1bed", "comment": "Malware payload (Heodo)", "value": "2253e3b657a2b438ba7ec60a080ebc656263d288", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518533, "uuid": "91879e26-f4ae-4fc0-8a21-362e642e24bb", "comment": "Malware payload (Heodo)", "value": "810f699ad38318cd60c24c3a41337827cfd264b7ef646728096dc96c5c8c49e804e621dcd79716247223af21f2877678", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518533, "uuid": "30eda63d-b2eb-4786-a97e-0da1823c1998", "value": "T153A2BF3FD132981CE67F987C430440F6E70A1D86600765EE2C45F26E66726B6038FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518533, "uuid": "4c12fa7d-9132-49fa-a571-5b01747ca98c", "value": "384:EHTyVb1GNjyo4CGzPd6ZIwGdKb5CzgObff9kC+xbX7zUSA:wuIN+o4FLYCBn9kC+xbLzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518533, "uuid": "6b345c52-00fd-4256-8e7a-fee4e124eb47", "value": 21444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518533, "uuid": "7ecec992-89c6-4444-b23d-17da45d7d45f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518533, "uuid": "1c17d6ab-9f20-4f41-860d-0738020a050c", "value": "Angebot-BONKU-627695.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26211e9d-a605-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647530158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647530158, "uuid": "e27b8e6e-e7e3-4b3f-9ac9-24f3319ac8a7", "comment": "Malware payload (Formbook)", "value": "2e35c88e2645b91d28293b10f1d5ba7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647530158, "uuid": "b9ecf4ea-6f1f-4abc-8a33-1befb16bd4ee", "comment": "Malware payload (Formbook)", "value": "ea816c6cab43420b789f780a35e40db03db4c63769122cc2ae2bd3955f6f9938", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647530158, "uuid": "708b0daf-8951-4a31-b46f-e2ea4e966053", "comment": "Malware payload (Formbook)", "value": "f99ea7dbc78d805664a90a2f0c839e1943f7f6ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647530158, "uuid": "43caf2a3-84a1-48a9-8f49-97942269d15a", "comment": "Malware payload (Formbook)", "value": "6cd23db445b67f4c865c2d858048a94670549d2aaec6e6e3b4c0f45a2c273a9163e2262a3c28186516558099bd5440c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647530158, "uuid": "f22e4d5c-ab66-43ac-b268-15851949bb2d", "value": "T11CC48C3E456C6373C97BD7758A51102AF691D1EF7902AD19EE831B800D231CA7FC6A2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647530158, "uuid": "49b0986c-e451-4e74-a341-20bed331735c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647530158, "uuid": "4ee4830c-40a4-427f-b939-58f556178bd0", "value": "6144:7uxWy/E+/IjnZ6I7vQnzKfnYF9DScbmkinvw1Ryq/D+WX2yTfS:qkywx7vQnz0YWc6rvW/SgfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647530158, "uuid": "c763227e-148e-4eab-86ff-e8b1788120c7", "value": 557568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647530158, "uuid": "ebadb36a-1f40-46c5-ae39-000942fefb7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647530158, "uuid": "2709aa78-2e62-4fdd-882d-714c151c5775", "value": "SCAN DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc6ba6b-a613-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647536291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536291, "uuid": "4d19360e-df33-4d54-93e6-9ae1675aade2", "comment": "Malware payload", "value": "ed77e6ba6b12bd21db5bb1749bafbc8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536291, "uuid": "bdf52315-4210-4f20-bd41-137fb150f967", "comment": "Malware payload", "value": "ea983c681793f263fecc36f9b6f4239f0b686b558ba8c5171df24f919213d917", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536291, "uuid": "81ff5e45-3dd9-4e64-bd92-33f6597be39a", "comment": "Malware payload", "value": "37e200bb58631d6f0ff63289f5151ab1370b0c04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647536291, "uuid": "27d040a2-00da-41b9-8dec-4f8e74772f11", "comment": "Malware payload", "value": "d20f9d166162ae87baca424752001bd8c0b60408814f2aed644436783e1f9dd38ea89bd1a7053c520169c54324c1d393", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536291, "uuid": "36f6c2c6-8a31-4d04-b582-fd34600e30fc", "value": "T11863CF812F94E82DF66E0D31B7D6D0176E30A3816D6289152F7A909B2CA338E1EFC51C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536291, "uuid": "4f471d91-c7f5-479d-875e-69beedfa9660", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536291, "uuid": "ae8c548a-7914-47dd-8d85-e30b4572e41a", "value": "1536:SmX9NKwuDUaQl+kzdC9GiZQWSwi/fUpS/fX/MNAASwz:9Qwuis1Jy///f/MCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647536291, "uuid": "5dbe5f0a-b31b-467d-bcbf-e3e2a6b22a6c", "value": 70728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647536291, "uuid": "6e12fa4f-a0b5-41b1-9ac6-b3c627dd96b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647536291, "uuid": "9d7f29e2-dff7-49a0-ae82-b9f49fb5460f", "value": "33586405.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73b256f-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647518805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518805, "uuid": "d8f92fe6-eefc-4c31-af6d-f80f0519b124", "comment": "Malware payload (Heodo)", "value": "d3912c9e8aa4790024271afa2d17a7f2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518805, "uuid": "eaf0ab28-7012-4562-9644-c20b904666b4", "comment": "Malware payload (Heodo)", "value": "ebfd1b9ae4bc2dc0230e0b448dc1fb4624cfaf2780756c11e8b5230289e7424e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518805, "uuid": "79bc1af8-64b8-495e-b694-c7e545518756", "comment": "Malware payload (Heodo)", "value": "1a84368c9c3945025c09b1686860b74d5eeec379", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518805, "uuid": "43a78208-fe92-4bac-a592-ab13251fe83b", "comment": "Malware payload (Heodo)", "value": "018632906707e46da4c157722d421a5ea897a591a4775dba709f927486d843fc4963d768f1df69a48a3d54e486787b48", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518805, "uuid": "db98582c-3d54-40eb-89ac-8ae1a3139e15", "value": "T17DA2BF3FD132981CE67F987C430440F6E70A1D86600765EE2C45F26E66726B6038FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518805, "uuid": "756756bb-a228-4fac-b62e-cd6b3a06291b", "value": "384:oHTyVb1GNjyo4CGzPd6ZIwGdKb5CzgObff9kC+xbX7zUSA:cuIN+o4FLYCBn9kC+xbLzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518805, "uuid": "fe47d4a9-41e6-4297-9e07-b8e54ad3ab91", "value": 21444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518805, "uuid": "a9672c79-924e-4a34-8308-4839a064f0ce", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518805, "uuid": "ff6e0afb-bc87-41ee-be73-94b97964ca80", "value": "Details 2022.17.03_1122.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47965404-a64e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647561568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561568, "uuid": "8a586a50-4e4c-474f-9cae-618e06c596cd", "comment": "Malware payload", "value": "fbbb56abc38e9a852a711586cef5f26f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561568, "uuid": "4342cccb-6c4b-464d-af9c-042b781ba832", "comment": "Malware payload", "value": "ec33401cad5198813944be5596504f7fd86e77d1f5960e2526a4f3c1b5211643", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561568, "uuid": "8e30650c-75f8-4327-a70f-ec980a0810b9", "comment": "Malware payload", "value": "41a296467a2dd57756ae0c264701b5a482308035", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561568, "uuid": "c276c6b2-66ca-40da-83fa-3fb54e045c97", "comment": "Malware payload", "value": "bc37388cc3db60a046ca4a329b9000b3dbbbbdae6f411c4332ff9afbbc9abfc6c47c1093fe6af08663c8d1195ec2c846", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561568, "uuid": "3c6a4e7e-3184-4b20-8936-300e172ba345", "value": "T1C8059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561568, "uuid": "04624da1-a583-4b76-87ac-51eed4bc865c", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561568, "uuid": "29a77805-9df0-4fb2-945c-219fc597e8c7", "value": "12288:V20BXOMcVzpWfmmnDDFX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDhX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647561568, "uuid": "9ec4df70-bfcf-40b3-8e74-95e9e4407b80", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647561568, "uuid": "49b2609d-a0bb-4b98-9977-3065bbd989e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561568, "uuid": "51eacdff-3a1f-4bc7-b5d2-d1ee2f33029f", "value": "fbbb56abc38e9a852a711586cef5f26f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a2a60a-a5f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647524413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524413, "uuid": "3ccc41af-20ed-46a1-9c89-5389a32b0ae7", "comment": "Malware payload (Formbook)", "value": "240f72ba898fd62267183f00c67e8a44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524413, "uuid": "dff502ab-3d85-49d8-8860-01470dbf4622", "comment": "Malware payload (Formbook)", "value": "ec56eaed4e42de73eb1f44c29d4a43bdadc6e4b2ad38456d62d7e81675469a5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524413, "uuid": "19200a8f-77e4-4f2d-aea1-0c55a7cc5eb2", "comment": "Malware payload (Formbook)", "value": "0ceac77310a375a245f77c886f036c5dcb3d1196", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647524413, "uuid": "5175a9aa-a991-4b68-a2af-3fba43958ce5", "comment": "Malware payload (Formbook)", "value": "8ac068d5de0ba37e20eb84263dd371fc563326d7ba25e600eaabcaf1d834564fb1af823f5a456deea8212ff6c407725f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524413, "uuid": "d036bfdb-16db-423f-ad69-2fff9d873dd2", "value": "T13B33070A789A9609D6D4BFFC99F1A58652767CE10020C14FACF97F1AAA33323DCC525D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524413, "uuid": "6106c9bb-3094-4129-9034-61985e49d5b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524413, "uuid": "3ebf0e6b-acc5-4ad8-8ce9-accc441d1ca5", "value": "768:tcD5x14gFhznQUbYUugVxlmMwCK/3deVDg:tKnRjpV630VDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647524413, "uuid": "1e9dce16-21b2-4971-8eb9-c01c41643698", "value": 51200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647524413, "uuid": "f730d968-e2ce-4b61-b234-e7e05de2eabb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647524413, "uuid": "cd833af8-1c65-4a45-927b-a3896d307607", "value": "6024180.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9dffcf-a649-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647559588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559588, "uuid": "7afa2486-79b2-4bd2-aec7-b6e568b4f518", "comment": "Malware payload", "value": "4d72ca3fae5b38df7d930c73ecd6502a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559588, "uuid": "ed54f66e-d94d-4789-b665-6e67d047dc09", "comment": "Malware payload", "value": "ec70a0bb9eebbea0f2a0a99171b19ca40effd892f17b2f0b29456703f3aec393", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559588, "uuid": "f6a13cdf-f25e-4f89-a9ba-97363d13031b", "comment": "Malware payload", "value": "2d662201a37bc69ff481f7cbb17b6b57fb7f6e87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559588, "uuid": "ab01246c-d441-4a93-bdba-5922911baedf", "comment": "Malware payload", "value": "2cbc870bf4a6b813bb49e098a49b3664d0cc8c38b026fb3f18712887eefabb0f3f1be734e61ee76f7d48ffd191f6367c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559588, "uuid": "7be70560-8c4c-4792-aa48-b673ba487e07", "value": "T147059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559588, "uuid": "00b9f30f-89b3-495a-acd7-f8c9b0f35c5c", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559588, "uuid": "cbba5b65-b97b-4dce-bb21-f4762bb2a04a", "value": "12288:V20BXOMcVzpWfmmnDDyX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDuX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647559588, "uuid": "47ebb268-76bc-41dd-b161-3218a7e49717", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647559588, "uuid": "44ab5db3-8fe2-4673-8cba-223c97cb5e65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559588, "uuid": "3f39e057-588d-43d9-948e-d25579dca51c", "value": "4d72ca3fae5b38df7d930c73ecd6502a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f334f5c-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647518711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518711, "uuid": "be99b787-499f-4418-8d12-3d454eeb8162", "comment": "Malware payload (Heodo)", "value": "e20c93ab0804b6c7b6e0ad9c6d1e770c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518711, "uuid": "7dce6f79-42d2-423a-9401-9a5bd6828dae", "comment": "Malware payload (Heodo)", "value": "edc9117aabb326b99df858a1e8a003ea83b4d4504b8816b21c4f51d46f67a286", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518711, "uuid": "2c9d9407-7c6d-4b1c-9ae5-93293026e56d", "comment": "Malware payload (Heodo)", "value": "9b900586d9f93ac31217ed7850dd07d5dad5dfbe", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518711, "uuid": "a8d2c72d-15ec-4345-b0b7-983ed9671b85", "comment": "Malware payload (Heodo)", "value": "886052574551861085a22abeef2da811eda0a79a4102696b0257d66a7f4f2d2d4554fedf3905c82c225814e48043527c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518711, "uuid": "a72c62ca-b76d-4ea6-9393-e05dec9d74f6", "value": "T18BA2BF3FD132981CE67F987C430440F6E70A1D86600765EE2C45F26E66726B6038FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518711, "uuid": "da1ee87c-44c4-4527-9861-dc62993d6aec", "value": "384:0HTyVb1GNjyo4CGzPd6ZIwGdKb5CzgObff9kC+xbX7zUSA:guIN+o4FLYCBn9kC+xbLzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518711, "uuid": "710167af-827f-458b-8847-c141220aff34", "value": 21444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518711, "uuid": "cd84499a-120b-4b0d-ac01-fd27388fdbf5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518711, "uuid": "cb682aab-4608-4e79-9d04-83a99b1f266f", "value": "Frage-zur-Rechnung.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a81740e-a5c6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647503215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503215, "uuid": "7bf4b051-1dcf-42f9-ad6c-f98d4576f0a6", "comment": "Malware payload (AgentTesla)", "value": "d703a7363c8bc855ad83d9b5f9868918", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503215, "uuid": "c0ea98ae-f802-4765-8dc5-ae2656deac73", "comment": "Malware payload (AgentTesla)", "value": "ee02fd2aa84bc7c690af4b524bb3c30b9af3f81da461c9a792369a8ecac7e0c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503215, "uuid": "492d1f2c-844a-4f92-a2fd-249d6a98dc86", "comment": "Malware payload (AgentTesla)", "value": "5cc61e70fb9968fe3e4000ea9b8255b4f7b15687", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647503215, "uuid": "53dd8ac5-d677-4e2a-8b37-dd6d39fd18c2", "comment": "Malware payload (AgentTesla)", "value": "e7e4e8a2285e5f92c2382b1b55a2c7fc8c1651f031f1954acc7ca250a0dfdc11f78fba74ec3565e7f0dfbb94d370b72f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647503215, "uuid": "5cb9b051-1f8a-4771-95b8-587adfb7328e", "value": "T1CEF4E14633754AD2D8794B344422C32CDFF9DD24D31AE36A2CC6749A6D72B8B0E81ED6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647503215, "uuid": "b2556bee-9d5a-4145-a5bb-d2ecc44bf919", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647503215, "uuid": "7c7ae293-d9b9-4179-99a5-0539c3456ebd", "value": "12288:Fs9RUcZ64AQlRpKO+7Go55/MwgYwRKM4yzyoZD31QDcR8W6szcQG67S+9Gf1NyK:CLUXD/KYAt3iu8W3z7G6G+4f9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647503215, "uuid": "9eab82cf-8df8-4ffb-9d33-b8f448cae020", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647503215, "uuid": "3725fadd-2d86-47d4-8636-4eb74f5b822b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647503215, "uuid": "e9d2e408-e7ce-4b20-8acb-e7244b48e8f0", "value": "STATEMENT OF ACCOUNT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "190a9575-a5ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518540, "uuid": "21bee58a-ea8b-4608-aa90-43d826c39a28", "comment": "Malware payload (Quakbot)", "value": "de02ffae3c955995923b460f4fc44987", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518540, "uuid": "97571282-6e3d-411e-8531-5f97dd5ceec0", "comment": "Malware payload (Quakbot)", "value": "ee1da463bd85a827c113fd3ef963ea5a758c41f2af1acc4890702ea255171f06", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518540, "uuid": "1956ef0a-26bc-423f-a0cd-0f757346cf3d", "comment": "Malware payload (Quakbot)", "value": "29961c05b5900132f3255f368398a4987e783e7a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518540, "uuid": "050b720d-fd6d-4eba-8ab2-6cc55f071f84", "comment": "Malware payload (Quakbot)", "value": "fb32825144a79f7571b1662c89131e4f4ab81974f5d81b520bd6df670c3b29f046ec8e7a97f023c3707bde388b5fc8f7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518540, "uuid": "aefe351e-c251-42be-990b-573fed4f0e15", "value": "T14915BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518540, "uuid": "71d93641-6ff6-4904-bb28-9a6ccddf0977", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518540, "uuid": "dfce361d-b32f-4877-81af-7b976b67781b", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518540, "uuid": "135be55b-a902-44e4-bbfb-1f0180a26d10", "value": 951701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518540, "uuid": "ccdac1f6-7001-4b04-9797-5fa658820e85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518540, "uuid": "02ff3f7e-52cd-440a-bca1-ff05c5d8cdd5", "value": "ee1da463bd85a827c113fd3ef963ea5a758c41f2af1acc4890702ea255171f06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae854986-a649-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647559593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559593, "uuid": "a4f14bfa-14fe-4c9e-8180-2a40c202c359", "comment": "Malware payload", "value": "e196dde40a5f7238aab1d3bbf83f6c6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559593, "uuid": "6cdfcdc9-85d4-4ac4-8ea0-ec1462a5ef7b", "comment": "Malware payload", "value": "ee48427648e6cd92c34f30581a901872246d0cd63c465ba66a333fa0c30de7b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559593, "uuid": "c8ea2d1b-e431-420f-a3dd-7188554369f1", "comment": "Malware payload", "value": "52d5f2c44c2faa9c575181318d32089b2c61b87d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647559593, "uuid": "d43c70e8-cc95-4257-8a8e-e02018d55efd", "comment": "Malware payload", "value": "223a44f6df83b288b77b2ee4269cf7c0cb1503d740e102e7be8c29971a67f6a2325276534a9027f413c7c3f0bdf0d445", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559593, "uuid": "10f6aeaf-cc89-44ef-805c-cb70a8bbc961", "value": "T1DA059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559593, "uuid": "43b97ef3-5c68-4c93-be56-3318d727adf5", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559593, "uuid": "f4ef9b91-c8fa-458f-acb2-3bd11aff14ba", "value": "12288:V20BXOMcVzpWfmmnDDvX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDbX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647559593, "uuid": "5606876d-3b6e-428d-81b5-6c42dfcfb92f", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647559593, "uuid": "3a91e9ea-066c-40da-9850-550aa6306284", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647559593, "uuid": "3fc169b5-a7e1-4279-a483-a38500d0713c", "value": "e196dde40a5f7238aab1d3bbf83f6c6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a17465-a5e5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647516635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516635, "uuid": "2434240b-657a-4257-808c-0aaba82ddaef", "comment": "Malware payload (Heodo)", "value": "06e4b7e1f9272ef2e7390609a3f7726a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516635, "uuid": "22983e9a-9e1c-44a4-a62c-79eeb3c80745", "comment": "Malware payload (Heodo)", "value": "ee5d5fc3e28980280791abe123d74de70c9a6100aa9e62bca0677b99897663ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516635, "uuid": "520a3e3c-798b-4d36-93aa-5b2eb02cb60f", "comment": "Malware payload (Heodo)", "value": "ad4dca2512a055cecac08cdd3c0dee44c006f739", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516635, "uuid": "0d249edc-b8ad-4ce7-a36d-61d359cc9032", "comment": "Malware payload (Heodo)", "value": "abb60555b89b0a65dbe98d7774793f30eac087815fdfaab84a876123484e07f66618a2585ff9fc8c6f3a5a3cd9ebc20f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516635, "uuid": "6061b129-4734-475b-8db6-1bcbe6ef98a2", "value": "T14F058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516635, "uuid": "a149a8f4-f698-42c2-bcf3-73118b487201", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516635, "uuid": "f37ff052-76de-4360-953a-5b2a9337559f", "value": "12288:Wvz1CLJyyvmMLSrBgo4ruGbPlVpqb+DlYzv:WJCLJyybLqBV4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647516635, "uuid": "6d7e041c-dc60-4923-a65c-68737849d037", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647516635, "uuid": "28d0bb2a-d363-41d4-95d5-933e8a78c133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516635, "uuid": "9152921b-11ee-4259-b7cb-9c36514c0343", "value": "06e4b7e1f9272ef2e7390609a3f7726a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d21fd79-a5e3-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647515648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515648, "uuid": "d5e4936e-7c81-4228-b805-199ed36093e4", "comment": "Malware payload (AgentTesla)", "value": "d0172caffa04fa7b5e0a0cc80d429f90", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515648, "uuid": "19dc10e3-437c-427b-b80c-6f515401724e", "comment": "Malware payload (AgentTesla)", "value": "ee61d9ef7a173258abdeb2d261276de1ff1c5386b9328c51a92b0f805c5462e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515648, "uuid": "1a1689d8-9aae-4e47-a211-17a8c817a154", "comment": "Malware payload (AgentTesla)", "value": "aeb16b1ff4fccc8048554d5083382173498d4571", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515648, "uuid": "06d9c769-f6c4-4b73-83ae-525ead0bcbb0", "comment": "Malware payload (AgentTesla)", "value": "e61b0d3ab383f87604778997311f80b072e30063bab989185f88461bdb473075de99acecd810abf43b6ffb9db3e1cb06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515648, "uuid": "ecd88062-1a06-4192-8db1-37974db2c47e", "value": "T19DA4597E04A99337CE7BC2328690541AF691D1EF7912AD29EEC31B810D175CA3FC692D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515648, "uuid": "06a013fa-d070-4c21-b592-5b268b6440dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515648, "uuid": "c3d6cc85-df79-4f2f-85d6-fdd1a839e05e", "value": "6144:/vc1yQzmrQosqJDqWvS4ELOwtDHiYcGjtsaO+1jpOiXf/pADgNIPP3MuwBa:/k1qr0q51cOg5pOaO+1jpB/pogNEMum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515648, "uuid": "4cefb4ce-b59a-46f8-94de-cb9d28b3ddd1", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515648, "uuid": "f7027119-a5ad-402b-a345-d92ea6ae970d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515648, "uuid": "1197d961-9143-4d84-abd1-c1847f108982", "value": "Shipment Docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5afbe0f3-a5f6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647523804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523804, "uuid": "ec2fe435-2d3d-4d05-9626-be888ccde48c", "comment": "Malware payload (Mirai)", "value": "ab79574688fce1c1a9515de884441f10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523804, "uuid": "4974250a-7e19-49bc-9cc9-a5a842533c42", "comment": "Malware payload (Mirai)", "value": "efe76083b71c6161399f9cca839353a26d68a8671ac491f7b6ef03b3448e9743", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523804, "uuid": "cd02a08b-78a9-444f-a927-ee42dc44915a", "comment": "Malware payload (Mirai)", "value": "73d971eaf6d28bb6c9b42e07b476c0a7e3d494aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523804, "uuid": "7e09e6c5-af55-459b-88e6-fd9e7e1971c3", "comment": "Malware payload (Mirai)", "value": "7efece575a78d09de54e84927fe1a1b0fcfcebda0643ad895eec830fddffa0e94fb005e4aa36d65909b11334aac30f8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523804, "uuid": "a84650d9-7464-413d-89c2-e2885a953035", "value": "T15EE38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523804, "uuid": "4b3d2301-e5d6-4b62-b9b9-513005a2ea42", "value": "3072:dgZc9h1jlnLA2PiXYeyCc/VNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZ/VWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647523804, "uuid": "36322c57-1b99-4430-ad79-e7dab215307a", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647523804, "uuid": "c2d794c7-faa2-4933-92f7-f361f4eb7a03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523804, "uuid": "d404fe40-3b32-4898-8741-7964fa4add45", "value": "ab79574688fce1c1a9515de884441f10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d7ea48-a5ef-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647520877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520877, "uuid": "88725dff-2582-48e3-a5ab-12b83e14e9b6", "comment": "Malware payload (Loki)", "value": "40ee16a8b1fb23248a99841588413a39", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520877, "uuid": "6e8c2cdf-f336-43a7-8351-037848f8892e", "comment": "Malware payload (Loki)", "value": "f0966d6b4ea87bd34fe0765d0b0f053908fdcdc840cc271f670a521256694da8", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520877, "uuid": "082ce73a-925f-44a6-9308-1ef09d0b259e", "comment": "Malware payload (Loki)", "value": "ac3e2effdaeb47401603b875fe91c54d2fc1fe05", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520877, "uuid": "1e85e0a3-2529-48cd-80ee-4df76781c856", "comment": "Malware payload (Loki)", "value": "1bf0f355f4b809c7aef8f67618970ce206507c2d5722db4521bb04cdc9d0b80aae0a157943500d9571e34d4ee94e7f32", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520877, "uuid": "79a8d444-4cff-4e13-b9a6-0c46385d47b8", "value": "T18C041247A412FC61C962AC7CC5269015D284BA0CE4B5C01DA174E3FEBBE92DB5F97B8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520877, "uuid": "5898c381-d4b5-4d9f-807e-c57bcabfe998", "value": "3072:xTFYRDyEsfM3jQ29jH2tYiUiL4z3o5q1mTBOQvqmL7RoaQutBguM/xSVFW6h+g1b:xTeRmoDNMRUiLqx1gB1IaBI9/2x1ngMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647520877, "uuid": "a10d5d92-f020-4925-ac3b-58a64724d8eb", "value": 184389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647520877, "uuid": "21256ecf-0616-49da-8af7-9607e782b920", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520877, "uuid": "012f687f-54dd-458b-8e43-003f50a4df2e", "value": "Bank_Remittance.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a6e533-a5f6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647523814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523814, "uuid": "a2f79da4-1d22-4004-b7a1-9a95b122e874", "comment": "Malware payload (Mirai)", "value": "57b4ff1d7dad0d3d2d9622911df27266", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523814, "uuid": "07fb3a14-0d1c-42e5-b2ae-44f8f47e18c1", "comment": "Malware payload (Mirai)", "value": "f0af9a7f47fa0660f95be413ff6b89c2f621d4f8fda0dce0a4d911f1dd48e7dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523814, "uuid": "bf703e34-4105-4e29-9997-03f5c64889d5", "comment": "Malware payload (Mirai)", "value": "962abab9f2a4e2f871c6c221033d6447649c9b31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523814, "uuid": "5db20269-dd4f-4d84-91c1-90694b301d16", "comment": "Malware payload (Mirai)", "value": "53356e7764c6c1fc95626331fb0dc8169f0e5236698d56d30b45c8dda74a98070819f41ec2954b8f4ecc7ef3a48dc6e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523814, "uuid": "c66b2233-a62f-469b-b7e3-8f64f1585343", "value": "T17BB31A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523814, "uuid": "43ef0c32-0f82-4079-8b81-469c5bd577b7", "value": "3072:pC/4rdZHsXsZwwR9XNk5mm/QcuLmHniPNb:pCwrvHwsZwY9XOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647523814, "uuid": "d0176d7f-5db5-42c5-9327-e992995ca027", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647523814, "uuid": "5a2694fc-caac-4bd8-9f9d-0305c2d79023", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523814, "uuid": "21f9dbf2-f3ec-46d8-838c-f094de44ef2d", "value": "57b4ff1d7dad0d3d2d9622911df27266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2d9f44-a615-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647537173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "a4ff8d0f-b09a-4c26-b92b-77e7d2f7a874", "comment": "Malware payload (Heodo)", "value": "ae7e95687db3d4733f06047fffebc7a3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "6c069e14-eea2-4830-926d-14acc2442cf1", "comment": "Malware payload (Heodo)", "value": "f0dda49f095e9f492cf4f3a544e2bfbfee3c20396ac6f5989cfe1afaf830aae8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "a5a9b670-3f24-4ea6-b2b1-a48db280367f", "comment": "Malware payload (Heodo)", "value": "23e41c5d839c5aa061524dd23f3847176a461506", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "4eaf80dc-5603-4fa4-86e3-7dc767fb56c6", "comment": "Malware payload (Heodo)", "value": "d8ef59c33bfcf1059aa6d2db5ba119dd6e167a20a6aa311ebd8c2376c1a7345b2712cfe508143e45a4622e22399ab2bf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "508b52c1-2e7b-425f-8e0b-0129361c4760", "value": "T143057C5037818037E7AA58740601BA783D797BE38BBF72924E80957DEE704C3C768B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "71594963-bb25-43e9-ab46-0b867008ebfb", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "6335c6eb-4b0a-459f-9197-5c99d9b1891e", "value": "24576:xJjq8sc5JGxNNNNI+++++h3/UQUQiSj5URW2AeF+99V3kW5Qk45:xJq8s4uNNNNI+++++h3/UQUQLv2AeEB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647537173, "uuid": "bfa9ced5-352f-457b-93a1-e84d4ff556fe", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647537173, "uuid": "4c6705f3-f5c0-4d71-829c-87f3356557fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "cfccb51d-4d69-47e5-9d42-19d1b7068580", "value": "emotet_exe_e4_f0dda49f095e9f492cf4f3a544e2bfbfee3c20396ac6f5989cfe1afaf830aae8_2022-03-17__171246.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e314bd66-a5e4-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647516302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516302, "uuid": "2dee0ece-bc91-4b44-8fea-2361acbfffd9", "comment": "Malware payload (AgentTesla)", "value": "161d29b294dc41b48fbb06153a102fe3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516302, "uuid": "a3db7470-50cf-4d26-9dca-ab2af837030b", "comment": "Malware payload (AgentTesla)", "value": "f0f4c454391ffa16bd4ce2a5c5039011791f5233e4bfa2a4b933b619f3f70ab1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516302, "uuid": "ae4f34be-8571-4c45-a790-a6fe3196bf75", "comment": "Malware payload (AgentTesla)", "value": "4c751a3e165f001d1c2b44333f39f1a82b291da2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647516302, "uuid": "3bdc5e58-fcf9-4b2f-82fa-efaae527eeae", "comment": "Malware payload (AgentTesla)", "value": "3e7d065bb8010f9ceaaeda01a805f3a4c31a2c81238ca96a1b1cca5aee7964ff13713cf1dcce91180612f54da0ea88dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516302, "uuid": "a2aab050-69e8-4c85-90a4-f40b85ff2c88", "value": "T160F1E801E7D8873BEEBA4B7218676341C730FB134C5BDF1F6888521A7E217941563BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516302, "uuid": "32a8d584-bbfb-4198-a957-03a1c5b2ac01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516302, "uuid": "ab5a45d6-68a1-4013-9c00-519a7c112d82", "value": "96:xL+j2MCR6MTZQ9JBNLoSkA1vi0gPj0uhtlH0oY30e91x5ycWaDtrrQozNt:IhCRPTa3v1aTP4uh7Hs1Tyc/DZEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647516302, "uuid": "fc265ca7-b38b-4407-8d42-9e372285a87a", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647516302, "uuid": "2468a568-1740-4bbc-98e7-0adea14a7f68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647516302, "uuid": "ad6bbebd-eb83-4743-a0ae-105230a1580b", "value": "POJNJ172022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d0db69-a5d8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647510768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510768, "uuid": "dd43499d-5407-47ba-b2ac-46734c3deec5", "comment": "Malware payload (Mirai)", "value": "95804a79242c85a0df09ccccf5ea6019", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510768, "uuid": "38253c7d-ba96-440b-b8e9-8032994228fc", "comment": "Malware payload (Mirai)", "value": "f1b8675dd6234343ef97f3ed321f4541d9d4a6f2e890b6445365ccbee144c7b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510768, "uuid": "74f55cd1-7ff3-49cd-86e2-a31723302156", "comment": "Malware payload (Mirai)", "value": "c4b3fc8c67351d21d923fa054c6a2369533c7b26", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510768, "uuid": "e8cf8637-174c-4435-a3d3-4c444fd1b6f5", "comment": "Malware payload (Mirai)", "value": "60b016f02fd12d497b586f34f1d4d6cc0d4e6b1d5f09f6b70ee5292a69a117a56d028a0156b066f305ec0d35f7c4fb59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510768, "uuid": "aa2e8e48-ff66-4cf7-bbf7-63586b018739", "value": "T198E2E12AD3CD9DF2DBFF81F2183B6DD17B5044CA7A53D7D08616AA04D8429232607DE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510768, "uuid": "e294579e-b212-4609-90f0-b33bf0627e2b", "value": "768:yPr4JFEJEWelrD5/lYnHbuC6fTER6xWTPlr4uVcqgw0RTWXJ:yEJWJ+lZ/lYnHOOtr4u+qgw01WXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647510768, "uuid": "d59a759b-ccf3-400e-b0b2-a4dcc9d728cb", "value": 32432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647510768, "uuid": "d65703be-73d9-44e7-9787-8837a7506b96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510768, "uuid": "6aab514e-0df6-4ec3-9b24-443224e12da6", "value": "95804a79242c85a0df09ccccf5ea6019", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cadffa11-a5eb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647519268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519268, "uuid": "bb18ed6c-2131-4bb5-8af6-a1cea91ef9e0", "comment": "Malware payload (Heodo)", "value": "752e8f8071fcfc49557418def3ad33d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519268, "uuid": "77bafc32-b45a-4b11-8264-5c93e4feb783", "comment": "Malware payload (Heodo)", "value": "f29868be9117cdb16e0cef2469d5f277d2a8cf2645b3938a421c930a23ceccd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519268, "uuid": "5fa9ad93-5754-4263-be20-e470822911fc", "comment": "Malware payload (Heodo)", "value": "d1e56a21f907a949b6f7ca96b3a363007044c406", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519268, "uuid": "e00db488-e0c7-42fb-9ca0-e9356d5ee5d1", "comment": "Malware payload (Heodo)", "value": "7d69a6e8b7e1b74bc1983041532db7db759b1e87c137ccc10f1e5cf14ee5d3dee69fcb3562b1e0a47849bd666aa0c74a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519268, "uuid": "c4986c9e-c7bc-49fc-b212-b06bcce6308c", "value": "T1AA058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519268, "uuid": "f13cdd94-cbaf-407b-ba5c-5cf409b9c49a", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519268, "uuid": "3c2ba8cf-703c-4ff7-a404-3f545de5e52d", "value": "12288:Wvz1CLJyyvmMLSrBgm4ruGbPlVpqb+DlYzv:WJCLJyybLqB/4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647519268, "uuid": "17944d26-04a9-4fb9-abc4-efd736c85256", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647519268, "uuid": "79ed5e9a-2753-47a0-9f2a-44345ba5cfda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519268, "uuid": "61e5da94-ac61-4f1a-a9d8-9c23721bf1d9", "value": "752e8f8071fcfc49557418def3ad33d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1061d7a-a5d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647510742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510742, "uuid": "1b8e6059-fd4d-43f8-9206-72cf55f8860d", "comment": "Malware payload (Mirai)", "value": "f2b299a06949d5bb598b014585fcac00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510742, "uuid": "9e43380e-14d9-4985-bc7f-e54dd2c4c693", "comment": "Malware payload (Mirai)", "value": "f2a00c28c1e16ded4128c5a595b85d4eeb55291f0b5d160993b5f0ea5b8cb590", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510742, "uuid": "f950aa57-6c1f-4549-9fd6-883a7d3f6704", "comment": "Malware payload (Mirai)", "value": "82d0ff6f777ca4e83a39ebebaef15436dce45908", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647510742, "uuid": "acedd388-536a-42fa-91b3-b8a018068299", "comment": "Malware payload (Mirai)", "value": "d507e1d63365fe95c25cb64a1e1a389923082b3764782c0f0ac2da14f8dff4a55bce5d2feda56e95a5e58ff9c905ec3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510742, "uuid": "679e9358-8600-4355-914f-41cb50433d6b", "value": "T1ECF2E103A397D089CDAB91756CBBBD2B8C50E50E059059AF5EDC3618AEE3A0CFD58743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510742, "uuid": "05f4b4d5-1c5e-41c5-8f6f-c3ff447cba32", "value": "768:OqwuG1vwI6wxYC/3+6qyOS3US+1XQdpbVtJ2i8PnbcuyD7Ufyqy:lrg16SYS3+9FS3USCXQvzJZ8Pnouy8qp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647510742, "uuid": "fc585834-babf-464b-896d-286b549ba5e6", "value": 35364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647510742, "uuid": "5cfde8ba-8f00-4965-88e1-dc414ad196a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647510742, "uuid": "7f9ac248-5219-458d-a12e-207cd75451f8", "value": "f2b299a06949d5bb598b014585fcac00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538b1b11-a5cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647507042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507042, "uuid": "ee34dc5c-41f2-4769-ac50-34284f1c7fd1", "comment": "Malware payload (Heodo)", "value": "f06bdc45c85eaaa75d9311d5348da544", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507042, "uuid": "cf8b0e98-4d01-4582-aa03-930a008f7507", "comment": "Malware payload (Heodo)", "value": "f42361c9d774c3b4e6bbe4a8902343c4e0d4fc44791d7f62234a3731da5e0a0a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507042, "uuid": "325c2bff-28b1-4cdb-a11e-14e1db40c1b3", "comment": "Malware payload (Heodo)", "value": "855f8fe1269f3531679b0649791673e3c3b07be6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647507042, "uuid": "94f41825-d82b-4136-9253-bfa7c81c983a", "comment": "Malware payload (Heodo)", "value": "dc7c037486b059f22ad7368cffba06db2699c6e12b9a286a79a6a35a666c8695dbe3bcc361fcba7e4c8188454a0c9897", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507042, "uuid": "48d7d25d-e31e-4293-835f-8c0faad0c777", "value": "T1F5A29E2CE921744DE3BB683C420650FA924A1C022147B5ED3991F77D6B73697068FEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507042, "uuid": "8ca621ca-740e-4289-b6ec-cd6526b75ac7", "value": "384:j3uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:HsNs/zXtFCBn9kC+xbL42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647507042, "uuid": "fc6ad1f9-01d1-4956-9c46-f3b1ec2f4af3", "value": 21657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647507042, "uuid": "b53e9894-2d45-456c-b804-78ffc2464633", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647507042, "uuid": "793c150f-b080-4243-8fef-8f4c2b7a6e99", "value": "Recent money transfer details.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002b49b9-a5de-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647513344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513344, "uuid": "79b3637e-342f-4b4e-a105-6ea7e09991a0", "comment": "Malware payload (Heodo)", "value": "6f4ca6e1b082c4fc66a0fe01dacc57dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513344, "uuid": "65989b62-a339-4bcb-8258-753e550470be", "comment": "Malware payload (Heodo)", "value": "f44668570cfdc87c702bde33204ba646f9d384ea5dd02480d05aac69ad133dca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513344, "uuid": "8aa3d33a-49ca-41a0-9fa5-e6df8868e8cf", "comment": "Malware payload (Heodo)", "value": "16c3c7252d95b4f4764c892358c06637339c8e13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513344, "uuid": "f44d96a2-438f-40a4-872b-05c966e1858b", "comment": "Malware payload (Heodo)", "value": "657260de341ea80b5e8ad93687f2b32e57eca3dac19b78649134771f0f6edd9881cba89ddd1fcd789a860b010333f8c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513344, "uuid": "f0d1f057-57af-44ba-a39b-77f1f9ba9be8", "value": "T1E3059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513344, "uuid": "18bc5bd7-f8fb-4cfb-ae58-c728c0365be2", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513344, "uuid": "18056b70-01fc-4b24-abd2-c58ea0c62e2e", "value": "12288:KVHML2QJe6XxhqCWKQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqiQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513344, "uuid": "9ce16890-eda1-44a1-aef1-520074cf3345", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513344, "uuid": "100191b8-df16-4947-9142-113f5f5ed16f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513344, "uuid": "9b0d5175-f87e-4b8a-91ee-9cd7c4c4f7b6", "value": "6f4ca6e1b082c4fc66a0fe01dacc57dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b3de6d7-a615-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647537173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "17585c71-7fdb-4cef-95da-3c574868bcdd", "comment": "Malware payload (Heodo)", "value": "45887c81f472697804dc5f4642aa5aa0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "968673d2-d265-4f0f-9ffa-2866a727356a", "comment": "Malware payload (Heodo)", "value": "f4b46ed4c73adb2432fdb9531f78eb1b4afd6d4172ab3cab85e273e5d0c9cb62", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "5a3072f9-1f39-4b55-acdd-a05782b98aee", "comment": "Malware payload (Heodo)", "value": "f72fcfd5e11f016e149a06ba98f6c8aca1754206", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647537173, "uuid": "b7757b4b-097f-4a27-9771-7117a630b57d", "comment": "Malware payload (Heodo)", "value": "7ccf7fd5a3b2e7ff49ea4f8bda322a43ab43343bd128568ed3feac2c2b11b09053cd14228dc8249a9225b1deeae74999", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "482aa1db-e7da-459f-a4bd-96cf20db59c3", "value": "T10B057C5037818037E7AA58740601BA783D797BE38BBF72925E80957DEE704C3C768B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "2a4bba0f-a753-4fd0-870a-3aee1425581a", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "ea4f06d0-191a-4524-918e-6916fa06fe28", "value": "24576:xJjq8sc5JGxNNNNI+++++h3/UQUQi9j5URW2AeF+99V3kW5Qk45:xJq8s4uNNNNI+++++h3/UQUQEv2AeEB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647537173, "uuid": "1679f446-ee03-42d3-ab5f-119b5f34aea5", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647537173, "uuid": "6f5d96ef-1f6c-4c4c-9f10-238ff752bb72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647537173, "uuid": "c78e679b-f764-4d3b-bcb9-bd45fc5219ed", "value": "emotet_exe_e4_f4b46ed4c73adb2432fdb9531f78eb1b4afd6d4172ab3cab85e273e5d0c9cb62_2022-03-17__171246.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8431af3-a5b4-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647495614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495614, "uuid": "f10f8844-1683-4ee1-bd81-021175544f73", "comment": "Malware payload (Loki)", "value": "9513468094a52c18b2f3761ac4907725", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495614, "uuid": "18566949-3df8-4bca-9976-0157fd6df622", "comment": "Malware payload (Loki)", "value": "f612027533094405c1a6dbd8a453e610e3405035b2b90a6415e4c983f7a2cb64", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495614, "uuid": "f2905c58-5c15-4f93-ab2e-0996b294b5e9", "comment": "Malware payload (Loki)", "value": "0688ed36307d4352e664ee502650ac741a2db04c", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647495614, "uuid": "5f7ddccc-3bfa-4a68-bf7c-07a008b06ec1", "comment": "Malware payload (Loki)", "value": "06b7a56b38ac9848ef7a2fdb2c05f8e863fd9e1a042fe181078930d063092acc3830ec21e30a03d0f2b1ff71fcf82fe5", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495614, "uuid": "30e152ba-4f23-4cd6-8c59-e8c6d024d93f", "value": "T11B716C09932792D941BC222F548627D339D9228832698062318ADC52417B6F98F9EE9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495614, "uuid": "9905b113-ed29-4a5e-9c04-a3005ac0fa6a", "value": "96:1vj+fiE5DDUmW8GAhxusm4V+nkgLhCELWZe0op3:VMlDnW8GkPV+nkQkop3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647495614, "uuid": "7685a1eb-ab07-43e1-96f5-c57594e546a8", "value": 3770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647495614, "uuid": "06317548-ddd2-4b2a-9c0b-b73a3b00640a", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647495614, "uuid": "6ffcf0a4-6535-4e60-afbc-7d81086056be", "value": "PO ONIMO 9636228.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd1dd0bb-a5e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647518439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518439, "uuid": "9724363a-f993-4293-997c-cb65d104cb40", "comment": "Malware payload (Quakbot)", "value": "cce51486cdd2556eb98b765b64db609c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518439, "uuid": "6b4e8bd9-442f-4c10-8095-d8035a5afbd7", "comment": "Malware payload (Quakbot)", "value": "f62c326f03d206b3427d6d00e551ed924efb255bb4adc620238c4e6e03ce55b0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518439, "uuid": "f2825712-9ee5-43a8-8b94-17eb400fa044", "comment": "Malware payload (Quakbot)", "value": "d7981c0ce85ebb4ceda4701fb7f487f51bc1c095", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647518439, "uuid": "a7c2f115-06e9-443a-b4a7-7f6509a9037c", "comment": "Malware payload (Quakbot)", "value": "9619d20678ac9e42b1100b2be5410963bd78c16b8463d6063d17449b629feef240ab74f83c7a8f81f6bf425541c14a26", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "DOD MEDIA LIMITED", "colour": "#BC7E85", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518439, "uuid": "bd94df24-2e45-48f1-a8f1-2a3aa84dd746", "value": "T17425BF71E3A014BFD1323ABC5D7F33599D253D012928C48967E96F0F4ADB981376A28B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518439, "uuid": "790bfa63-482b-4881-8339-dfe0f2a0ec9c", "value": "6ba0cdaabc3a2c72d338b7f8d0d0f8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518439, "uuid": "59d30c85-9101-463b-8ede-d9d78efe8d53", "value": "24576:h6BseOd1eQdn+Xz4oA9bDajPNI5zvpiGaT5H:h6toeQJ+rAdDa7alpiGM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647518439, "uuid": "1925b909-0153-4593-b922-dd4950c9b4ff", "value": 962321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647518439, "uuid": "91886903-c700-4614-8988-c98a17544a0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647518439, "uuid": "d8cb4fa8-2cef-47b0-a047-92d780c2fefb", "value": "f62c326f03d206b3427d6d00e551ed924efb255bb4adc620238c4e6e03ce55b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaddd74b-a61f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647541548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541548, "uuid": "1f16314d-6abc-4445-bd9c-c9c8a6d3d14c", "comment": "Malware payload (RedLineStealer)", "value": "1ed132d6d90d417e58b3c343aef001e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541548, "uuid": "ee394aa0-06e3-4d0b-ab16-d8fa25449294", "comment": "Malware payload (RedLineStealer)", "value": "f63d210b78dc2f326226418dbcb6aafb2176224115e20dbfe792c8d2ee66d796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541548, "uuid": "1b68a26e-4b7b-49f8-9ac3-aa145b03f725", "comment": "Malware payload (RedLineStealer)", "value": "12a91eb487c25f29c7926bf0192c0efa1a452ec6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647541548, "uuid": "db7e9afd-fe41-4ed5-bba7-f736aae3577f", "comment": "Malware payload (RedLineStealer)", "value": "e8fa508bd9a3ec164e607c8487c36b85dbce8b88666904ccf0b3ed0a6063be126a3ae566307e4e6bbbeab867d485727b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541548, "uuid": "b945e40d-448f-4c4f-bf49-3748ca4d1d32", "value": "T15A84DF40BBA0D03DE1B312F87D799368A93E7DA14B2060CB22D62ADE55347E0DDB534B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541548, "uuid": "00cc3e95-6b89-4e42-b35e-ea3be5bce38e", "value": "b017e9be8dcb33abe5f710031058b5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541548, "uuid": "6f683d89-0a2a-4226-98ef-032ffc2192ec", "value": "6144:2aVyHIlQBP0WmwK4plhMVvSl63OAjoCOpknp4lY5f30/pSt+v:2aGIlEPF5KOlgKl4OAjKp9lYh3AUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647541548, "uuid": "1ef556e5-d732-4daa-8364-f899427f9927", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647541548, "uuid": "d9c840ee-03f0-432f-9c27-e27a01dc0eed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647541548, "uuid": "b9154c0a-c241-48d5-afc6-e6f7ebdb4931", "value": "1ed132d6d90d417e58b3c343aef001e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c202b3c9-a5e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647515817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515817, "uuid": "58b1b0b7-77fc-4584-81d9-85ac15d22dce", "comment": "Malware payload (Heodo)", "value": "85b23dfa3ba3548d6df48d849f08cad4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515817, "uuid": "441ca09c-04e1-4f22-8c33-a00a94811bee", "comment": "Malware payload (Heodo)", "value": "f7151f548e141a0fce34e76a4a24c65e54fa44bfad57794ab53d02fe69003bae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515817, "uuid": "c8f0f152-b615-4a7a-ace1-64a527c4b49b", "comment": "Malware payload (Heodo)", "value": "503b538670ed422a8e3748081a4b84288ee8af05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647515817, "uuid": "4be1440b-d066-44fd-943e-d89149dddc7c", "comment": "Malware payload (Heodo)", "value": "c9de7a96061393d247498fa4f5e1103cef9b963e54d79743d5fa0f60b8fc1fb48cb421f135682bde397280fbc7dea99c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515817, "uuid": "00eda4c8-03ba-4469-b306-95873c5a8670", "value": "T1C0058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515817, "uuid": "7c4080bd-6657-4c18-bcd4-8f846bfbc147", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515817, "uuid": "e1dd0093-66bb-4d9a-a655-a041174e5510", "value": "12288:Wvz1CLJyyvmMLSrBgB4ruGbPlVpqb+DlYzv:WJCLJyybLqB44ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647515817, "uuid": "992880b5-67ce-44e4-91b5-980b8cd0b589", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647515817, "uuid": "63ea66a8-a72f-4f67-8073-9b0f8b09ca48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647515817, "uuid": "4c96cd27-46cb-4384-ba8e-a0e82deceb35", "value": "85b23dfa3ba3548d6df48d849f08cad4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771d2600-a5ef-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647520845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520845, "uuid": "c40eb657-e856-457a-87b0-3abdf23e868f", "comment": "Malware payload (Heodo)", "value": "f17ae261d4d2a9b18a70e6ade60fe5f8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520845, "uuid": "a1df71ef-db55-4f0b-b584-8dbb3ac27fda", "comment": "Malware payload (Heodo)", "value": "f744479f9903900438136774cc203c44c16b71ec26973509aef3aac0ee891a7a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520845, "uuid": "42c96a2b-656d-4f0e-b0cc-842457463525", "comment": "Malware payload (Heodo)", "value": "7a58f39ef793532b60b7ba9c6023d0cd8ca9af5f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647520845, "uuid": "935d9b82-f371-4779-9046-b043187e9ec0", "comment": "Malware payload (Heodo)", "value": "e17543018216b9d9771c302f4587a25cda494b2a0c3f38238fe1c593f0ec3d4753fd6520b0c5d41d6635d21c98c8f1a3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520845, "uuid": "ee85a6de-a47f-4866-b3fb-aa77d75ab561", "value": "T1CDA29D2CD921744DE37A683C821940EED28B1C067047B9ED3490B67D6B7B297178FAED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520845, "uuid": "823e486c-d327-4a5b-a9fb-45a148b80ebd", "value": "384:vhuAi/NjZS8EibbwBlwegASYrLb5CzgObff9kC+xbX77NWu:vtsNxzXQFCBn9kC+xbL71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647520845, "uuid": "32823dfb-8fd8-4dca-97b0-cd5dc946f1b7", "value": 21667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647520845, "uuid": "64bb4e6c-2fba-4b06-a0e5-fe87f777bcfa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647520845, "uuid": "d80bb5bd-cf2a-4106-8956-1bbd11a67f15", "value": "4517VRR-1703.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7fad7f2-a5de-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647513652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513652, "uuid": "2e895615-e459-4200-9148-7dec67b53eac", "comment": "Malware payload (AgentTesla)", "value": "2ae73e16fc4e875793bd3cc081743d9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513652, "uuid": "e10d95a0-9ac7-40ad-927e-24f625bc1b6a", "comment": "Malware payload (AgentTesla)", "value": "f8221d4ffae4d38465210c76fd7705734eb37ced44b1caffc3d65618515f2204", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513652, "uuid": "c6b7c8ba-bc17-407a-b621-4cf8dcd85339", "comment": "Malware payload (AgentTesla)", "value": "1d19afdea80d6b805b88fce96cb182d0fcaff469", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513652, "uuid": "ff59c43d-d39e-4e2e-9714-de809f856892", "comment": "Malware payload (AgentTesla)", "value": "e29b33de56afa0cf7a8d6500e302fd3deb0256d98587c715b66f303a2abcd565b0dcbbf9d71e5235a81534a78e412622", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513652, "uuid": "156496e5-9b4e-4c5d-80a7-5f6330edeb0a", "value": "T1364522197FB88926F07F47F0A0A315988BB07186A11AD36CDD8274F81C633D98A5F767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513652, "uuid": "ca12b4ab-7293-43cb-bbeb-c295f6601379", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513652, "uuid": "740a1fbb-974a-4f62-99e9-b6ffb0a5a4a8", "value": "24576:Cq3+99XY6mq/IvgH/mLcz/+EXw+HjOXXHF4onGAsUkxzPZvcJS:Cq3a9X7//OgH/wm/xvDOXV5YxKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513652, "uuid": "94f06a65-84b4-4280-a465-968202d567a0", "value": 1176576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513652, "uuid": "6969df5e-2ba9-4c57-82ef-79208e85e76f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513652, "uuid": "944ee056-233e-42bc-a1ec-57dbbf139161", "value": "payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5fe782c-a61c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647540358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647540358, "uuid": "0b845ad7-c2db-4052-9d48-29af48451158", "comment": "Malware payload (Heodo)", "value": "743f1823097a2ce32732e2d5da355364", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647540358, "uuid": "2071178f-1568-4657-9bc8-d84cb63bf230", "comment": "Malware payload (Heodo)", "value": "f883e2c37de87b0c1250cc03c735233556105fdd3058e52408b4a0bf34d428ab", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647540358, "uuid": "7678717a-d0a0-4e28-b03d-275b59cec26e", "comment": "Malware payload (Heodo)", "value": "6b4cdd1de13c7d9542725e18ca121d85bfb0cfbf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647540358, "uuid": "8dbd4275-90af-4f7a-aefd-c8d47673a268", "comment": "Malware payload (Heodo)", "value": "abad020f62c7103e47f8e48da61263f6a81a2288eebca6c71f10db4a4772d5069cf87ac2f3ee7e43adbb93f09632682d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647540358, "uuid": "cd9d6c1f-e8b4-4c4c-bd0d-6567d91f7700", "value": "T13C156C0377D3D4F6C6570B3701019A7432A67F628B63D1BB3AB0A97C2BF69D29624712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647540358, "uuid": "29fe6b2d-68d4-4d27-a50b-dc5b9d0592ed", "value": "a75fbf174f418163882037d6ea99f755", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647540358, "uuid": "d56c54bb-8588-465b-8623-baa83a99ef9b", "value": "12288:R8q2m092irmW0b0vW3ZYI3tNZzw2gYGly:R8rrr0b8LAj6VYGly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647540358, "uuid": "d4dd17f3-3026-402e-9f42-619c56ae308d", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647540358, "uuid": "3bca1d16-c2b6-42dd-94df-ec85dda187bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647540358, "uuid": "985e081f-f6b5-4084-8ce8-4f742ca892ee", "value": "emotet_exe_e5_f883e2c37de87b0c1250cc03c735233556105fdd3058e52408b4a0bf34d428ab_2022-03-17__180550.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523b6e40-a5df-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647513911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513911, "uuid": "1d325fda-1678-4371-86e5-39f67894b4e6", "comment": "Malware payload (Formbook)", "value": "5a6f8483c978ada3c9cfa14684ba7097", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513911, "uuid": "6e84e488-b0a8-4118-8119-ca1cac339a78", "comment": "Malware payload (Formbook)", "value": "f8912392c18231844c4e49111d668fab371e0854ce732571e0b171fdbd0758a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513911, "uuid": "c8e8f1dd-5a6a-4205-a6ad-8e73980d587b", "comment": "Malware payload (Formbook)", "value": "9222e8955398340e4c9d95eb873556573c81ed8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647513911, "uuid": "0b30e3be-e3cc-448e-8e31-aefad67de244", "comment": "Malware payload (Formbook)", "value": "ebeea58d13aa169aa29c3c20d30fdb036f8d31c3d4f945cdc1ec411f1a6cbf4d98db5d9bdc5f40af18be4373b154cbe8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513911, "uuid": "80920a31-e0e6-4fb1-84d1-6c405e02cc63", "value": "T154356CF2A2918432D42236388D1F5EB9B52A7D00DDE4A446AAE13F0D3F3D5B1FD21A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513911, "uuid": "afe97349-766a-4911-8f28-e32adc729d9a", "value": "066f2adf6884c84166ea572f3442e2f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513911, "uuid": "485464fc-1bb4-45a8-b615-04128615ea2d", "value": "12288:RbojJKNbgMwT2NRAvS/yqenMbJjRsBp8oziAO8Iz2sVW3MIqI6F3HAhcAszeVQ18:elKiCRAvS6qOMZGBNgzWqTHAhU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647513911, "uuid": "dd7db4de-78cd-4350-866b-bd6c7319b511", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647513911, "uuid": "95d2f36d-1144-4f2a-94b6-37b5ee0d8ba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647513911, "uuid": "b84c5eb9-73ec-473a-b85d-cc2a3a0438de", "value": "sat\u0131n alma emri pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59959963-a619-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647538834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538834, "uuid": "f4228670-0960-4b3a-8b1e-9c4b79dc4ef5", "comment": "Malware payload (Heodo)", "value": "0f318407b4729da77b1ccb333c1e5f7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538834, "uuid": "3e03ab4e-ca84-4f76-af77-6c7b0772a419", "comment": "Malware payload (Heodo)", "value": "f8b7361c22703eee405cee9f6652a42808fd27959dc9a2ae282d38fcaa585032", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538834, "uuid": "5430c326-91e9-45ab-b8b7-beb894b429e2", "comment": "Malware payload (Heodo)", "value": "a67698d5e1297a6b0a39e6c9ea76870e41ecdc66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647538834, "uuid": "d2ae64b8-9f7a-43cd-bf42-ec5d26d58548", "comment": "Malware payload (Heodo)", "value": "45075303dc97404cd14cb13ee5d8a69f635891c6b6011c14e1019cf30996cd55f7b5ad53db3f6c76e97754770d27f38d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538834, "uuid": "954f46cd-27ae-4025-97a0-982cca9f0042", "value": "T1D9058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538834, "uuid": "b2b750a6-f68c-42c2-8d05-8d3c3b1a0bed", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538834, "uuid": "48553b3f-ec02-4560-abce-cec748f9ef1a", "value": "12288:Wvz1CLJyyvmMLSrBgm4ruGbPlVpqb+DlYzv:WJCLJyybLqBb4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647538834, "uuid": "19199fc8-6d21-4004-89c7-dce40753257a", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647538834, "uuid": "15620e23-b687-40bd-9a5c-c5c85af08879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647538834, "uuid": "ee25fba6-89fd-423d-9ffb-232221c626f9", "value": "0f318407b4729da77b1ccb333c1e5f7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb710ec-a5d5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647509745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509745, "uuid": "8310ce00-d88a-4ead-aac7-a3b67d4ab4df", "comment": "Malware payload (Heodo)", "value": "10a4fe87cc0787d0a0a38dc00597a1d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509745, "uuid": "3d5a4d99-f338-4e6f-a260-ee029945eb9a", "comment": "Malware payload (Heodo)", "value": "f9220dc24761c0a95d63b7d3881b572cc62a145e721649dc06e6921784ef77d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509745, "uuid": "60240350-db37-42ec-b239-847b0b18a90b", "comment": "Malware payload (Heodo)", "value": "a4b7731e0920d3cd2469626be79eecc792491370", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647509745, "uuid": "ab18aff5-1d7b-46f1-9da8-fac63a61350d", "comment": "Malware payload (Heodo)", "value": "344dd28a74494f53f747fdd66e728c1d8621bfc388ad9083c80d9f65f2e832d0f915fa44253ed020a0f105574b6fa443", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509745, "uuid": "3ca62066-075f-4832-a7b2-fc8ce75014cd", "value": "T185059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509745, "uuid": "6bded1ea-2dad-45b1-91ae-30c94a7da510", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509745, "uuid": "be00cbc1-0540-44b8-a8cc-96e9438d5249", "value": "12288:KVHML2QJe6XxhqCWeQHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqWQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647509745, "uuid": "30ba779e-ea35-4756-a8fe-8c9a9a959f44", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647509745, "uuid": "dc752a53-992c-4b4e-8084-410d6d7c0286", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647509745, "uuid": "d533e00e-c8bd-454d-81d7-05bcf8221c09", "value": "10a4fe87cc0787d0a0a38dc00597a1d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1c7242-a5eb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647519355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519355, "uuid": "b46ab12b-c930-4160-9a29-690f49a36df1", "comment": "Malware payload (RedLineStealer)", "value": "a75b0d861406fa58b44b570e00ece6ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519355, "uuid": "22443973-245c-4ee2-9dda-82816b10d99d", "comment": "Malware payload (RedLineStealer)", "value": "f945f15ec2370ce91ceca2df4f5638581376d59a1579ad395a91eeb4b574bbd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519355, "uuid": "913881b7-b0ac-4cd3-b52e-f0d73813f1a6", "comment": "Malware payload (RedLineStealer)", "value": "671cce35752149cc26cb303dfd66ef996605c6e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519355, "uuid": "a402cde6-3892-4129-990f-fbc505a1c7b0", "comment": "Malware payload (RedLineStealer)", "value": "bba4b2f85570a083e3859aa0034c73fb93a65a5a8ef35a2911b64fbcb6c333914d73bca18deaae8b65fcfd41e7aed81e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519355, "uuid": "c8e46f83-1a57-4f81-86cf-3e7b378ac2d3", "value": "T11F84CF40BB90D03CE4B342F879B9D3A8753E7DA15B2554CB22E62BDA16316E0DCB534B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519355, "uuid": "be65f0db-f876-4433-8229-b2bfd6b6d92d", "value": "b472aaf48fca3ed6a184088234bd1425", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519355, "uuid": "564e6e0e-3a60-4aa2-aa83-a35f7535ed1f", "value": "6144:JIk+M7/dbv/5GXoVUlvvnOWHz2sgkj2oEf77MUytLMlI7Ur4C:JIm7/dbHgXmEfO22Vs2xoMlI7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647519355, "uuid": "601aa6fe-9468-472e-b5cd-3795ae479636", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647519355, "uuid": "2c6ae7e9-c6c8-4627-9d3d-6c9adccfab38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647519355, "uuid": "c687e73a-2201-4385-90a4-90b7c0bcd3ac", "value": "a75b0d861406fa58b44b570e00ece6ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a65a190-a5f6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647523777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523777, "uuid": "df3179f6-dc7f-4942-9fce-683763611b9f", "comment": "Malware payload (Mirai)", "value": "bdc75b878a3d9b6f0e36ad3a7237e3e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523777, "uuid": "8a30b109-a67d-49d3-9604-7f5cb3572d7f", "comment": "Malware payload (Mirai)", "value": "f9ef744eb7e148fc3bfb8b063c0a6ff1a6f0015560fe198c1f3a8fb1de7a25d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523777, "uuid": "f8c8b5ab-bae9-46b8-9522-a9845a3a4c6d", "comment": "Malware payload (Mirai)", "value": "3ab551f5daed0e02a5108de17f76339cbbbd07e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647523777, "uuid": "a62931ae-6f21-4592-b76c-4dd2b457e3b1", "comment": "Malware payload (Mirai)", "value": "33c3cc77b39bd10e9a57c1d1548a0237a891ba83f663be4506ede92d360e2839b81f01a83e819fe61377694ca6a60bb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523777, "uuid": "2e0ae08e-ec62-4c29-b22f-33209e696acb", "value": "T151A3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523777, "uuid": "88ea5d85-11d4-4360-af2d-a1e3e222207e", "value": "3072:wW8FUmgujld6Mkxm6AJ+4fjHmmFVcqq0GnDZT:wJFv4Lm6AJ+4fjHmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647523777, "uuid": "8645e8bd-2369-430e-9141-8a19e27516e3", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647523777, "uuid": "524fe16a-f149-4e1e-9729-958026e63e12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647523777, "uuid": "dea04bf6-01c4-4284-ae69-155ddf3f540f", "value": "bdc75b878a3d9b6f0e36ad3a7237e3e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad3aa33-a606-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647530837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647530837, "uuid": "5f961535-a28b-4e35-bc4f-ad2408fe1324", "comment": "Malware payload (AgentTesla)", "value": "0bf80a0a53607889c163bad4884161b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647530837, "uuid": "7a4bd725-b208-4c23-8ed3-90c0bbd276e6", "comment": "Malware payload (AgentTesla)", "value": "f9f4d689041831c04362ffb100ec231fe3872fee2be00d14454d45df739cd406", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647530837, "uuid": "b2d403eb-945c-4b22-bc8b-66c333740b8a", "comment": "Malware payload (AgentTesla)", "value": "f4fab428123696970363a2fbe28821af250ef81a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647530837, "uuid": "fd0505d2-94fb-4399-8457-6e465f93085e", "comment": "Malware payload (AgentTesla)", "value": "e3cc5fddab789dcdf903c6675b43f5ee26535c91eafdfdcda9e3d1883991a71084e734b2f2462dbfed941dcd0ddd15f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647530837, "uuid": "d7797ea3-3c55-4781-94ec-9260a68772b2", "value": "T1AF74129EF3C59D73F13185311AB78EB7E33E8394E2B60D070F592E3A297268345894A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647530837, "uuid": "030c29ad-fdb5-4681-937a-9790ed30506d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647530837, "uuid": "6285dfae-1399-4a2d-8865-23f0c5840979", "value": "6144:rGiELi0Ql2ndoQ7ysTYtzSrIl5F2S7OGIXa6UJXe0zUFbqwqnl0w5z2:mWl2doGyCYtFkS7OGIK6UJjZwTw5z2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647530837, "uuid": "3716858b-7f82-488a-9e6a-4b6887681feb", "value": 356056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647530837, "uuid": "c178713b-82e1-4ecb-9d32-2dad39f8f48b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647530837, "uuid": "57dbac1f-0fb7-4ccf-b789-00e5a5213fc6", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2f439c-a64e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647561572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561572, "uuid": "1b48671c-9ea0-46ee-bb88-bef5d66125ff", "comment": "Malware payload", "value": "881d94d6e87cfa402fc6f9ffca8574f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561572, "uuid": "79537212-cfdb-4cc4-99df-0d99c16f319d", "comment": "Malware payload", "value": "fb688768c7fb4eca4b872a1649b8938f50d132fe3c3ac9046599e605c8a79095", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561572, "uuid": "e0392c43-0c48-41ab-9b66-43df56981a93", "comment": "Malware payload", "value": "fc9bead57226647147da1ec746561626be9d834b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647561572, "uuid": "942e3c7a-deaf-43e8-a014-c77adf9b1e9d", "comment": "Malware payload", "value": "85afffbeec22d3e0cad8f2999e09252b2bebb6984045a625a7f0d2e55d68361f0dadeeafca265494214c21d5748f06cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561572, "uuid": "1c8d4126-c20e-4e98-9e96-176796db6c92", "value": "T18D059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561572, "uuid": "985ad548-7a8e-41f4-ad2e-8317a29e1daa", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561572, "uuid": "5f96cc4b-292a-4852-adad-041d6f7c2448", "value": "12288:V20BXOMcVzpWfmmnDDbX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDXX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647561572, "uuid": "8f33e521-e918-481c-bbb2-3974a2738ebf", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647561572, "uuid": "337f11d1-f6a1-4b5d-81a9-a285932ef0b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647561572, "uuid": "4a385a63-16bf-4d2c-98e7-dd48733743ab", "value": "881d94d6e87cfa402fc6f9ffca8574f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0537956-a5ad-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647492702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492702, "uuid": "770d46a3-f7c8-4104-a7cf-336bd7020c91", "comment": "Malware payload (RedLineStealer)", "value": "a4cdbb5affdc7b723d9908168cfcdfa4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492702, "uuid": "a24fa5a5-3655-4ecc-b56b-dd6bf9947948", "comment": "Malware payload (RedLineStealer)", "value": "fc9973021689f9693c24cab8bf06c81c7094ca49ec57d6b1f15fb0d9bd853bfa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492702, "uuid": "1f72bf2b-82d6-444b-9452-84ce4a928fb1", "comment": "Malware payload (RedLineStealer)", "value": "5b6d79394801c51dab79eb73314241ddec53982f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647492702, "uuid": "885a4a4e-830e-4f94-98c8-2f272c956746", "comment": "Malware payload (RedLineStealer)", "value": "28f7adc73cf65e66781ab169ff8e5fce23deadc7d057a05a4b1d4ad72eb7870ca61eb6618b5ae2d39396c7101b3e4433", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492702, "uuid": "b353f9f7-1f88-47f2-a4aa-18c7b0fe773f", "value": "T14284BE40F6A0D03DF1B702F8797A87A8A92E3DA15B2450CF22D62ADE56306D0DDF535B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492702, "uuid": "18b0cc0a-2198-460c-8a49-ba9c9ffcbb4f", "value": "909e4097670a3851d6a882270ed674ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492702, "uuid": "24ad8f8c-18bf-45c5-90e5-46b32b19897b", "value": "6144:SDj7LJ1OAinrbyGNf7kvM2Fat/bDtcXxPPQdA0nqgV4VBir0NK:SDbJkAYPfNY02eaP4m0qW4VBk0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647492702, "uuid": "56ffe53a-1745-4201-bf2a-7f6c599a292c", "value": 398848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647492702, "uuid": "37494aca-e9a9-4b4f-98fc-250a8ce74982", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647492702, "uuid": "cc7abf89-77da-4bcd-a0ee-3556be5ede7b", "value": "a4cdbb5affdc7b723d9908168cfcdfa4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8fcefdd-a632-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647549705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549705, "uuid": "19b1f24f-ef89-4003-bcf3-267e6c256f42", "comment": "Malware payload", "value": "b1f275da2a0ef0af0126206a0fd99e1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549705, "uuid": "f06acd29-d0d4-414d-9c43-db9c0a6ac31d", "comment": "Malware payload", "value": "fcf120f1d8bea1a6bb77cdf0d18c2b36b9dd1f721a43657e515ca9e125653d81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549705, "uuid": "64c5266a-11ce-417d-aff9-ddbbf5e09dcf", "comment": "Malware payload", "value": "c85219a842dfac0e0f8fb1680c05030962ceb82d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647549705, "uuid": "1e46c7f5-bdff-42d6-96a9-509162ea0489", "comment": "Malware payload", "value": "6141e9d48d8ab91d8b5bf822eafaa2ba390a16ce5c2e922f4cb07e6b6514d8920e5aa722f1b32ceb17ed37879c987dd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549705, "uuid": "38a00a11-7ee8-491c-9809-063deb64a473", "value": "T11CB1A213A67D14E8C439C7BE828BA99DF461BB303B166ED7AA50260321216F97D74B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549705, "uuid": "83ba422a-a4e8-4458-92d3-d2ff88912501", "value": "22647e5b96f2de81d003f25d98d7d2dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549705, "uuid": "ba85fd58-ebf3-4c53-9e1e-d1adfece238b", "value": "24:ev1GSFGFiKT9D8iOWDKunsoZ9cniXPwLi/njpnNfuMAIaYNq9KBl0CsCu5bsiHsZ:qFGFxrdsoZ9cPL2cMjts9UqCcYiMkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647549705, "uuid": "c6063ca4-31cf-47ee-98ca-5eb54bad91ca", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647549705, "uuid": "e3e03cd1-977c-4714-b14e-5aa4c645622c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647549705, "uuid": "22806b14-eb5d-4a1d-b198-d59e24c071d9", "value": "SecuriteInfo.com.BackDoor.Spy.3626.6110.31149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14d43fe-a5eb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647519252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519252, "uuid": "8acea7e7-49e3-48a6-89ef-79a518eca304", "comment": "Malware payload (Heodo)", "value": "79f3b120caca3b88f35fbb1c8210d6e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519252, "uuid": "ddb72a2b-adb0-4ced-9207-3f4468130caa", "comment": "Malware payload (Heodo)", "value": "fd2516118e659c0b1ce68401a04e873e612b25f64c933cc2aa6fad4462f7c77f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647519252, "uuid": "887abb0b-69ad-4631-80e6-421b46a6056e", "comment": "Malware payload (Heodo)", "value": "eab2e01386546a5b6c8f4e84969a50caa6365d91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo",