{ "Event": { "published": true, "date": "2022-03-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-03-28", "timestamp": 1648512182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "9bdfc394-5652-49b7-9978-5403571a488b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf1f281-aecc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648495435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495435, "uuid": "a73311d3-dd56-4f07-aac3-e5ac119f789f", "comment": "Malware payload", "value": "40a0ac2f30a6de51c1d827b44305b697", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495435, "uuid": "2609c767-2496-4778-be61-28cfef93cb5c", "comment": "Malware payload", "value": "0019f7ece285e0389994c37db5c6181302b8380004b69625db99637278265313", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495435, "uuid": "31ffc4c2-0f7b-4a7c-9769-021b7f8586f6", "comment": "Malware payload", "value": "2b8b7c91f7d48d7da30b4b6584ec2b3cfd458678", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495435, "uuid": "0f582b2d-7864-4251-a158-fd60c98fe972", "comment": "Malware payload", "value": "96b2c8d9570396eb5147097fff23382a56b9460e58967ec7645b7e749dbab0335cc1a0404d47378dd1eab847f19c7cd0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495435, "uuid": "11c302f2-15c2-4bc9-9e3b-77506642fb98", "value": "T1F9351210BB90D035F67715F049BD93B8A53E7DE09B2891CB62C56BAE6631AE0ED30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495435, "uuid": "381af62c-37a4-4afb-93a0-80152123e9ab", "value": "c5abd0d249bf5319619ab44b6b97960d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495435, "uuid": "936dca2a-a8eb-4f55-8f7e-f640ae4b538b", "value": "24576:kaeRUSrUuEZz+M9ikSfT4e0ynf8IAjjLSR3xRJ9x+y/cZ:kJrUTZy9Ff0g8IAv2FJ9x+ccZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648495435, "uuid": "e7098f5d-fdf3-4726-93aa-21b105153483", "value": 1127424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648495435, "uuid": "0bd08c00-cede-4267-88cf-ba2bae0b1005", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495435, "uuid": "ff6c0cc7-a53a-4f89-a71d-4a56a249d7bf", "value": "40a0ac2f30a6de51c1d827b44305b697", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21fda520-ae6e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1648454858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454858, "uuid": "83d16d77-4f87-4be5-b194-ebd9599da0fe", "comment": "Malware payload (Quakbot)", "value": "6f0042284cf54f023cf0fa40f1b8ef04", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454858, "uuid": "4cae8ca6-671d-41cf-ac55-9cdac19a1f28", "comment": "Malware payload (Quakbot)", "value": "0040b01a6f795d66544b1136854ad1e276905a5c316afa829b2e3f90234b9e1c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454858, "uuid": "5ef530d4-f0d2-4e53-94b6-e77dc7facfa9", "comment": "Malware payload (Quakbot)", "value": "b8914500cd892fdad15903b9f74a90a4ed306467", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454858, "uuid": "61709108-c416-4a4c-be58-581cc5c7d461", "comment": "Malware payload (Quakbot)", "value": "b18f1237109e093db36d843267abff8c0d882d5cc2b61554f0bf5a3e4ef6639ec4a85d6f8fe8f5347c156140dadf5f79", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454858, "uuid": "e9e4ee21-d75f-4597-b41f-a281d86e3122", "value": "T1D6059EB8794818F4D7DBD63649ADB8B9137332635AC75C89015DB3C20A7F362AFC1A09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454858, "uuid": "90350cb5-cb6d-4308-a0e5-e9a0f5cb94f8", "value": "bca36259321c5f1206488d971142e716", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454858, "uuid": "825dac46-6156-43ed-adc1-8f289c7f5f57", "value": "12288:rXVyvDn5CX/JYLL+wLg+aCsnnzxS/WZ6xyK4zxfDoN+wLvp96GvZvc/ZscKMu:DMb8vO3xsNxFm4zxILRtxvc/ZdKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648454858, "uuid": "2074e907-a1b8-4fd3-b503-4a8fbd834bfb", "value": 859172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648454858, "uuid": "0944dcde-4f3c-4bfc-bffd-06b90e4d2b71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454858, "uuid": "4bf59753-7cbd-41f0-987a-811437e31f87", "value": "dsuh3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c507ab-ae81-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648463311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463311, "uuid": "75a75ed1-061c-48f3-9c80-7cbd6ce77c02", "comment": "Malware payload (AgentTesla)", "value": "e7343436b1e4b6f88aa7355fce29a23c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463311, "uuid": "bedd9295-c12f-48ee-aef7-fdc61766cd1b", "comment": "Malware payload (AgentTesla)", "value": "00957a8942469dcea856dc800ff76a4a63926c8a1033ab87101979d08bf5251e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463311, "uuid": "e2ef52b9-cc63-4d66-8400-1705cc30c7b5", "comment": "Malware payload (AgentTesla)", "value": "8b017215d739532cde86427885f737f319b23dad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463311, "uuid": "a808f1bc-3a64-46db-b6e0-8e5d99f750a7", "comment": "Malware payload (AgentTesla)", "value": "4025230c8c9d89a856862fbf0fb723077af2d7fcf8972f7bba9c9e75d1191d1312a7d03b6b06d0101420153c7c35f2a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463311, "uuid": "d1d05fbe-2acd-4e73-81f7-d537f71c8440", "value": "T11E755A78B350799EC433C972CD645DE8AA106C6E4F1B854B629332DD8A3DEC7CE185A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463311, "uuid": "abdf8350-8687-44ca-85d4-5e389e71af0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463311, "uuid": "74779be2-47fb-4bb5-a689-81a321e6b1ee", "value": "12288:N8sQTxyrdOGVchTglEaXig1dvyzG1489lS+gQOeHZgoEbSLpn8EezCgzGrZUHHJO:NfAyrbc4O4d6zG1Dyu+oiMlMGOHqv/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648463311, "uuid": "6d3caba9-fbce-4f3b-853f-7bb715c1c5eb", "value": 1603584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648463311, "uuid": "699a7455-73ff-4aa2-87d0-99defdc02d77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463311, "uuid": "07c625e1-c7d4-4710-aecb-319587faadf8", "value": "Feb 2022 soa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a7707ac-aeb3-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1648484534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648484534, "uuid": "6128d04a-bca8-496f-8143-0aa385099577", "comment": "Malware payload (NetWire)", "value": "1e438bcf422643c44dce4daf5ea3006b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648484534, "uuid": "897f98fe-3d80-48d8-980d-072064251ae8", "comment": "Malware payload (NetWire)", "value": "00a5d3a64510cd32a452ab596e74aa5d700f90878ae24c07cd833464cf0d39ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648484534, "uuid": "914c9404-22f8-4b6c-b183-158129460550", "comment": "Malware payload (NetWire)", "value": "a1d7dae28b16532ac155eb40e9810e2766fd34f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648484534, "uuid": "9e035c65-eea8-461d-be9b-b099beb7f907", "comment": "Malware payload (NetWire)", "value": "c8a01b098c5e999238c9aa284cac774a6e1b2279dbc7b625c264bd951d0d55c066346bf2098ca8f534789c64aca44d26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648484534, "uuid": "fa78f669-06cf-4977-ab1e-c8800a035374", "value": "T176547C1136F1C032F2B359714A35C7B15E7FB8726939968FAAC40A798F25BC2EA11317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648484534, "uuid": "01f4e98c-3946-4a3a-9615-34d83978a74e", "value": "c07c5e888b8d3cd01065901e27811273", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648484534, "uuid": "9596a372-6926-4e87-b4e3-8a9b9f7a4825", "value": "3072:8zepavPn8Ci1dxcNbYMdqxfdNJi/tOyNRtl/mTJHnBa+j88KnxvEYtuxDOGl5vdH:2epM0Ci1dxktM+z1qQ+jMnxcYQxDO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648484534, "uuid": "f56f2715-8d0b-464f-8cde-89c647ae99c9", "value": 287232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648484534, "uuid": "ba87375f-edff-4f25-a419-daea7e18d7bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648484534, "uuid": "906be657-cf17-4445-8187-2043d73a8952", "value": "00A5D3A64510CD32A452AB596E74AA5D700F90878AE24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc065f5-aeb1-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1648483925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483925, "uuid": "5e6b41e6-ac92-4194-8b56-a7f3230d34be", "comment": "Malware payload (njrat)", "value": "2651557709b0edb3911fdb2f8d7527a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483925, "uuid": "9ec895bd-2f2d-4dc8-969e-6ac0c1df1a99", "comment": "Malware payload (njrat)", "value": "00a73c3bec537f33c6fedb1bcbe896fb9516730ea23b6fad80f422b4ad747bbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483925, "uuid": "5475f7d9-d63d-4beb-9cb2-409a4387b3ab", "comment": "Malware payload (njrat)", "value": "fe40c7fb21f2a2fef6b866f742dce0e025193144", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483925, "uuid": "65576337-881a-4f53-bed2-34f84ed22fb9", "comment": "Malware payload (njrat)", "value": "92f59d69d9a72b7faa313d9f697cea229ab8d5ad879464880cc606dca4265511c4d4764d5cb5ca2ec5d77f333b933568", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483925, "uuid": "67f81102-1731-4243-ae29-7011f5252825", "value": "T15754AE03BAD148B2D57319321935AB216A797D201F348B5FB3E43D2E9B33581A635BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483925, "uuid": "f2bd45c2-b46b-4039-b275-d7a2f48b4013", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483925, "uuid": "3b258aa2-40a5-42ae-9ce0-f9275aca205a", "value": "6144:4wYWSbN4lJlvXYnZTtc3wHSqYQOJp6quZXiD3:oWq43pXiZT+AsQOJp6quZXij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648483925, "uuid": "fac47dfe-e8b3-4ce8-a076-5ae1a56ccd9a", "value": 304105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648483925, "uuid": "4b93138b-94d1-4a0f-90a8-df4a85ae1bc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483925, "uuid": "b814b6b1-14a0-4c6a-b4fb-a2fdaa5414db", "value": "2651557709b0edb3911fdb2f8d7527a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c35548-ae70-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648456025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456025, "uuid": "9b989eda-186c-46ef-84d6-0de55b766c4f", "comment": "Malware payload (AgentTesla)", "value": "91c53122fcd71700a4216236d6943ebf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456025, "uuid": "e9510c52-81bf-46aa-939f-b779b6ab225f", "comment": "Malware payload (AgentTesla)", "value": "0116b76872526b9bb5b0536b3486f5b2f9a920c267bd7d07ff19b4621010723a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456025, "uuid": "2a27e8cb-7ffb-4a1f-b8d6-c43a41daa948", "comment": "Malware payload (AgentTesla)", "value": "561c233d0a33a51709decff4cb36b182b4d6d800", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456025, "uuid": "4bb93311-fed8-4738-a46f-462b085b2011", "comment": "Malware payload (AgentTesla)", "value": "c8ddda15a697abb8e3bfe411b7507a8e35a4affe8a23a2ee78cd6ea90f9ae8a4bdeccd4c24387c5c8f3fb8e82354433f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456025, "uuid": "af39320b-88c6-4a3d-89c4-b24e368daeca", "value": "T13F942384364372230FAA2D9F0BC5DB83AE67DB485173D2B7F8B8A8193D52A5D3B95404", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456025, "uuid": "1233730b-a83d-4ce7-a68e-c7542015f0b4", "value": "12288:IEwukXEitp77oGDpglwf9zmRpv2DRVIY36s:yHXEc70GdZ9zmbv2DjIwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648456025, "uuid": "6d9b2064-9877-4345-8683-45a621ce9777", "value": 426214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648456025, "uuid": "a782f7bf-ae1f-4083-80f5-9506297daec6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456025, "uuid": "db8fd6d2-b5d2-4164-943a-24c871fc0cce", "value": "PARKING LIST AND INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35131f80-aecb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648494833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494833, "uuid": "b36af7aa-6cba-4a79-8081-edcf954ff0fc", "comment": "Malware payload (Mirai)", "value": "7a0d1ab87db4801b4c0a3872ebbb31a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494833, "uuid": "32acbddc-9d88-4085-9bd1-03f67067012a", "comment": "Malware payload (Mirai)", "value": "02a1cf38783d2925af72d124b308836a3ddd49a3534055cdc0a219a78690219d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494833, "uuid": "294bfbb3-e8e2-4098-9278-0aaf74ff397e", "comment": "Malware payload (Mirai)", "value": "ec45e91e36d3447636cd2e7af40541723262a0b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494833, "uuid": "7262c243-fbef-4711-99bc-ab7563ced2d8", "comment": "Malware payload (Mirai)", "value": "8955ac0873a6b6d42afc3fe89e8d5edcea5c189a6e017eb08f6066ff2c4ffe019c903c0d0674b914ca2b791e34bd61cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494833, "uuid": "e0f3abb6-8b27-4d44-995b-0438dffa5200", "value": "T1F4338CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494833, "uuid": "59590e41-5442-4ba4-a95c-a094589fea0a", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvI:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648494833, "uuid": "8d1b6cf9-14b1-4fe0-8957-99c78243bbcb", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648494833, "uuid": "33b13a53-2781-49d1-89ee-4e66fd30b46e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494833, "uuid": "e49c115f-cf80-4e09-a49e-6275822542d1", "value": "7a0d1ab87db4801b4c0a3872ebbb31a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9372006-ae88-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648466332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466332, "uuid": "05ed1e07-035b-44f6-a8fc-3cfaf76d3f32", "comment": "Malware payload (Formbook)", "value": "2d42eded04b592b539951f61742a736a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466332, "uuid": "3077c94c-b7de-4d5a-92b0-67216d4da131", "comment": "Malware payload (Formbook)", "value": "02ad8318feb2f8ce745e2cefa321f18d19b7ad72085664371033fada68bd6b91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466332, "uuid": "5c5c679f-1ce2-4cb9-ad6b-f3d75228e645", "comment": "Malware payload (Formbook)", "value": "d0c31bc164b18121ceb884859a9a5a5547ee437e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466332, "uuid": "023e38cf-f177-4207-ad0b-825b46778cc5", "comment": "Malware payload (Formbook)", "value": "6377278ebb2b8eecc465e408e1a44d9d91bf56a46b2a6eb000c5ae2e66262cefaafdc5b0dfaf59cc0e51470a01812272", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466332, "uuid": "8c8fe3d7-cda4-442d-b288-3abf159da20a", "value": "T199556B993250719EC467C932CD681CECEA207C669F1FC207A053329E9A7DA97DF145B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466332, "uuid": "240bfc5e-56b2-422f-9cac-a3c50207153d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466332, "uuid": "6d12706d-3301-4858-aa09-4b28b59b44ff", "value": "24576:39p8WI1dlcA9z6bMN2qJwNCDedo7Tdmk4j0UeT7nE+qpFKFqy:Np8fNcA0ANR2Zdqmk7fnxC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648466332, "uuid": "1568fca8-f1fb-4111-a530-f8af22321368", "value": 1389056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648466332, "uuid": "ece9343e-4e53-41a4-9b68-388dc0874569", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466332, "uuid": "ed3ef1d4-9d32-4b63-bd2e-6164c4f793ce", "value": "RQM6HLsZQYLa9qt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c519a84-aecb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648494845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494845, "uuid": "3c6c7aae-b7b3-4ba4-a111-9bb549ae08a3", "comment": "Malware payload (Mirai)", "value": "c42859aba39302be420e482d3f9d1d40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494845, "uuid": "d8e3d8eb-1dcc-4b11-a6eb-c072112f137c", "comment": "Malware payload (Mirai)", "value": "02bbeea2a33fd53d71355baf2c6ad26056a8f1d80628e09581e6e30cac96a2cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494845, "uuid": "901648f2-79f4-4b8d-bd57-a63db4f6144d", "comment": "Malware payload (Mirai)", "value": "661520bec982a09dce931e8e404b97508796989b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494845, "uuid": "9f24c4ab-083b-45ff-badb-bc25a357215d", "comment": "Malware payload (Mirai)", "value": "ff400e48ab63a524cdf0069b32ce644d08739a92236be145972c531db208e5896c96da0f2c1d1ccba7048bca83e81bad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494845, "uuid": "2cfca5ec-457e-4f8f-ac7e-49ed1bb75b8d", "value": "T1EDA2D00825CCE972D1B0D03FE23CC347AADB87B652FE323A1E180B9CE45091AD3B9945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494845, "uuid": "5e3e0a27-c428-4f02-a208-d3b9d374c9c4", "value": "384:Yzmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbxPhymdGUop5hXc:YKoh/DxCvhdR4IjWVFbS5s3UozJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648494845, "uuid": "5af8cc41-43f7-4993-a4a1-2b39f37bb96b", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648494845, "uuid": "174422cb-eb5c-4059-84d6-18af869f0b6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494845, "uuid": "793e02fa-3aa2-48cd-a62d-13bf29ffc461", "value": "c42859aba39302be420e482d3f9d1d40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24af4e47-ae73-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648457010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457010, "uuid": "cffea704-8735-453f-b3d1-3d2c00534e39", "comment": "Malware payload (Formbook)", "value": "57480a6c3e0ee14ace07496a351c410b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457010, "uuid": "84ab7ae2-51ae-4fad-a021-4039117683e0", "comment": "Malware payload (Formbook)", "value": "0323bf6b166df97ef9a76da9bbb2488919cbff131ea0363154e06afe0b363116", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457010, "uuid": "4ac9a242-a653-4324-b599-1d949d1ac8f4", "comment": "Malware payload (Formbook)", "value": "977008cae83e16f308e40b10120c489745c85da7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457010, "uuid": "075d680e-b279-4437-a208-a9f62d8866d3", "comment": "Malware payload (Formbook)", "value": "9ff9eb45d7f3787e0c33cb4462bb26460747dbd6e0a0ecbcb70d11f3c498aacbb015a4eff1454dbbc1d0e0107f1cfc11", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457010, "uuid": "bb7a362d-5af8-40e1-b131-c8ddf66b3934", "value": "T148A4231D8656C6A2EB39F7D2242D1E97CA81E042C712D1FD520D8273E62073D9E19EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457010, "uuid": "2157b9ff-8d20-4eef-9398-58ddbfd088f0", "value": "6144:S6b0Ps+ZLQ29GjO34sZ9p77N5cvZUmyp8H4QZ7TNbwTRh5iS5kdb0pP4Bk3895fw:S6v8T9JLATy8YQ9iTWEABkMzm2sNWEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648457010, "uuid": "ebeea8e3-705c-4647-b69a-274bcf9e1ab6", "value": 456220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648457010, "uuid": "12a5f571-cf1d-432e-8fb0-c3fe0f1f9809", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457010, "uuid": "f0852644-5d33-4942-b8cc-fd668998d941", "value": "New QuotationPDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a05583-ae74-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1648457486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457486, "uuid": "7f88824e-df80-4a5d-8330-69574e1764ee", "comment": "Malware payload (njrat)", "value": "aa329ecdb9113db8ed5cfa0abddc66b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457486, "uuid": "be71119a-71b3-4cef-a513-a82e99e985f4", "comment": "Malware payload (njrat)", "value": "03c797996da1b603758c6875b0dc86c8c1cf2f4f1939d25aa3874cb0fe2bf08a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457486, "uuid": "831df4ec-fb28-4264-875a-dd03e2af42f8", "comment": "Malware payload (njrat)", "value": "3f202fef6884546f0f79123e877ef369fd0d6744", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457486, "uuid": "559d9f06-2d3f-40be-ae82-f2a1d7843755", "comment": "Malware payload (njrat)", "value": "8ba9a76c94443d716138f9d101fd5b6d5f6de4fbdcbd27a5c39c3823e570d5dd4707a54c07e8d8e5756be6c613fee73e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457486, "uuid": "f4371a7c-d69a-4b57-a52f-51c629f1a563", "value": "T14303294D7FE18168C5FD097B05B2D01307BAE04B6E23DD0E9EE5649A37636C58F50AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457486, "uuid": "fcfd386e-0b1f-4055-8a36-1c7e28d8f129", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457486, "uuid": "139351c7-f70f-4f97-807f-5b6668661638", "value": "384:vJnjkitqZf5W9cTYXyc/hTMSgz3R6n/6a1rAF+rMRTyN/0L+EcoinblneHQM3epJ:hnSjjTYic/hAc/66rM+rMRa8NunNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648457486, "uuid": "5946025e-4b94-4d37-8494-ab36c9125882", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648457486, "uuid": "40b51676-577e-4d4e-ad84-6af62f72bddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457486, "uuid": "a8364f68-0fef-4fe8-87be-f3af2a6f5096", "value": "aa329ecdb9113db8ed5cfa0abddc66b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7186edc8-ae68-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648452414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452414, "uuid": "00e2b91a-c111-4c0a-9ad0-62be31b6620f", "comment": "Malware payload (SilentBuilder)", "value": "985517b997cba484ce15a314c303b91b", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452414, "uuid": "c7078066-3b7d-4874-a8d6-a9f7c1566de0", "comment": "Malware payload (SilentBuilder)", "value": "03eccb4286e763775624927993448a980cf9a8f9a94ee84ee8e989726493760c", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452414, "uuid": "d23333e1-0c1d-4adb-9552-5425135a0772", "comment": "Malware payload (SilentBuilder)", "value": "b1814f25127339fbb201f190166f935cec9c9775", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452414, "uuid": "35292819-fe79-412b-9b46-7ba8f4b75512", "comment": "Malware payload (SilentBuilder)", "value": "93409286bd54c5000e22958bcbb7ee069317c4aff1ed3a4dcd2450c37ec9968080a15ccb788182314769c82c9e92e6de", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452414, "uuid": "e2f50b2c-2cf5-4e2b-a2c8-4e70cf331686", "value": "T1E744D04272459439E8EE973414CB4A96923BFC20DA5A5B4B131333FA3F796B05E133AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452414, "uuid": "4262d4b0-4d68-459c-9e90-ad662533c473", "value": "6144:UKpb8rGYrMPe3q7Q0XV5xtuE8vG8UM+AEpBLgoN8uJCLpgV2ZV2VUSpbLjtdI:zpBLgAgtgV2ZQ2ALjtdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452414, "uuid": "c2bec8bc-e5f7-460a-918c-1f4e23fac4a3", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452414, "uuid": "45d6af98-72f2-416d-b0a1-559d25011c08", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452414, "uuid": "5b7f0ccd-3b2c-4b73-94b3-608472e991d9", "value": "neevsqiimdeuabtu.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90fc8702-ae6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648453755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453755, "uuid": "4f09aadd-3e06-4e97-b5b0-e12978db5d4f", "comment": "Malware payload (Formbook)", "value": "1cabd60d160cf879bd7b561018e334ff", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453755, "uuid": "08b1c637-663d-49d2-a976-92b3ddef0b6c", "comment": "Malware payload (Formbook)", "value": "040cff08509278893e4e0bf0f731a1a1797d2518610135500e03c02fc8b6e7d1", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453755, "uuid": "5394268a-981e-4a00-919a-27e97bd5553c", "comment": "Malware payload (Formbook)", "value": "629487fd85949128df601880bfeb914817f51cfc", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453755, "uuid": "171831f7-b7bf-47a7-883d-2193078a55ed", "comment": "Malware payload (Formbook)", "value": "9fd55a68ef100343f93f346861cfd554e2801842884ce54c1f1483c4cafc5e14e7590381cb4dd2e809772c74c2e5c978", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453755, "uuid": "7e4b1f4d-e8d1-4416-91da-2b191df6df47", "value": "T13235F10232E06754E07A13B9DCA844DC53717E49AE7DE61F2DC172CF0AB17829A26F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453755, "uuid": "cd1e494e-cd8e-4631-83ac-0c717f62764c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453755, "uuid": "b1c4c246-8c0c-4528-b7a2-92b38b2fbcb3", "value": "24576:ypip60WKRKewfCDu68D0P4Ge6AvAMDdHAjyc+O:ttR6fCl8YPtQmjyc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648453755, "uuid": "a0c5acee-a8cf-4df6-ab81-9b6ab0ccf276", "value": 1100800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648453755, "uuid": "5f1e7bda-d134-44ae-8497-8bb3d644dbee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453755, "uuid": "ebd60d41-5424-4ad7-b9d0-25d97c4765a6", "value": "DHL Delivery Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a6f6e0-ae34-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648430267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648430267, "uuid": "a49bd410-976c-4739-9f46-5332b07f514e", "comment": "Malware payload (AgentTesla)", "value": "4e431e7f00429784347e10243eb2c3d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648430267, "uuid": "9944eeb5-2846-4bf7-a7f4-79a697eb7349", "comment": "Malware payload (AgentTesla)", "value": "040d9873354c51b33e6d01872d6736cf197eb43a62c3cc0aa48c1ce0204ea85a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648430267, "uuid": "364ee027-add5-4aec-8179-b2497d72646c", "comment": "Malware payload (AgentTesla)", "value": "83a40464d390af9e9849036bae272a9c4ac79950", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648430267, "uuid": "af1b08f8-8969-4116-82f0-d37c29a06b96", "comment": "Malware payload (AgentTesla)", "value": "30acb456dca91c0efdc1bbfedfdaf4f8f1a2bbc8b021fafb78490599cc8ea625c32178faf8d91e700a9ee89e168bd477", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648430267, "uuid": "7c1a89ed-cf7f-484a-913b-68ce6ae0eee2", "value": "T18A351233F38A9A45D56E4B7916A6D6A013367F6AB42ECB0C3DB9324D55323C35202E37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648430267, "uuid": "82a4b4f8-ce53-4361-99e3-63ac44adcbd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648430267, "uuid": "0d5ae883-b642-4bc4-94ac-ca8c3ba6addc", "value": "24576:Wb/p+KmXeM53SARpKEGL3ez7m6DjhCDJt5AMQ8B6cE:Wb/YKPM5iARpKa/NDjs9XBBTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648430267, "uuid": "d8bf472a-f89f-4cc2-9c5f-641f0eddba08", "value": 1101824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648430267, "uuid": "8dedc2d5-b196-4a7a-ad33-282f8223404c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648430267, "uuid": "7aa2aa2d-5c2b-4fa2-9089-19ad5d2b918b", "value": "BKLVkmqVLbRm8td.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8eaf2af-ae72-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648456936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456936, "uuid": "16698410-4be5-4499-8cf7-479511f22af6", "comment": "Malware payload (Formbook)", "value": "d1572e5a7696d323c1c4c858260bba40", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456936, "uuid": "46d28d8b-83a9-4f67-acf3-339b4463b2ec", "comment": "Malware payload (Formbook)", "value": "0524a8c95f5a07491118a7aa2f7536e1aaa732ee8d23edd38d82af955bf386c4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456936, "uuid": "308a2865-e14c-4a1e-b52d-1b76cfb0672b", "comment": "Malware payload (Formbook)", "value": "b1b75433054148c36d06a9dd73205196fd97f794", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456936, "uuid": "3863cfc9-ea36-417d-b35c-cad230ade8de", "comment": "Malware payload (Formbook)", "value": "92465d560b26ac97bc959869093b2d3f91b0708ff0c41d7ab1502abd8ac83825ae71442aec7d72e79cc3dea8954f9208", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456936, "uuid": "98fd4a36-1814-4230-8f4a-55f22171a8f9", "value": "T191A4231D8656C6A2EB39F7D2242D1E97CA81E042C712D1FD520D8273E62073D9E19EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456936, "uuid": "6dc7a1cf-6eea-403b-b926-a38d4731dc99", "value": "6144:v6b0Ps+ZLQ29GjO34sZ9p77N5cvZUmyp8H4QZ7TNbwTRh5iS5kdb0pP4Bk3895fT:v6v8T9JLATy8YQ9iTWEABkMzm2sNWEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648456936, "uuid": "d28f62d5-fc58-4164-8275-6ce5ce12815d", "value": 456204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648456936, "uuid": "c2c23ddd-21a8-4519-a2ab-043b5f04541b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456936, "uuid": "e2b41734-938a-4d37-b455-53464245eea4", "value": "PO-34482.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411fecb5-ae70-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648455769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455769, "uuid": "26ec7122-2939-41b2-a1e1-0613664af172", "comment": "Malware payload", "value": "42387bb41af3f8f11137d4d515d5f65e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455769, "uuid": "de31848a-b516-4364-b6cb-c1dfee5ea941", "comment": "Malware payload", "value": "054fb3351a312daf5ab8011db57731961a0e7258eac118dada8e1f5ba531ba73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455769, "uuid": "eb517f55-8986-4da6-8984-056b40d7316c", "comment": "Malware payload", "value": "1a6f16b9ff57b4c3f752ac3eb9f0f5f31d39e424", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455769, "uuid": "4df0cd92-1db6-469c-9929-0e266a5b951d", "comment": "Malware payload", "value": "93fa968b845658f79d92f8d4f93f33930baf922c5ebda494f4d7abf9cfc9a6b5e0c38f71b886953ee258791f5853aea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455769, "uuid": "5ae5d5c5-12da-4ffb-87bf-1229fbbc91aa", "value": "T1DCD5336C49FB29ADCD87A07185A6E533E2683ED8A9CC2D872DF63E37F4E5911D1C4840", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455769, "uuid": "40266a56-ffa0-4608-8077-ced188aa3c75", "value": "01d1b984e99e67b6f7ae46199d7dfd92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455769, "uuid": "fcb96862-2724-4032-8fc9-02d6cf4b61c8", "value": "49152:K9SRQo3DNrOKFcHxALBpIHo9HYdZvXYEj4UDEbVhqTig2Iug/xRNzi:KMRQo3DNry23M80F4WyhqTi5Iug/xRNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648455769, "uuid": "6c9a0bbd-eb2c-4fe1-80b2-c9b64e21259c", "value": 2761360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648455769, "uuid": "98b0f16e-ea25-4cc1-b444-677de94d9baa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455769, "uuid": "d5ee1e24-9e0b-4314-bdee-1222b40c22d5", "value": "42387bb41af3f8f11137d4d515d5f65e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1683f0e8-aeed-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648509384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509384, "uuid": "badec60d-5f52-4ed8-9a07-c5832acaf924", "comment": "Malware payload", "value": "44aba241dd3f0d156c6ed82a0ab3a9e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509384, "uuid": "2fe5710c-9491-430e-a100-97ac54ddb7ae", "comment": "Malware payload", "value": "065208b037a2691eb75a14f97bdbd9914122655d42f6249d2cca419a1e4ba6f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509384, "uuid": "8be96e47-de48-4edc-81fc-71bea47e335d", "comment": "Malware payload", "value": "8516db624f17ad1cc56f71a69555272b216a8aee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509384, "uuid": "fa664c9c-4fe3-481c-bf42-00f0758a6272", "comment": "Malware payload", "value": "97ed307e5bf6333242acc36987bded4f5f915792d3f43f3163fc977bb4d1030ad7ceea3f42394dd30860fc282e2c5141", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509384, "uuid": "83fb2104-a4a6-47d2-a018-a5dd2af907b8", "value": "T16F943947F2A2A0BCC16AC0788757A573F932BC0946247E7B27D4BE312F65B50A72E705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509384, "uuid": "ca5d2973-45d5-4be3-9adf-8953e1057104", "value": "40064c6eeb9f32dfc55bf2c7514305c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509384, "uuid": "153e6907-6050-4567-b1e2-559375cfd243", "value": "6144:7++39gJVd8v1934Wx/DSnsJOWGM/gRASu8ixez+AW1LmOBGYYr2:7++ta4tb/2sfSunPNmOW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648509384, "uuid": "d5a386cc-34d3-4136-b749-f9353d76ac8f", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648509384, "uuid": "ec7bc0c5-ac44-4af9-a0c2-8cf257d53bb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509384, "uuid": "d3452958-04fa-4f0b-876b-e1d6524d68e3", "value": "065208b037a2691eb75a14f97bdbd9914122655d42f6249d2cca419a1e4ba6f1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13c5450-ae81-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648463285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463285, "uuid": "ac243109-f4fd-42f8-93c7-e874dcb73efc", "comment": "Malware payload", "value": "2eccaec3fd1aa73130d897c51b30e170", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463285, "uuid": "a99c7338-f239-489e-981f-f84bf05d35e7", "comment": "Malware payload", "value": "0674af950a423e2a60a6a9e030e3f2646adc75d1a84f8b2f986dd1df3f428a54", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463285, "uuid": "9772e6f1-7b75-49e9-b8ba-56133886a1e3", "comment": "Malware payload", "value": "60e47ce3ed2210ddc52658b13028d3b39360c8f4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463285, "uuid": "a98f4ad3-dd61-4f9a-9402-5a2baa011c9a", "comment": "Malware payload", "value": "09cc39914e4992ce188d330ee002a8abfef01778f8fc8299b609e32814d266faea4085e3ea63ecbe623439dbfd603241", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463285, "uuid": "a1c385d4-61fc-4960-b117-621a1a478022", "value": "T13AB301DBB8012E21E46089B284ADB14C7A7941171DA0EFB65C977396D0682737FF6AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463285, "uuid": "fa9677a9-1a8d-4d04-be30-5e9b22de2f9c", "value": "3072:j8pbNZh0Kv6d1B5sA2PzHc3t3h9N2Ab9W8ENYS+5SEHqq+IacWyzhm:j8DZhjv6d1B5sAP3tRH1g45THqq+Iac+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648463285, "uuid": "5631159f-5cab-4661-ab82-107d7c2c159b", "value": 115776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648463285, "uuid": "64383b8e-64f5-4372-8cf4-a6e67f798f40", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463285, "uuid": "d27c36a6-216c-4f51-8b26-4b8e74719d8f", "value": "donwarpersistence_NaXWKLukvm115.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e75f20-aeaf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648482785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648482785, "uuid": "7bf6e0f3-90e8-43a1-a04b-cf6578a86ca9", "comment": "Malware payload (Formbook)", "value": "8cedf017e93d084ae4e2d260529b8d02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648482785, "uuid": "a754f0da-77a9-46dc-af69-59defb75934f", "comment": "Malware payload (Formbook)", "value": "06a09d39e422f0a5df196c4de322e7adec9ee762bc5d840e980c0dc658319cb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648482785, "uuid": "9297a2f0-6a0a-4bf2-bf43-7cea49351b90", "comment": "Malware payload (Formbook)", "value": "8283ef91a3959e83269898f159a49f70cc4e083f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648482785, "uuid": "867c1fa4-c9ae-4419-ae35-6f86fc77feef", "comment": "Malware payload (Formbook)", "value": "83290c449258cffb2d7273ffc74a88f6b7c7ee45dae7c4e4242d97f7fd1747e51ade47ec0e139f0fe8d8df164d4450fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648482785, "uuid": "0bde8d29-5ae2-4df2-9486-24967935e09e", "value": "T129259E50543178E3C8B27D31E52FB3A7A3A0D55E4F9149E73747A98428A6BDF010BBB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648482785, "uuid": "2310eb70-ef8d-446b-b0ca-878c1b9934be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648482785, "uuid": "9d9281c5-dbb5-44c4-9fd0-f7975d2334c9", "value": "12288:rrQOwh7A2wwEo78WIx28Tf7ihuLiJPPFQMyir5dSWVWerlyAKp:/Qr7ABoba7ihujM/LrlWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648482785, "uuid": "706f7719-d9d2-4ddc-a3e3-6f3ccc190112", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648482785, "uuid": "03abbfaf-41fd-4c17-b8dc-24d96b40287f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648482785, "uuid": "a4e93f62-6b52-437b-b38e-e91330387a05", "value": "order confirmation 1000037106_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf3a204-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448111, "uuid": "747d54e5-0b20-4130-9c84-86f73c729a37", "comment": "Malware payload (Stop)", "value": "431bdb52c6df493a36600632ba4c7dd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448111, "uuid": "6837e247-da15-4c2c-b6fd-1b843a00a771", "comment": "Malware payload (Stop)", "value": "072358a173e1a843310b57da93eb0bb4a9f30489415b162de5fc2ea9e876bfff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448111, "uuid": "8bafd71b-4351-4ba0-b3f0-abcd7b625110", "comment": "Malware payload (Stop)", "value": "69ff040a4d2f6d1ad586cc16a2b4d5459de7ecec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448111, "uuid": "c6552447-ab73-4a65-9a05-2ecda9b0cb67", "comment": "Malware payload (Stop)", "value": "d4c2c660c93eebf6c801807a929c0cfa38f894bce745bd2102d2b56f7ca3d2299e18c0a4acc0af599fc9cf2d02e56e45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448111, "uuid": "de919761-511a-4fe4-9e04-7a714bb1a81c", "value": "T1E8F42350FA58C13FCF125136B3748AC45131ACA15DF3A607767E495A6E31AE30ABA3CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448111, "uuid": "43f8b279-08a3-4ec3-b33a-9370dd88b010", "value": "98af1336ee9a8378f1e2c2d0d9027760", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448111, "uuid": "c5bfbbcf-cf59-4ac3-be04-baf782f531da", "value": "12288:kLLrENl3kH6jJkwW3LnoDzonTjR6Oix+QHjFFRJdFKu7muAawCDUzBXf:kXrENZkH6jhW3LnoHonTjR6OKjFFRzgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448111, "uuid": "0a73f022-589f-4341-8bb8-5404d2de2c5c", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448111, "uuid": "47c6a8fe-ecdb-4121-bfa8-03a5f22ccef0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448111, "uuid": "eff7db36-3063-43f0-af18-118fd4c4e1e4", "value": "072358a173e1a843310b57da93eb0bb4a9f30489415b162de5fc2ea9e876bfff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9dd77f2-aec4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648492049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492049, "uuid": "c8ab8f2b-53a9-455a-bf8d-b78aad6197a1", "comment": "Malware payload (Heodo)", "value": "2f5c3cfa7dd80c5b1ce09562ea0a3d7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492049, "uuid": "b7a8f162-e52b-4ce8-ac2b-baac93eb5918", "comment": "Malware payload (Heodo)", "value": "07377ce8ca6bf1e691e780c9d458f3b4d40d981c33ca26b31bf5d1dd1d86ed16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492049, "uuid": "55728a7a-1f14-4ef8-b313-911926770f8d", "comment": "Malware payload (Heodo)", "value": "99a650098447da65618df1b4e95446cfa0f470c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492049, "uuid": "d709c233-7a08-4d11-b0a1-b2978d1b12c8", "comment": "Malware payload (Heodo)", "value": "75ece9a670731794adcc9d6c1c01edaba45c04289980dd668d7e0a571707152b32464b31b90b6d5796e70f40e201c5af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492049, "uuid": "87b01d99-9bb9-4a5f-a3bf-11204510ee34", "value": "T144E48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93FBFCD302514D7432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492049, "uuid": "c055fcd0-f180-4e19-9d13-9f17c8078138", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492049, "uuid": "7d542d43-cf8d-4f5a-ae67-1f521fdf2827", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7XvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zlCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648492049, "uuid": "bb443040-a8ff-4d95-ac7f-d09725a3f24a", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648492049, "uuid": "ef37bf25-495f-451a-97fd-14ab480cb7b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492049, "uuid": "355fcc9b-60ea-4b1a-86af-9ddb7ca43b49", "value": "2f5c3cfa7dd80c5b1ce09562ea0a3d7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddccde7d-aee5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648506283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506283, "uuid": "f2409ffe-cdb4-4b1a-8daa-fc2adcb6bf84", "comment": "Malware payload", "value": "030f38327a254e095712d84e88f0b759", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506283, "uuid": "d80387ce-20fe-469d-83ec-7da0947fb36f", "comment": "Malware payload", "value": "074f528692736843773c7a6ecafc1f3155c1df69e642d0170c0b22deb4d3fecb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506283, "uuid": "618feab3-0115-4d97-88e7-b48cc74465c2", "comment": "Malware payload", "value": "ffb3fc63dcd9376d210f3d4679163bb76810c69f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506283, "uuid": "ca2c7a63-e06b-4c33-ace3-311e22dae225", "comment": "Malware payload", "value": "31a50faee37f990b7f07c051ee0ff429a5ed884fe75de49d6196ad6a6ce5b04f9b54cb2bb6f8b7ab4dede997c451c51d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648506283, "uuid": "04f7ea0b-41fb-4dd8-9322-d70aa4471831", "value": "T12CE43A16EA5221B5E45B05700A1F16B86EAF8E01A7114AEB6F685D2D1F303D3FD3FB09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648506283, "uuid": "357d48f8-df33-432a-b90b-3bca8bace868", "value": "12288:DtAanana8Meee0GBGEI+0JCPjp1g4SbBKilbUD4LmQjcQb:Kanana8qGBGuPjp1g4S11lgDIRAQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648506283, "uuid": "4073fcfa-feb8-472e-84f7-67e6821a5b87", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648506283, "uuid": "39a2cdcb-0e2f-48cd-ae31-5daf54b65d2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648506283, "uuid": "7b4b5a04-3ddb-4440-bb38-c693f4b10472", "value": "emotet_exe_e5_7a2060670506673e1af4a4c387b3fb4ca3d1974de02dab3c157374116cc40f25_2022-03-28__222436.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e73de9-ae5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447910, "uuid": "ce85f07c-5f9f-4186-b985-e7b46d61ba76", "comment": "Malware payload (Stop)", "value": "0860df2119c7e788fe42796ae7873000", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447910, "uuid": "926fb50a-89c5-4128-9f51-6659f556195f", "comment": "Malware payload (Stop)", "value": "07be6cebf7cb6fec6e82da3e5855ffb5f0c5da5ce6ff0adfed897466b08387ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447910, "uuid": "b15351e2-3ea0-45f3-8d09-af0409fe4a0e", "comment": "Malware payload (Stop)", "value": "cf1011e8116fff4d2b8cba65e99da6ac21f01eec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447910, "uuid": "4be96bdd-7d2b-44c4-b503-14a3e451dbb1", "comment": "Malware payload (Stop)", "value": "1bcf8a974d70cf23763af7802198a2629319b022f2b129927b42115de5e62ada8f7fefafadf5f72a073d07e9257a267a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447910, "uuid": "26eaa8f8-bef4-4b45-8ba4-c1dfe6af37ff", "value": "T182F40200B790D031E6B712F449BE83A8752E7AF19B3590CB66D66ADB96346E0FC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447910, "uuid": "92696ed4-4448-4476-a19c-e536049e2fc5", "value": "8b43e1344b27321e8381c60a4a19bca2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447910, "uuid": "5aa78368-8b41-403f-823f-ff5c15be92ae", "value": "12288:Vwdh+/kNMPSHZ2jIoMKVhxQTZj7F+cpfNQbVVgSnXj9qGngMFpCD4My7TyOPnQp:ThaAtMcxiSUuEeXRnHru4Myj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447910, "uuid": "3abd0d96-094c-4c8d-8fb0-3acf96be48cf", "value": 792064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447910, "uuid": "9d272ad3-ae01-41d3-b4df-0713bb8b69ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447910, "uuid": "bf67a16d-01c8-4ebd-9b27-c6a0c68fbd20", "value": "07be6cebf7cb6fec6e82da3e5855ffb5f0c5da5ce6ff0adfed897466b08387ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a1fe4a-ae74-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner)", "timestamp": 1648457471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457471, "uuid": "0621ebcd-da71-42b9-baa9-043d48d7255b", "comment": "Malware payload (CoinMiner)", "value": "6a337cd5c10d84815af53e1512cff4ca", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457471, "uuid": "f5ece752-fee9-44f1-b08a-3ac6147deb71", "comment": "Malware payload (CoinMiner)", "value": "0827bb6d52a3611950b39274a201a9186f7d6773612c17cf3fb94bfd14fba341", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457471, "uuid": "b000d861-b0e2-4376-8e18-e2d94261dfe1", "comment": "Malware payload (CoinMiner)", "value": "dd298186d2c08e800d866462ee530e3fed1a494b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457471, "uuid": "cd37b830-290f-43c2-9afc-f90e09aa3394", "comment": "Malware payload (CoinMiner)", "value": "4cbbfe7f3c4112c5ed381d7651574b8d9da71c0a5b23c4e50a74742cf629201dd08afcb99b26b03571d995f41bb49349", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457471, "uuid": "74ed68c0-a0be-49bf-a0d0-0d700b998cb3", "value": "T146566D0BB6A264FCC0AAC474475FE573B97178984122797B32949B302F67F205B2DFA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457471, "uuid": "fc600a2e-30d8-4102-96df-1abfa6e0bb89", "value": "98304:F33VBFMby9nL99ctm7ZFcwqu++++++uq+++++NlPlPlJG8oG8oG8MBdFODLYceax:F1BTa96y+i4+vNTrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648457471, "uuid": "3017c06f-23c9-45d4-8e2d-4c4a1deadc06", "value": 6326209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648457471, "uuid": "fb13a07d-468b-44b0-b0cd-80535f3c77b3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457471, "uuid": "56704b08-65db-472e-86f6-f058200b8282", "value": "45.64.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2a975c-ae52-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648443116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648443116, "uuid": "c8103803-7966-4a89-a259-2cc67c127b36", "comment": "Malware payload (Heodo)", "value": "89b0578f70fb70738faf5187a9320475", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648443116, "uuid": "6fa6e89c-54d5-4087-a8d4-bd55f7585f34", "comment": "Malware payload (Heodo)", "value": "0842a73428fe214e0647fb90dbfb1963966a6b0cdf217768f277802e229c52e3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648443116, "uuid": "50786b2f-1ab5-4420-8be7-130e7049d403", "comment": "Malware payload (Heodo)", "value": "4b7cf1d28bdb1862a73a2bc9ccee8f270cb71505", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648443116, "uuid": "c4a879a3-b5bf-411b-9c89-7faa70829bd6", "comment": "Malware payload (Heodo)", "value": "8dd789813c46ffd6a7732ad647f41bd2e9f90a61318d57e021857bad0962bdab13914667ba312fd5dd90b50b6f1ae440", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648443116, "uuid": "9fdfa95d-48d7-4930-a44f-031ca916b892", "value": "T12BA40823A9816172D74F57B26ADCCEEC739E077103C5C0CF0AB819793AB29E66634947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648443116, "uuid": "a660381f-3ae5-42a3-ad78-d27b5427594c", "value": "12288:78u2rsRwkKeb6hsHN36rXeL09CTZ5X2wA:x206S49CTawA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648443116, "uuid": "110c5058-ac4c-428e-a201-71cc883ed097", "value": 485989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648443116, "uuid": "43d00df0-a158-4c6c-82c8-e69418b05c1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648443116, "uuid": "cb2f2fb7-85aa-4b08-a5f2-bb21fe61ac95", "value": "emotet_exe_e4_0842a73428fe214e0647fb90dbfb1963966a6b0cdf217768f277802e229c52e3_2022-03-28__045151.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75854024-ae73-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648457145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457145, "uuid": "5daed6d4-c9ed-4fc1-a888-ead9e52ae8bf", "comment": "Malware payload (Formbook)", "value": "d351703bda08a7ecedd5dc0567b2686c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457145, "uuid": "275c07e1-0595-4905-bab3-3c4d7528aa47", "comment": "Malware payload (Formbook)", "value": "09ebcb323865c97c1303942fe7a07144ec7a505147f3b0548f621fa1a639ecee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457145, "uuid": "ca50b834-c5a8-4b6b-bbec-1993d9f76dbd", "comment": "Malware payload (Formbook)", "value": "93a11f580e7d9aba08f06c48bea046886afa56ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457145, "uuid": "0f4be191-6642-41da-9140-22005753ecd1", "comment": "Malware payload (Formbook)", "value": "16f3ce8bbec850b249fdeab045de6e8f947a2c10e883821924390741e723be2a8f2a3395e6ffca269247f5841ac1271e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457145, "uuid": "3a531458-5595-4dd1-99f0-9a197d0b87ea", "value": "T18AF39E32D741C071E2A242F5B2AD1B7B893E0D34235560E6E7E219A56EF19E5F43930F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457145, "uuid": "c4d1aca5-b8b2-45f3-84dd-ed6fb188fe33", "value": "3072:g3J2aj2FnQ8oFnBjMK1pJ3aGx0g9KF2PmN133NU3lBJLT6zuF5+Rs0L4:gMlIVMK1fKGf9Y2PmwT6qF5+Rs0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648457145, "uuid": "1f97d0b4-54d5-4114-80d5-3473acbab4e8", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648457145, "uuid": "58ff9450-52f2-4e57-ac8b-dddea3f0668c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457145, "uuid": "6b880232-2177-46d5-b77f-f434688f86c9", "value": "d351703bda08a7ecedd5dc0567b2686c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77cbcc3-ae99-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648473631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473631, "uuid": "bba3da6f-3a9d-4157-9c13-408aaddb89b3", "comment": "Malware payload (Heodo)", "value": "5e427a15006ea3b4ec2a38dae465cfe6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473631, "uuid": "26d575e0-0e60-442b-bd84-8192a94666b9", "comment": "Malware payload (Heodo)", "value": "0a0fb8f6cde81cfdf1b2a1f9b2f7b19942ed6ff7a435ba13ae9ce1c76d2f8b8b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473631, "uuid": "fd4b93aa-a781-4c5c-af7f-9ebcdc585554", "comment": "Malware payload (Heodo)", "value": "c35076dddf3be9525fc5d4f31a5771b000a10923", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473631, "uuid": "2c02edd0-5c18-428f-afae-82bd42104057", "comment": "Malware payload (Heodo)", "value": "9f282b232b78223f2423fd4b3ab196c31da7697adc41f30427f75ddf1c62174539ef7f8d20fe13c773badc1a0cfe497c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473631, "uuid": "2ec396a4-85b4-4544-8757-753b02765f54", "value": "T16FC428936AC3C077E41F0279861A92287267D5327756E6CF3BC5E71FCA387A2A738150", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473631, "uuid": "b63945e9-dd7a-4d64-8624-246ee94e412a", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473631, "uuid": "cb5189f8-53fe-47f6-b10d-7c24205eb910", "value": "12288:wGOAWAyzLzHKwJrCf9dJJjI1rMpUsN+JinUqqOYJIO:w5aYJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648473631, "uuid": "955a4989-0815-4cdb-96bd-730b12e1e69c", "value": 573024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648473631, "uuid": "1f098255-b95b-4b4a-bd23-7a3aab2c151c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473631, "uuid": "43be1e8f-b3f9-4144-bff3-82cbf0f86385", "value": "emotet_exe_e4_0a0fb8f6cde81cfdf1b2a1f9b2f7b19942ed6ff7a435ba13ae9ce1c76d2f8b8b_2022-03-28__132026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c915ef47-aeac-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648481767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648481767, "uuid": "3113f8b9-6f88-43c9-b9ce-0de25cc1e5a3", "comment": "Malware payload (AgentTesla)", "value": "26e8be6828c18d64b60d113a0b6b3081", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648481767, "uuid": "9377f599-e6e8-4ea0-bacb-422cf4ced22a", "comment": "Malware payload (AgentTesla)", "value": "0a2e598f1370275cf346105f94c547a0615647ec19b5b06347c999b640730ddf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648481767, "uuid": "f23887f5-b86b-43eb-a5da-df1945bc7a62", "comment": "Malware payload (AgentTesla)", "value": "d063000511d4f4c78ba9e39e126458df353e9dc1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648481767, "uuid": "9e5260c4-8cb8-4cdc-8726-4c4f8c9c03fc", "comment": "Malware payload (AgentTesla)", "value": "c7e6fe9802dbaec7a009c3bee22b37c6c29eb5d50058751622f52af1b3a49952a238d6b07d518fbb9867086b7b6e8ddc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648481767, "uuid": "f180c442-a265-469d-b2e6-a6286f3146e6", "value": "T1C13533C19E0505254AA1FD9E59645032B950E78ECEF4DC6CC18167B826CFBFE7C22ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648481767, "uuid": "b9a2507f-f073-481c-8ed3-e676456e2ef8", "value": "24576:iOxPDd80j6zob2vrgcpMYrjFMRCesxQ7JZK0AqyPz8me61qeKHv7AEW:iQPDd80ezIgdpLvFMR19bKFqyrHqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648481767, "uuid": "3707aa46-adaa-4238-ae12-d12f42bbec3a", "value": 1099804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648481767, "uuid": "d5439967-ccee-4330-b74f-53b06b769886", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648481767, "uuid": "84af2968-7245-410d-9e43-f85c28a10139", "value": "AWB5032675620_PDF.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1592166-aec1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648490854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490854, "uuid": "ebb2a512-0145-495b-876b-7ca4000e307e", "comment": "Malware payload", "value": "912f446bba061fe63ed8e2ab17c4c3cf", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490854, "uuid": "0647c91c-c400-4e34-be20-4fb7f3dd2033", "comment": "Malware payload", "value": "0a5def83c8c789c105bbbb75bcca23f3914050ad4f53b3e9279d4b09c539e91a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490854, "uuid": "e6a14735-78d4-4c68-84e7-8b3894ab0edb", "comment": "Malware payload", "value": "40d3786269df8189dfe910fa086d9528cce30c4e", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490854, "uuid": "d3405ad2-d337-4546-a4ab-4467e8df5ea9", "comment": "Malware payload", "value": "cc2321f0774b429994202159cb1460b8ee3752f1fa59c415851139b71cbdbda34e92b3085b4fd2f2f8932645b42f0478", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490854, "uuid": "ea8d3634-c28d-479d-a888-1bbd29ff66d7", "value": "T1B5E56B23B2C465FAC06B0AFAD5F7A718993F6A6125128C5647F0488C8E75B413B3F637", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490854, "uuid": "925d2550-a6f5-4140-8a4f-5b3f70676ea3", "value": "49152:FrtiJ9ApqlD3bSdDKE/nWS/b1w4IEEZGSrTiLiQOboAt+dYf3A:ziVOdDjEiiQlACYfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648490854, "uuid": "eb7d5490-2a36-4019-8cb7-46ade0bb95b6", "value": 3307008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648490854, "uuid": "26c2c007-7108-4c31-8f3a-3db53b77f973", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490854, "uuid": "d657cbf5-25ac-4d01-bb86-3823b730445c", "value": "Fact.ArchivoEndesa1703.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14a6dcf-aee7-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1648507067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648507067, "uuid": "20f5c074-8bad-4bef-ba27-14fe8cfc9089", "comment": "Malware payload (DCRat)", "value": "17b190a0b78b314160beb1a6e2777ce0", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648507067, "uuid": "076b942e-7995-4317-aedf-32c45eafad3e", "comment": "Malware payload (DCRat)", "value": "0a745b0f52fd92c4ae5ba28c3d591f4cce99c5353e60468006332e3f62f493ca", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648507067, "uuid": "710197fd-18f4-47b4-b5e1-ca3583b18181", "comment": "Malware payload (DCRat)", "value": "aa8cc1884502aa0a82b61c2f560b35c8a26249f5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648507067, "uuid": "d6c5f6f7-2a8e-430a-8ab9-36a061f31ccf", "comment": "Malware payload (DCRat)", "value": "0f13445d1f20a25b636a06c55fecb7b1c201f4b9cbd36047c1942bc867fa353fab72f970f201755a0cb604e100ab89b0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648507067, "uuid": "83afa15c-5a7f-4a5c-a4bc-07ca8aa07df8", "value": "T162C5D0867AA8CE12D0690736C4FFC11843ACAD427AA7D71E7E8A33AD25113E71D4D5CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648507067, "uuid": "d3f20159-9ede-4524-aed2-76d9892569c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648507067, "uuid": "a97c0b82-1e09-4391-8384-a7f8e5bde36e", "value": "49152:9Oy2AywDnYRgmpigoNiEFMNpUexO8KU8oKkonx/FAgqNxBECLdGaz1Nu:9V8emiiEFMUsFckMxOpNLLt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648507067, "uuid": "60f183c4-85b4-42bb-8a54-b08617d9b2ae", "value": 2587648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648507067, "uuid": "2b0fbf52-0e73-4434-ae5a-2063fc845960", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648507067, "uuid": "30cec2c0-5f20-42cd-b223-c056b7873018", "value": "17b190a0b78b314160beb1a6e2777ce0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e02be98-aec1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648490687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490687, "uuid": "06c38bd5-b173-45ed-8b2c-787f70b1f0ec", "comment": "Malware payload (AgentTesla)", "value": "21c8dc924c5d38d0ca23b09c2458c7f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490687, "uuid": "28a86c0f-ac21-49fb-9548-390561b83dbd", "comment": "Malware payload (AgentTesla)", "value": "0b6d1d4f900ee4dfa7c174b60212424a44202412ba98061f72c43e5a1262cc1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490687, "uuid": "56bb2c86-fa67-47f3-874d-1510e3e4dea1", "comment": "Malware payload (AgentTesla)", "value": "92032ddfc079dc4dd8045c57efc1baf4e52093ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490687, "uuid": "6ecaf9a2-206d-4080-ae3c-98371ef7e5e9", "comment": "Malware payload (AgentTesla)", "value": "4216b288cd557940b62a565378742a4574b6c009771ccb753fa22b6c0478d95467d2b2116ded44dd652b99ae3f754ee9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490687, "uuid": "c63e7e3d-10f3-4e8f-bf1b-edfabff6674b", "value": "T1E0A48FBC7A414A72FD1EC131AD510AC4BB670B036280AA9657FB16CA874F0F76E45CDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490687, "uuid": "5c2dc57c-b8df-40f9-85b7-1e7873cbdeb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490687, "uuid": "48dbd7d3-338c-48a7-b0be-08c705af3cd8", "value": "6144:G/fBJTEQIIkt2THfO9A9lHPUmImo2lMcMWpNNbNbyOh:aBJTETrOeCtPomNMuNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648490687, "uuid": "6699a18f-f5ee-43fe-b4b3-95415bf02819", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648490687, "uuid": "9a9d2e80-b66a-4573-92ba-d85d0cc09d02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490687, "uuid": "17c6e53b-ee94-4168-b4a2-11b375197c70", "value": "MV MARDINIK - Voyage 1 - TRB-220018.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2e1a49-aea1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648477079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648477079, "uuid": "c41e6307-b0fc-4539-8846-c2d6da2238a8", "comment": "Malware payload (Formbook)", "value": "140fb0fd91e99bdc4950b1bdce607b9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648477079, "uuid": "2b6a06d6-908b-4f29-a63e-ceea2880ce0c", "comment": "Malware payload (Formbook)", "value": "0c00b068d5bfd4dc81a3868464cdc8058a8a258db2b446722a601eb942b69068", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648477079, "uuid": "bef51c06-3c05-4a63-81d8-95cc32fee113", "comment": "Malware payload (Formbook)", "value": "105fa71b7885b5b941eb4594cb865053ad47ec17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648477079, "uuid": "34487aec-9551-4562-975b-f8583abd3c88", "comment": "Malware payload (Formbook)", "value": "4a6170d3b2fc79ddad6355757dab45ac2e1542f7a6ab55fee69d3bfcb2d56e1317eb08fe08aa044f1bde72e1d930ec2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648477079, "uuid": "626b5b1b-b18e-467d-a46e-2f9a64a292e2", "value": "T12D45CF22335A49C8C834A276CD9A60CC07F02EC6DD2EDD4B39D132EF36717A15AD5A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648477079, "uuid": "9613968d-6ac9-4216-847c-a7c5c4d66a60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648477079, "uuid": "05ac8e90-73cf-4768-89a7-cf87aef6b3dc", "value": "24576:XJ9AUjeUZ5gcvBKC9jopZzlpBSh6sZgYBpiPQxt+:Z9CUQjgopZ/BhyNi4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648477079, "uuid": "07e852f3-e691-4129-accb-2ef3adbad282", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648477079, "uuid": "0e569e04-b69c-4ccf-b8b6-4071d6b4243d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648477079, "uuid": "003d68a8-a0b7-48aa-bdce-8dafa7aece60", "value": "xqhIo0EIUpE1vTp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7d7db7-ae6d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648454446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454446, "uuid": "e68c14b7-0f69-4c1d-b333-08023ba8ae84", "comment": "Malware payload (AgentTesla)", "value": "c57458c975e484181ad2b5f69228ff6d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454446, "uuid": "14cf6aa4-9720-40dd-b3ce-1e0b55d9167d", "comment": "Malware payload (AgentTesla)", "value": "0d34612769ca0bec0bda68a9b182b7477107288b8272f855e6e75bd0b330dcdd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454446, "uuid": "40ebee65-36c4-4ab2-a946-e5bc8589343b", "comment": "Malware payload (AgentTesla)", "value": "6e373fa260021acad0d3fa186fc6b5b81328e50d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454446, "uuid": "ff5844ae-b2eb-4564-b6e8-244585433859", "comment": "Malware payload (AgentTesla)", "value": "cced62f86326ffb37f3ff8802763adb4bc7d91cf839e61f4f2529eb47aaedb50c87c5b00c84c00c5e9d19239160bfeae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454446, "uuid": "f730a6c5-7e9c-4e84-80d6-f8e7938fc69e", "value": "T16BA49D403EA5DDCEF3394134309F666EE462AFA5698608BF173B7E9007F76462B86035", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454446, "uuid": "cc872071-aa59-406a-a891-7773669665f7", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454446, "uuid": "c0e4ef54-f0aa-4f27-86de-bf180930d470", "value": "6144:oGiPgFvXUJD8yt8KyWyVjvPOB6t/JC+XmlwgkEw2cryk4pxITFJIKtMxM:BADltfyFWB6tlzjrjSxIvWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648454446, "uuid": "a0fd6101-7195-43ce-a956-de2bff3d81cf", "value": 472802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648454446, "uuid": "305195d5-0bb6-40bf-94f6-9648cd218b3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454446, "uuid": "9194962d-58fb-4d15-a49f-5aa5f21d2066", "value": "c57458c975e484181ad2b5f69228ff6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c17f80-aece-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648496237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496237, "uuid": "c5eaf13a-486e-4c90-b707-ffcdb21e6086", "comment": "Malware payload", "value": "2f5cabcc8db31c8a955a0708e7bd8071", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496237, "uuid": "be072541-cbbb-4b86-9aac-24406164b48e", "comment": "Malware payload", "value": "0de06f35a5c31c70dd592e15c7ebe43fcacd0935828855f59df4b1d322e05bdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496237, "uuid": "c31ed5d3-1599-4bbb-b14c-bc6dbcc89b88", "comment": "Malware payload", "value": "d45f029f36f2d3e83fd671f58bbb0fb6576ef5ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496237, "uuid": "e6b1d59b-36fe-4558-b262-6146673d6cf4", "comment": "Malware payload", "value": "ee71d228518eff43ed2b91946647e09fe33d5f8b2e3bfec012f001505a95de1ebca3b4c683b44c18df71abbe52baf2ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496237, "uuid": "d83b31e0-75b5-4856-9aef-65cc6949ffaa", "value": "T1C495F1099147E2BBFCFD08A3045081D4C29C7FAA7B528DCDE97AD58A141F482B7B6D87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496237, "uuid": "467a4d0b-1dd2-4975-9c9e-89600acec05c", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496237, "uuid": "e28b6bba-920b-41f0-ac9d-8eb47218d99d", "value": "24576:4ry2uXzmVLeIhGQ/mvcqh/wfQFJfRjWh3jJztOmzE48m29:4unZIhL/r8PFFRAhZVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648496237, "uuid": "1dd6098b-d204-41f5-9c95-61acef328e32", "value": 2005292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648496237, "uuid": "8d318190-9c28-4655-be43-992e83ffcd30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496237, "uuid": "a15d18e6-023d-4199-80f8-22b87ab954fc", "value": "data64_6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca742ae5-ae9c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648474897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648474897, "uuid": "dd316fff-ec3b-4e54-a631-9ae183b78b16", "comment": "Malware payload (Heodo)", "value": "511b6f90e08b9e9fa54a3007e07107be", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648474897, "uuid": "36db381b-96c6-42b7-805c-ff69048a5ffd", "comment": "Malware payload (Heodo)", "value": "0e4f12b99da1af3bc85791b745aedc30a309779b947426482cc8a6ccb5a2f249", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648474897, "uuid": "6c255e8b-fed8-4d4c-bfef-15d1356fd370", "comment": "Malware payload (Heodo)", "value": "eedab34176b9955ff5088a406b25cdecbca83a7e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648474897, "uuid": "1ab2c91f-e9c5-46bf-9040-9295754a27b0", "comment": "Malware payload (Heodo)", "value": "14c3c523b2475c3c29b898ed5bcdfb2d720f27db1c1c43aec404d2e56afd940158226ae290cee0b0c9e494a4cafe20ea", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648474897, "uuid": "3d041a3b-77e2-4558-9a7d-8d477a56baed", "value": "T10E43E95BBA49985DEA14877548E743997323FC304F6B074B3269F3257FF89A05A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648474897, "uuid": "e45357e9-0e7e-4f5c-a0b8-25632c2c1a9b", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umvP:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648474897, "uuid": "3eaa3823-e606-491d-9298-c34fe7383c43", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648474897, "uuid": "398017da-2589-4e2b-b8e7-b4f9bf9da4d8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648474897, "uuid": "7dedae2c-9ee5-41af-9505-30db4d673552", "value": "1004058864727460483446.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d009a22-ae63-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648450286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648450286, "uuid": "2ef36073-0ad5-465e-a1d9-d4ee5b7addf7", "comment": "Malware payload (Loki)", "value": "cc162f9dc06792c6ec844fbc79524821", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648450286, "uuid": "d36cf42e-9bde-41fd-8b30-d02a89bd2206", "comment": "Malware payload (Loki)", "value": "0ea330e955ada5829b367e6c0d5146acc32c517e992fd02f659a92ec98a5dff5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648450286, "uuid": "d6d35055-5f64-49da-b43d-f2303ee54295", "comment": "Malware payload (Loki)", "value": "dba40a76f9a2c44f978695beebd6f1125b8a9bfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648450286, "uuid": "975d4463-c7c3-4fc7-bae1-de06ad4253fc", "comment": "Malware payload (Loki)", "value": "4959fce4a0efa0b301a8b7ef87bc257ba7708454bbf6cdf2a0fbea02b4937b0bbdaae1ee527e125d1e23f5b632710491", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648450286, "uuid": "264dc35b-b4cd-442a-b939-a5c6e85d3753", "value": "T1E135F11221B0A745E17A53BACCA980DC43713E1A7E7DD65F1EC136CF0A71B828A29F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648450286, "uuid": "88c1ed20-2fdf-47d2-8943-949a0dab46e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648450286, "uuid": "79acaa6f-e9c6-4225-ad13-abd06ed72ae2", "value": "12288:rpdcCFcS4X9/fX+IpUdsGSkwHuICUz9c9UOaYK/2lfu0onJmuB54IDcb/DsHJFJ:rpnK19H+WGsGQOIC4NOaYWZ9nDcbLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648450286, "uuid": "dff596a7-080f-49fc-a891-9a4c1509e5bc", "value": 1065984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648450286, "uuid": "0f6016b5-6ce8-495f-be03-1eeca936063e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648450286, "uuid": "030eb300-c211-4ede-a134-11cf3a77baad", "value": "PEGASUSPDA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e40f4239-ae59-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648446164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446164, "uuid": "dd19365c-f020-4447-b67f-a29db0c6d4b5", "comment": "Malware payload (Formbook)", "value": "8862b0b8cf6f94732df9ebfe73b0b74e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446164, "uuid": "4979a4b1-68f7-49a4-846b-bf384e3fdd4d", "comment": "Malware payload (Formbook)", "value": "0ec0f53190782e1c4b92039ba199e2fd71ce3a620c628ffa569a06a53fa3cd4f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446164, "uuid": "2d390ede-91e8-443f-a42d-b348d281edec", "comment": "Malware payload (Formbook)", "value": "43b194f0408ec0f4904817044d221ace00553054", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446164, "uuid": "9926051d-a285-402f-9780-252a9080eb77", "comment": "Malware payload (Formbook)", "value": "09779719e21b3cd74531c6af870502d145bd373c866b894e8b2616aef6ed2b8ba6095bedfe8fa7b99dcbbca5d6af1e6b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446164, "uuid": "f522e1a2-4ec8-45b4-aead-4141dd7da9c7", "value": "T1666533D96FE31D714EE45AF4C9E8227A303C3519A1990765C6EBBB421F178D86C802EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446164, "uuid": "ddf7da16-1273-4207-8afc-ec0d7acabb6e", "value": "24576:o6JimN4jfzMDd0jd/u5Dc6UYz0nULU8Kr6vaoDL2Ut3A6ZEAgyoMzcuUnCAphn6N:oBzMq5wD7Yn58DCoDNtw6ZL9oM9UnCAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648446164, "uuid": "b1116f6c-19fa-477f-84e5-5f6f4e5f3b86", "value": 1479030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648446164, "uuid": "e634d62e-9d55-4649-be3f-beaf9caabd68", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446164, "uuid": "2b6fc265-c2cd-4b68-ad3c-7b75b3cdd0f0", "value": "revised PI876345678.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1326d5a7-ae46-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648437653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648437653, "uuid": "e592b44c-ff51-4c6c-afd1-14de74e5383c", "comment": "Malware payload", "value": "848dc30afe377fdeb82a45539a6ecf62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648437653, "uuid": "79aa412e-be2e-4e54-ab24-8f9151aabf52", "comment": "Malware payload", "value": "0ee6fbd8eb2275164accfec12e1e55cecb07dde988df23984fbbf054f2b24c87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648437653, "uuid": "730c8241-2dec-4b62-aae3-89e9c3c154fb", "comment": "Malware payload", "value": "0d1a038e77b5be899928d2459532edecf329695a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648437653, "uuid": "b3a5e345-d9a6-4421-96d9-811ae98b5e41", "comment": "Malware payload", "value": "e9ee39cd6870a3d942b4ef5bb6b59a395609c74d5a3e5616bd7f309fb3f3c5530ac0a4545ef2f314ad477cc78b1665a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648437653, "uuid": "f4a15e3c-b643-48a3-8b0b-85de5e5001e2", "value": "T1CE9523920719E6E5E388873045D5E2940336AD7918ECA64FE928FDF83D31A83653B35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648437653, "uuid": "f6c0459c-f643-463f-9579-525b1f326329", "value": "a7fdc3ef825112d1bc87f36177ae2024", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648437653, "uuid": "a9f345c1-2c06-4e8c-93fc-9029414456de", "value": "49152:9uQY74EngalSORx7ao2b5KwM2GU/adsKnrr:9uHEW4G75cjM6/ysQrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648437653, "uuid": "b874b6a6-9cbf-4f9c-a21d-6e1baa42d3e3", "value": 1922672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648437653, "uuid": "c08e15f9-630f-4a48-b52a-09be957fa603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648437653, "uuid": "fb397f7c-1bd3-4b43-9f92-5a5d22ebed9c", "value": "FCPacker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2bc1fc1-ae81-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648463261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463261, "uuid": "81cc3427-e3d7-4601-b059-88201fc569e3", "comment": "Malware payload (Heodo)", "value": "756205ed5fc923c13b9f5c9fdb7c30b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463261, "uuid": "ef2e0d26-da9a-4241-bbd8-eff39549c7bc", "comment": "Malware payload (Heodo)", "value": "0f260d938ec071bf17611da160b512ef0f56432da56bb81fc5457f5fe4910fa7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463261, "uuid": "e6de1f52-7e63-48ad-b619-f878c0c3d188", "comment": "Malware payload (Heodo)", "value": "f88026bb1fbce6780ed2640730b43ab578d98918", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463261, "uuid": "7b9236c0-cf3e-4d03-b242-1b14b5c4296c", "comment": "Malware payload (Heodo)", "value": "2cc91abbbaa837754c416c6de7ec3031f15c533dab37fa741aa457789ec627ee0d42592a65b9c390096a5b11ce17a95f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463261, "uuid": "4d1d8091-4954-4cb7-b61d-de907e36b502", "value": "T11D94CF0272D0C47AC6EF23785D239B5AA7F9FC208A75C647A751BF8D5E326C1893035A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463261, "uuid": "3921dac2-bda6-4c0b-a558-cf7cccdf9097", "value": "8f8b1cb86c6697dd342b65a36c6ccbb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463261, "uuid": "1dbc8515-6b50-4c47-a453-dd3bf8286902", "value": "12288:zwn2hR3547jpDMgySyxpuCMS5AhugWarPU:DRJ47xjyFpuCMSqumrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648463261, "uuid": "ab25fe33-c569-4151-98d8-c8f7dbedf798", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648463261, "uuid": "f76438e4-6e56-4d5e-b580-b6168672109d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463261, "uuid": "9a1d9e49-eb25-444d-8226-4c429ec2f0ec", "value": "756205ed5fc923c13b9f5c9fdb7c30b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e64505-aec7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648493405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648493405, "uuid": "18d7293f-1fe2-4ed3-af42-075c75945b38", "comment": "Malware payload (Mirai)", "value": "e8e0c0d40166f3a4f2a125a7ae80f8fa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648493405, "uuid": "a3160fd8-51d7-4b36-ab1e-cf54f36ba1b3", "comment": "Malware payload (Mirai)", "value": "0f2896cc1f95e67cf32ced2e11530e8fa00b2246eeaaf0b3fdcecf63350084ed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648493405, "uuid": "7a1b0493-def6-4cb9-8a3b-73397d99a3e9", "comment": "Malware payload (Mirai)", "value": "12bf2ebbe57d6181ac83402c3183b975ef6ffacf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648493405, "uuid": "a107e043-a40a-4863-9038-5024803b0c63", "comment": "Malware payload (Mirai)", "value": "cbf752aeb282292f3ecef7801eff32072ce4f647137e1819c6af31217955dc58600a98f735fa132c3e654a71523f34b2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648493405, "uuid": "f2ff3566-24aa-42f9-8c1d-652f73b419c2", "value": "T1C32302432093BA03E03458FA85728CCEB65EA67CB1BF7BA625440D154C75DA3ECB18ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648493405, "uuid": "31709378-4ff1-481f-9af3-5237fcb329ba", "value": "768:lK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFi9q3UELWt/iw+kvBGg6+fYtrBHV:N12O1LCNguovDPH7TcrhLWhiw+kvBGg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648493405, "uuid": "f47fb59e-c75e-45b3-a75a-d9527ef2cb2e", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648493405, "uuid": "81e46ca4-b5c1-4c4a-8077-a7f7d4491a1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648493405, "uuid": "a390a356-b6cf-4050-8fed-c4f735679a70", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c68a3cd-ae69-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648452701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452701, "uuid": "2d8694d3-3128-4af9-a122-b96575859551", "comment": "Malware payload (AgentTesla)", "value": "a2f8d47609768059c1fa3b4714c0698c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452701, "uuid": "cde613a2-4332-4eb0-a390-4741d6f7e08b", "comment": "Malware payload (AgentTesla)", "value": "0f47dee1efc24c903209fece83e4618e0f8bb663a7fdb05321fe3c1c8bdcdfd8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452701, "uuid": "a6caafc1-0112-4d1b-819b-72a423d5c588", "comment": "Malware payload (AgentTesla)", "value": "7e9ff14181b32f91f6df198d8ae517c5c1a9b5b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452701, "uuid": "53d36c67-f6a4-4ea4-a5e8-7cbe584efc73", "comment": "Malware payload (AgentTesla)", "value": "fd6fa1f15701ada914feacbc7fae9032e4d40f1e5161ace6835cbf7a56d3ade77b16cf8737e7d9cd98af5ef52e7df3db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452701, "uuid": "941df39b-b46d-4689-995c-38b009e2db26", "value": "T14FE4D6ADB2F075DFC86BC075D9681C68BA907CA7930B4103A02735AD9A7D987DF143B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452701, "uuid": "c9fe5263-467e-458b-afd2-f049f396b561", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452701, "uuid": "c49a3eb1-f1cf-4c7f-92e3-8fb1720325e5", "value": "12288:6fXt4jnSakJ8ZULpeCz5aeXJ5RqkLplRb6tt+XHCpyWWiirDLITwnJOV9l6w07+t:6fXtCqJQULpNpXJjq0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452701, "uuid": "1d5a6ee8-6e1b-46aa-9756-34d96cf9cd86", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452701, "uuid": "3729f88f-c47d-4ad7-95c3-f001bab509b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452701, "uuid": "566a6a83-7a81-4abe-818e-12ccb359b243", "value": "PR 11442066__S10-346-17 PROJECT__S10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05e1671-ae6c-11ec-8e58-42010a9c0032", "comment": "Malware payload (SystemBC)", "timestamp": 1648454238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454238, "uuid": "e102ecda-5f31-4644-bc7f-a1502a0209ce", "comment": "Malware payload (SystemBC)", "value": "5366cfb7213ba42e13f5a07ba83a6353", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454238, "uuid": "3606aa9a-cba8-491c-8308-853f2d63f4e8", "comment": "Malware payload (SystemBC)", "value": "0f88cfd80dda550bf8ed08966821d84f6344fa6110b248e1148f06109c9a9f96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454238, "uuid": "eff4edb6-0922-4512-9c04-065ebce6f93c", "comment": "Malware payload (SystemBC)", "value": "958421f6fe7a2928578157c36b366578bc4e1b18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454238, "uuid": "0025810e-dc25-423d-ba5e-2a4a876d4981", "comment": "Malware payload (SystemBC)", "value": "e876b84d92b9ccb76efb959f2b188632b8184742ec0505eabe04da6e0737800f865888464cc340474859661b40f3f6c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454238, "uuid": "6dd596ca-c8c0-4289-ad5e-dc20d820eb4a", "value": "T16E449E10BB90D035E1B712F8497AC3ACB53E7AB15B24A0CB62D55BEE16396E5EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454238, "uuid": "a2e847fe-88ad-4b3a-9e7c-a5aeb167ea8a", "value": "112f301b72f7079fdf51b59676b2b142", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454238, "uuid": "0b868ea0-4447-4f0f-9c95-018cf72063db", "value": "6144:sJW5mzhwjT0tq4/JF2g/wVQtnlYbBxUX3FtCo:svzhwP0tBAg/cQ0HU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648454238, "uuid": "c4521f1d-5608-4050-bfa6-3bd5bee1056d", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648454238, "uuid": "e66439a5-0ef1-4b9e-acfe-6aa1a966d13b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454238, "uuid": "31eac4c8-1f3a-4e5a-af9a-4cbd2ad8b26b", "value": "5366cfb7213ba42e13f5a07ba83a6353.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc70753-aebd-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648488965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488965, "uuid": "dfb3fafc-916d-4b24-bb9b-da8801a31297", "comment": "Malware payload (AgentTesla)", "value": "df48c14d8b225d71df3ea1ce0edffa85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488965, "uuid": "ea5a6655-1cd0-4fa8-b8b4-9df5e2b67b50", "comment": "Malware payload (AgentTesla)", "value": "0fcde5165bb00b5a681013cbc1532dd4fa2ca02a3ef54aa74bb7b53b0f38697a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488965, "uuid": "c4197084-4dc2-4f13-b80f-24948763e7be", "comment": "Malware payload (AgentTesla)", "value": "00ffd04a5b77e296f7d309fa21435380c4a7dc58", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488965, "uuid": "37e20c2d-a925-451e-891c-82ccf95ba029", "comment": "Malware payload (AgentTesla)", "value": "568254720fc764f3e648aea630555444dc563586d86dc80036d3c46e86169abc32beaa99887afde9ce6ae3b20946d4e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488965, "uuid": "cd1ab7bd-a2da-4279-b63b-913de9b77d8c", "value": "T196B460BC7A414A72FD1D9130AD510AC4BB670F036280BA8657FB35CA876F1F76E45C8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488965, "uuid": "a9238e99-fd00-44d6-ac19-79c740ca21e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488965, "uuid": "663c7f01-d4f1-4800-885a-701a4e37480e", "value": "6144:loitN34kOE29eFNyrb6s7kjzD5V/IPZmuPdBiYqEZBNQujQXX+KDb7uLbz7f:lo0NnOEieFNyrb6zVYZmuKY1TQucX8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648488965, "uuid": "be9e8bff-e26c-4d34-8053-35abf4becd41", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648488965, "uuid": "24e5ae85-12c8-4ff7-aea2-9706b137f863", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488965, "uuid": "d8437560-05e5-4ad9-b40f-28e9c81339ee", "value": "MV TBN - PERFORMING VESSEL.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d0dc08-ae77-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648459020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648459020, "uuid": "94a94118-0426-4667-aecd-76ffad152d73", "comment": "Malware payload (SilentBuilder)", "value": "1b2f39617e1568a862885f62077bfe8c", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648459020, "uuid": "3ab79506-f659-463a-a9ee-ab9c3c809f78", "comment": "Malware payload (SilentBuilder)", "value": "1004e558a86e697850cf0fce7126f6e7e169d3aa386aed563772c7cdec60c57f", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648459020, "uuid": "56fa8f8e-729c-4ae5-864b-0a5f2cc182c8", "comment": "Malware payload (SilentBuilder)", "value": "cfca8b1050f73fe9ca495a48f4fea919a25826cc", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648459020, "uuid": "a21d4f8f-401d-4cdd-be0c-3ab45d8cbd17", "comment": "Malware payload (SilentBuilder)", "value": "8e9afaaf2c89bd2abc89bf19ae595b7a7e00d43926d1004ad8dddc26146eda879b740c2304f817fe22569beb99afd62c", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648459020, "uuid": "3039bf19-d5bc-4022-b93b-426e206f1e78", "value": "T15D43E95BBA49985DEA14877548E743997323FC304F6B074B3269F3257FF89A05A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648459020, "uuid": "99c3f140-041d-4340-92da-0c08bde8019b", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umvv:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648459020, "uuid": "b97ea945-731b-4e81-b0ee-11539f28c622", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648459020, "uuid": "c63e24bb-f783-434d-b0f3-d780872b61fc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648459020, "uuid": "cc07bf65-dfa7-4791-8044-45c0b71607b8", "value": "SecuriteInfo.com.Exploit.Siggen3.30262.10324.9121", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae72af4-ae71-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648456107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456107, "uuid": "b3e7e09e-d115-4f1f-a2b1-3ebdd83b8e77", "comment": "Malware payload (Heodo)", "value": "3c4bf0a1215ef4590c026a959e826e0b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456107, "uuid": "7358e8f8-e47e-484f-b1fa-162e3153697b", "comment": "Malware payload (Heodo)", "value": "104dadef45ab0909f765cccff05532ceb2e14215ac4d695447fe8849a929d5c1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456107, "uuid": "3a9c8d19-28e8-4e7e-a343-e2a3667d4f29", "comment": "Malware payload (Heodo)", "value": "9c7ca81b4479ce23fd6e17b22e4b02aac05df711", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456107, "uuid": "c8aa7e35-a585-4df8-bb6d-5aaf8125ac54", "comment": "Malware payload (Heodo)", "value": "72bb88d4c2849f3332e49dfb039b93436382bce8bad74898d637b5ac4259bb795005ec8c36b8afd0a221dc1b75ef0e03", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456107, "uuid": "f5527539-3ae9-41de-bd22-f959189d1e42", "value": "T1F643E95BBA49985DEA14877548E743997323FC304F6B074B3269F3257FF89A05A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456107, "uuid": "0e7642cc-1645-4d30-af9e-7707b16fb158", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umvT:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648456107, "uuid": "bacd8a99-8a5c-4b61-8fb5-ea045c69e631", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648456107, "uuid": "d4cb2a01-d1e7-4cc7-ad38-00ede685bf8d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456107, "uuid": "b356995d-c0ed-49ac-a0c5-d8a704bdea99", "value": "Media 10 Limited.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46a2bf4-ae67-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648452151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452151, "uuid": "efebf473-8ce0-40b1-b630-8766a3b785be", "comment": "Malware payload (SnakeKeylogger)", "value": "5cfb728941adbeb29e2eccc319e7cb62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452151, "uuid": "c18ca662-b5d9-4196-aba5-ce920fa3b7ac", "comment": "Malware payload (SnakeKeylogger)", "value": "106b473ed2fa0b2928652169c8a95473bb5366f2e02feac95bb735bfd0f375e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452151, "uuid": "62a2a3bf-7e32-41c6-9203-e027f2d4ee06", "comment": "Malware payload (SnakeKeylogger)", "value": "d093c15d2d538e9f86a2fa8587079d7c33aac9d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452151, "uuid": "43e2038c-71d8-4299-b74c-b3f5b8067468", "comment": "Malware payload (SnakeKeylogger)", "value": "5c1d5e9847f74082f27a81388ffa2aae912caa26828335511d6c43736dbc3894729eb01cf7fde9c07cf6e9df01dcae82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452151, "uuid": "aa4702f4-f5ac-4a51-8919-706db195bed0", "value": "T1B1C493ADB2F075EFC86BC176D9A81C68BA507C67930B4103902731AD9A7D987DF143B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452151, "uuid": "1b8b3659-b3f7-4bbc-a7be-033a30ce1c7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452151, "uuid": "be3d3d98-6258-45b0-aa22-9c9254f374c8", "value": "12288:/fXt7BIYY0dg6YC4/NwW3OYZMrKSfF1Aox5fUfOYsbltbXPyubD5YejKgL5uXBms:/fXtyYYrCkwOZM/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452151, "uuid": "ae5a866c-0a46-45fd-a8f4-c84a765a0a2e", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452151, "uuid": "1a332ef5-b0b4-48b1-b1b7-802f14d3803d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452151, "uuid": "f22fc838-ff33-484f-a535-e5916a49665a", "value": "March 2022 Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308d684b-ae6e-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner)", "timestamp": 1648454882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454882, "uuid": "ba84be84-a53a-4aff-a18f-57faa5ae33db", "comment": "Malware payload (CoinMiner)", "value": "d1ae17986d2b258ce218602eb3fc6fd9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454882, "uuid": "e87e52f4-1b7c-45c0-b8c4-48566ba4c6e8", "comment": "Malware payload (CoinMiner)", "value": "10c0687f586f23c486cb2186667a5edae3bb831ace8a6a9e1c92cb30879e0bf7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454882, "uuid": "aaa81c6c-57a1-4fb4-936c-b85fc8166990", "comment": "Malware payload (CoinMiner)", "value": "f149c7ba9d6fb6b0a5759fce6a6df419b45b928d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454882, "uuid": "9e936001-5be6-46df-99d2-34298892108e", "comment": "Malware payload (CoinMiner)", "value": "5148855afd8ec815744d32264b70858292eda8be7b22ce912db57c833f1fe80e828d7e55c339cfa294ede9bf35c8da60", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454882, "uuid": "ecb879a1-3b20-4ae1-b640-815dc1e594e5", "value": "T192269E55B2A400E8D9BAC078C64BA917F7F1B8194374ABDB17B052690F23BD06E3FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454882, "uuid": "99c76aeb-d2f2-4fac-97d2-69d088da8f3b", "value": "98304:/RLRLj41OH4wAIOF+kmcIxJr+fx3k/sc37gz+li0pjY3l5x:nj417x3Msc8Kli0JUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648454882, "uuid": "961d96ee-f692-4382-8dcf-2f2b94f86abe", "value": 4750979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648454882, "uuid": "d9cb4021-30e9-4a9d-9b75-faa2b13a681d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454882, "uuid": "5a16db31-574c-48fd-b282-6525cc942981", "value": "d1ae17986d2b258ce218602eb3fc6fd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa3bc98-ae80-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648462960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648462960, "uuid": "c2932ada-6c58-4273-8d6a-172154aded7d", "comment": "Malware payload (Heodo)", "value": "dba6dd32a51071319612f8b743d0b6ce", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648462960, "uuid": "072636c4-ee4a-4d34-8d16-28eaf7ed73db", "comment": "Malware payload (Heodo)", "value": "10e8c19f754e49253be6be51f7939867058c378ecba811d03458b9549476e2a2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648462960, "uuid": "b8620428-d0d2-41d4-bab4-84b0a0ee352d", "comment": "Malware payload (Heodo)", "value": "8a3ae27d440e82619c105c38b8b4e8eff5d8c949", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648462960, "uuid": "c379f714-dbed-42dd-bf4d-5de9dc4f609f", "comment": "Malware payload (Heodo)", "value": "83994ac715941cf25b2ce948061d86e9c401b66cc077165b8e688993c8fa511d0c26472575620136e9276039745de680", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648462960, "uuid": "e1866dd9-1d07-40fb-9d14-566f5bcd7865", "value": "T15C94BE2176D1C07AD9DF02365A07C3A962F6BD708DF5C247FFD53B0EAE321418A29299", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648462960, "uuid": "f8b8b28c-d8b3-4e4f-adeb-438d450c6f60", "value": "196752bd65f33bc6f5dd0426f39259ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648462960, "uuid": "ab0bbdd0-b094-43b9-8ddf-30cd75de3333", "value": "6144:buZlJOFmzvtg1Eyid5GX5BVhthqnhdDpV+WWT8JKyTpoOvy2ufQd8:bGptged525pthqnhB+RUKyTpoOvHuf28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648462960, "uuid": "1a25e053-1be3-4b7c-970f-70590549b7b2", "value": 433861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648462960, "uuid": "b276db67-7112-46ea-8b66-225bc9d83d79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648462960, "uuid": "9bc54c5e-3863-4deb-a985-61e3efb05582", "value": "emotet_exe_e5_10e8c19f754e49253be6be51f7939867058c378ecba811d03458b9549476e2a2_2022-03-28__102236.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdbeef0-ae6d-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1648454720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454720, "uuid": "3a0703bf-de89-4b48-bd01-ddc8b030478f", "comment": "Malware payload (ArkeiStealer)", "value": "c6eb2ef8d00fcebf74253064a4da862e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454720, "uuid": "081b165d-7db0-440b-b503-1f0d5c1f2e59", "comment": "Malware payload (ArkeiStealer)", "value": "11a69bfb8a93253c13d7e6754d99a3bbedf0dc16d8b81b7ab1a2e8dc9a628bbf", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454720, "uuid": "8ffc1ee8-50d6-4159-afec-2afc467533b8", "comment": "Malware payload (ArkeiStealer)", "value": "79880821d7c0c7503af289fb210107fb7cac2ccb", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454720, "uuid": "40d1bcf2-180d-4bfd-8dcd-880828783810", "comment": "Malware payload (ArkeiStealer)", "value": "2b9a16f7f88332b0c907358c58772bf0eec9c259bc322f7f067c44cd73ff4cd6b031f53ccf832dd560083722a691ec9e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454720, "uuid": "4a5e7c66-afbf-4e1a-84d9-6ff5030d41e0", "value": "T1CB54DF323596C833F62602B15C16C770AA7B7C3519719A8B3BC9296D5F323E3DE6530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454720, "uuid": "1b068d42-f9eb-4cd6-8733-a9d52aef599c", "value": "1690f0efc188c620ac36940e114b98ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454720, "uuid": "807f7c65-7dd0-49cb-92a5-9d7a5148aa2f", "value": "6144:xqibQafj9tP30ZFEMUhuiBgzweH8Jop+D2iXs:xqibQafPPam4PRqxCiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648454720, "uuid": "c4134c40-ef87-4d74-abb3-fc1420134f44", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648454720, "uuid": "9b0b0532-c18d-480c-a800-3e9bc090947a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454720, "uuid": "e21976fc-b7c1-4449-a3df-3df2ba91e491", "value": "c6eb2ef8d00fcebf74253064a4da862e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b1d723-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447932, "uuid": "7105325b-3ac1-4a4f-96e1-ddcdd1aada3f", "comment": "Malware payload (Stop)", "value": "0b423fc4ff16c78a811a382d200e1501", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447932, "uuid": "0f4f968f-0464-4c8a-a7a3-911bf24c26d2", "comment": "Malware payload (Stop)", "value": "11cbf8967f0dfb881a4a38c7abf2c26c61bfc68dc61a56a354c400a35f9a75eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447932, "uuid": "325a831c-bfe9-4020-9a3d-5b1d96346edc", "comment": "Malware payload (Stop)", "value": "511965d7b844019fa6688f8b2a51bca623c7d619", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447932, "uuid": "8c91d9e8-7484-4ae2-b663-bccfe5aac514", "comment": "Malware payload (Stop)", "value": "c6bfb85761b50abd070535d3e85ba97e6f8ee26672f2a21272ef375028612ae6853493d954f6141bb417c25956a1511d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447932, "uuid": "46089dce-ed09-4f2a-bd78-f9f1f982d9ba", "value": "T152F42214A7C09432D792E931381ED5B12D7F393342A05A6F7A9417262DB2FF39FA520B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447932, "uuid": "e2279e92-40e1-4a40-90e2-5d4021fed041", "value": "82d4c36ef8d8d93a7382f02fd78b23b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447932, "uuid": "93c46fca-a92f-4072-a21b-d0160e8fbb69", "value": "12288:8hokRBX0Aq0p7mqTtKRimRXqfxhJBn+Cx039hym63Vyn7oWJxjVQY:8x/0Aq0oqTqBqfxnBnXYShQNNKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447932, "uuid": "64a46d60-8485-4666-9137-0119af5ace03", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447932, "uuid": "3a26fd5d-9a46-4bf6-ba58-4ffec9ac8291", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447932, "uuid": "2c9bde23-a1e4-4f3e-8acd-02ba649b0e48", "value": "11cbf8967f0dfb881a4a38c7abf2c26c61bfc68dc61a56a354c400a35f9a75eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ab4c26-aeec-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648509333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509333, "uuid": "036e2ccc-9db6-4ee2-a46c-5d0b29d68f3c", "comment": "Malware payload", "value": "13170d483486ae21654175e3dd107046", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509333, "uuid": "1716ef2d-cabb-42f6-ab8b-8d6fcd49a2a1", "comment": "Malware payload", "value": "11cc94773e0d1b1d6c4a5c6ffb430a321ff470c83896ed7c6ae8b1d87e1e6443", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509333, "uuid": "fe8fc292-7a27-4de3-ae38-86d796d59d70", "comment": "Malware payload", "value": "18437b21eae279728e6a34e671610ac481331c51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509333, "uuid": "7577100e-56dd-4f1c-b4df-be900acfb0d8", "comment": "Malware payload", "value": "189dccecf0526bd50185eeb2c84714db2046e0c064b9ef52446b5d37d56f6ef4e278018ca5c960c094de067b491ff5e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509333, "uuid": "9c13c69b-a9d3-4b2e-bbea-2578b14ce506", "value": "T18E844A47F2A2A0ACD16AC1788757E633FA327C0946217A7B27D0FE312F65B50A72D705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509333, "uuid": "4488470d-8494-4d9d-ada5-d89b16aa2cac", "value": "b3f6dcc1b4af5b5c34940f50a3e17687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509333, "uuid": "0f91fb83-7ed4-4bd5-b12f-301cbd24a24b", "value": "6144:MU/yZ9D1EdQ4Qi9rO3/JwOWGM/gRfDCVIpKUY0MVJuY4G:j/yZLPurSRpD03V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648509333, "uuid": "750521e6-f63d-4298-bb8c-e2bb335c62a7", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648509333, "uuid": "32f11efa-24e8-4487-a4e3-39da83948560", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509333, "uuid": "46646558-792d-4d71-a955-f909c4d392f1", "value": "11cc94773e0d1b1d6c4a5c6ffb430a321ff470c83896ed7c6ae8b1d87e1e6443.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439a9752-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448042, "uuid": "c4c0bebd-9314-4b16-92b9-eceda2604ccc", "comment": "Malware payload (Stop)", "value": "ece180c32ae92eda779b0257e7119434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448042, "uuid": "7fca97eb-6740-4f1d-a4e8-0e57b8aab3d8", "comment": "Malware payload (Stop)", "value": "122c593f41d588b3e7c72a499c092fed6b5e42264fb0651962061f7b4bb722f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448042, "uuid": "06d68281-d0dd-454a-92f1-93db89e9db51", "comment": "Malware payload (Stop)", "value": "80ccc7abf180fa14d11f761d97e3437f9e07678b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448042, "uuid": "7c491687-c8ba-4b4e-8f1b-d56091b35a8e", "comment": "Malware payload (Stop)", "value": "072640981d38d0f6a945fcd58a6d027467ce063358f0ee9163bfb2700eea52bf1db5fcfea2a67f7a6248ba444488823b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448042, "uuid": "c2e96da1-a38c-4fb3-8a0a-546e4be6c53f", "value": "T1F4F42323A350BC32C0832E31B53DA7609F3F46729653A806BE7952AE5F721D1B67E315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448042, "uuid": "b5f3ea83-3811-4b53-8921-5a197dc9d4b0", "value": "ed1b2792ced7a8e7bb849a84d01e5fcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448042, "uuid": "fd65226f-4b58-40aa-b1d1-ef7701d8a7bf", "value": "12288:zeIVn+wo+y2iskkOsA5DMSZxz5pvaW8kKGkps8RnB/d7xndzQZG:zeIVn+wY2RfCVfzzvaWKGkpf5B/htdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448042, "uuid": "1199bd42-5371-4d15-bbcc-c25daedcd704", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448042, "uuid": "83b73c35-0f17-4e0e-8299-bf40b8e194b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448042, "uuid": "ec1be006-259f-4e8f-bccb-c1c83bb603c6", "value": "122c593f41d588b3e7c72a499c092fed6b5e42264fb0651962061f7b4bb722f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6dcc64-aedb-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648501848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648501848, "uuid": "87a2f14f-3e72-4bb3-a4ae-3ef9a90b794c", "comment": "Malware payload (RedLineStealer)", "value": "9157ef33baabf0ea29fab421353c92f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648501848, "uuid": "75fa17cf-e8c3-4ff4-ac73-45b977327b21", "comment": "Malware payload (RedLineStealer)", "value": "129acedca6a55db8586c6bb1b9bedc0d5fa9faba4be330d1cff18d21ed1ab4fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648501848, "uuid": "e3f007b5-18af-441d-b5b5-a8094ff7401e", "comment": "Malware payload (RedLineStealer)", "value": "53f6a474f6f160cabaa0251d0853a2221d395de5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648501848, "uuid": "68f9f183-a214-4cf2-b733-7897e48c4f89", "comment": "Malware payload (RedLineStealer)", "value": "c6875edb9a736523cd1b25778270a8d49765a58fbe55896a652cfc49f38c4573aae6e3bd1daeb7daaab9984dc1b1d72f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648501848, "uuid": "76571768-c977-4073-9fbe-51a6e7049770", "value": "T14784BF00B790C035E5B726F44E7992A87A3EBDB19B2851CB62D53EEE46356E4EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648501848, "uuid": "1d211259-0887-452d-941f-f64f8e9f6d4e", "value": "c5abd0d249bf5319619ab44b6b97960d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648501848, "uuid": "1d8b5d73-252c-42e3-a684-2c6cc146353b", "value": "6144:ajtFx5pjNm8b67a4GGQVblDo/285B4oV9RFpZLJ8cp6:ajtzrjNm8b67a4Wdv85Z9Fp3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648501848, "uuid": "285997b8-630e-4bfd-afb6-2f67289308b9", "value": 379904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648501848, "uuid": "0195ce0f-faed-498d-980a-11c725f3151f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648501848, "uuid": "5729bd3e-cf2b-444e-9f5d-0d67a11f390d", "value": "9157ef33baabf0ea29fab421353c92f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d79bfb-aecb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648494809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494809, "uuid": "a741bf87-000e-452a-9c19-5a902cd0cbf4", "comment": "Malware payload (Mirai)", "value": "1fc8eb351d068d206e62115294d017eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494809, "uuid": "5a7c7f02-2dc2-4dde-8b54-4faba4ba4e1b", "comment": "Malware payload (Mirai)", "value": "131eaf4c8412700869aa7ebe0dda074513cf0f6d1002b293e939e6d3c6a4c022", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494809, "uuid": "65c69a1f-2e1e-4007-83a4-abd19059d09c", "comment": "Malware payload (Mirai)", "value": "8e4fa8f5cdd3efe6b8d73ee5e4e324a91b00a59a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494809, "uuid": "e00107ce-ff16-443f-8e91-c4b1a5ee156c", "comment": "Malware payload (Mirai)", "value": "7bee7c06cd5d1cc9a32dd86db9742ba2759f93ed46efae57d89895512c98e9fb680706592b374e5bda6f0f2bbb66fd3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494809, "uuid": "d56074e7-ffdc-4e24-959b-41ec7508a326", "value": "T147B2D01EC0AE2EB4FEDB7D395D45E2817B619BDF3A628EC017C15B010222D385F986D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494809, "uuid": "4f2eb527-4852-46b7-aca7-2c9bd34d71ad", "value": "384:2OA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIo+3uM4uVcqgw05Vz:2AApCdvwJr69VJoA8FZtxCo833t4uVcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648494809, "uuid": "8119bd7c-9350-4bc8-9dea-6e224eb23150", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648494809, "uuid": "b09bfbc1-b67c-49b0-af17-99a50a6e6b56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494809, "uuid": "d29308a2-5d9a-4f8d-b0d3-e41408ff0016", "value": "1fc8eb351d068d206e62115294d017eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6d8f23-aed8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648500561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500561, "uuid": "9e6f0ee6-e537-4af3-9e4a-513b4a475ed8", "comment": "Malware payload", "value": "19cee9e8dff79e0468cc5605fb63ebc5", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500561, "uuid": "27aec494-2a1f-411e-a6fc-9cf0e5ad72eb", "comment": "Malware payload", "value": "13e2e196c7b1f078c1868ceb55f6912488deefdae8789934245baea91bb4e89b", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500561, "uuid": "4209cd1e-4b6d-4182-9f75-c69b31e4654c", "comment": "Malware payload", "value": "a4b24b0f8dac49678e6a8e84a2e3a7b228e6c1e8", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500561, "uuid": "7ec3c58c-759e-4e45-b1eb-2f821f1717cf", "comment": "Malware payload", "value": "9603dbddb683c5bb40c70f31e938d6722cc0a9da9f3d47e895abc86833f78775f0dd3f794b480609097d94af8f11f38c", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500561, "uuid": "39b7bb9d-3d17-4748-b657-39992760b905", "value": "T13B01D0F1687941A94B78D267F537BA17A630C1D520C2E3FC54CE464DA7E00A8CF60BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500561, "uuid": "7b32d9d9-10c0-4813-8ae2-39af2a6e7bf9", "value": "12:x3voQByxH5QwMO76T/esFskSX7M9DgwgegGSRrF7tdgwA4qkz6gt1R:x3QUyt5QwMI6TeKFk7ltbdhtWwF6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648500561, "uuid": "cb6eb801-4b73-4c37-bc54-df478ef6f369", "value": 776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648500561, "uuid": "1379680c-9e60-4cdd-8684-bceaa5393a47", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500561, "uuid": "023c9e6a-c9d9-4495-a23b-bd7455f59cce", "value": "AjpE8eE0.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2c5f052-aec4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648492145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492145, "uuid": "f4e7bcb8-07e2-42ec-ba63-82fe1d196e11", "comment": "Malware payload", "value": "0067a20e194f8024c4c09c3aa685fcd3", "object_relation": "md5", "Tag": [ { "name": "ASPXShell", "colour": "#8AF4DA", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492145, "uuid": "4dd81f75-8b88-4681-891a-f515e3202326", "comment": "Malware payload", "value": "1405fbd483aa353b6e4dcc9f5eff4c921523f11f21bfb9585834e4e0d7a586fa", "object_relation": "sha256", "Tag": [ { "name": "ASPXShell", "colour": "#8AF4DA", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492145, "uuid": "fe376084-32ad-4159-8dd3-e25082bd6c37", "comment": "Malware payload", "value": "bffce72d4a77f08cc41696d562e5d210859f4a32", "object_relation": "sha1", "Tag": [ { "name": "ASPXShell", "colour": "#8AF4DA", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492145, "uuid": "febbff6a-c9cb-4902-8eff-88800d6eabfc", "comment": "Malware payload", "value": "803e64f4e600c899bae87521dcefd29e4cc2b76aee7cd99db77458597b8bd0bc0a9dec69582ef26dadc1144391cb7fa1", "object_relation": "sha3-384", "Tag": [ { "name": "ASPXShell", "colour": "#8AF4DA", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492145, "uuid": "8af1e763-ab86-4a86-bff8-8c599d95fbe2", "value": "T1F402D819790C0549D2326123F7B38295DB66917383235975BD9C031BCFB9A6C02F1EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492145, "uuid": "a9939ee3-1aee-44fd-b0b6-035f614dbc08", "value": "192:i7EwHNnC4p7TytmZMUWpIUW/0UAWqUAW7jhzYAf1/UDsfJjh7J3DrG7QN+:oEoCe7pZjWp3W/LAWJAW797UDsxj9J3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648492145, "uuid": "1c9dffe5-9ff7-4b23-9a09-d898548456b5", "value": 8562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648492145, "uuid": "a3b06d60-c5d4-4eb2-89c2-9466c581db88", "value": "image/gif", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492145, "uuid": "e6995f63-2e8d-4668-a047-840c6af4265c", "value": "x3KngR6T.basebash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f16e98-aea5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648478505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648478505, "uuid": "a94ec837-3efc-498a-8320-42e35fde0de4", "comment": "Malware payload (Formbook)", "value": "65b680d178b242ca9004ea869ad141a1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648478505, "uuid": "25007edc-08ed-4b49-ac5c-1ef135d8ce68", "comment": "Malware payload (Formbook)", "value": "143727de91bdc7772d0415c6f21967b27e30194e8fd2f8bbe0996874b45c4cc0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648478505, "uuid": "c85d6ea6-278b-4c5e-be67-2481a865acac", "comment": "Malware payload (Formbook)", "value": "994b149badce1a232a4cc377eea6fe95947d58f6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648478505, "uuid": "cdacfb45-af47-4e77-8d3e-6e2a20d651b5", "comment": "Malware payload (Formbook)", "value": "d8049d3bbc84039c974cbaa94f5c3d7d344a845632fd409f0bdd6c38b7440cfe6ef6742aef256c44fe148ae094d63c68", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648478505, "uuid": "b561456b-f16b-4490-9ab4-c3b6a151f836", "value": "T1B354238C50D15FCE083E626EFB49F31D25E6C601E21C2BBFBAA9E10D63A7168172754C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648478505, "uuid": "9b4f8158-3941-42ab-a6cd-7663d482180f", "value": "6144:WQMpfut0tzBeDqzwOaWb54H89ZwOWzUix9O/X9kLxWto6eTrN1JX66Ng:WQMputuBeRjpHD4irO/XOAhepBNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648478505, "uuid": "3335760a-1e41-47d5-9ea9-a941d60c467f", "value": 297962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648478505, "uuid": "d5b46071-a367-4cfc-a698-e2e2348e6636", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648478505, "uuid": "a94766e3-a821-4979-a35f-ca302e63edfb", "value": "PO-JST-270322.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a1d3ed-ae90-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648469467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469467, "uuid": "6c69bfa1-7b89-4d2e-b9c7-ee5e46c85a32", "comment": "Malware payload (SnakeKeylogger)", "value": "18f9092cc75a19c90e28b9c7ba6a0dc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469467, "uuid": "caaf91ef-2d0d-4c6d-bc63-77001dfb4759", "comment": "Malware payload (SnakeKeylogger)", "value": "146c8cf10674514ab26839ec8a1f1ef5a7e4b644544a475e45cff04f48aa98eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469467, "uuid": "85e2267d-4d8a-40b9-8d8d-93f23cb16b27", "comment": "Malware payload (SnakeKeylogger)", "value": "4e34f3df8b11d11b69d88b87f065ec46e49e5a6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469467, "uuid": "978d91fa-7ced-41d1-aaf4-ae84a1c7e7cf", "comment": "Malware payload (SnakeKeylogger)", "value": "1613c0ff5299e2715d407bbd35b213e22628863bd9fa5fd914b5f4b7ce7157fbf73a52ac1c5023c844838273aa2837c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648469467, "uuid": "61d8a113-fc7a-42bd-8504-d7277065b6e9", "value": "T177556B98325071DEC467C932CDA81CECAA607C665F1FC207A053369E9A7D697CF246B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648469467, "uuid": "0560b24c-4cff-41c7-87ec-95c0027fe09c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648469467, "uuid": "4babf76f-0244-4bd7-90b5-755eb3980b53", "value": "24576:UL3GFul4bwTC24DBwBkxrdZ0XlqOQN07H8gkR73sHbVTDL:s3GFul4bJBwBWrd6Xlq6j8gkRDGZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648469467, "uuid": "0a5680a0-6a09-4fe8-a8d8-5ba212587cc0", "value": 1349632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648469467, "uuid": "c185006c-1cd9-47b1-9a33-1194b4424861", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648469467, "uuid": "2034852e-79ad-4ef6-a22a-4277d66a750f", "value": "AWS SHIPPING INVOICE.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c903b623-aef0-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1648510972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648510972, "uuid": "b0e6935a-fcbc-44b9-83ee-be05e55c4505", "comment": "Malware payload (njrat)", "value": "10182df5f86a76e27a54f98f8ebfc93d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648510972, "uuid": "4b397fa2-7b70-43bf-a442-0af407aa0a38", "comment": "Malware payload (njrat)", "value": "152ee3be28150c649bef1d6227b6310d85a03c517970f913fa6750899ffe13a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648510972, "uuid": "48bc44f9-3d24-422e-a1f8-0a55a162d755", "comment": "Malware payload (njrat)", "value": "1df151927b91e5875ef7fa2604a9da6a7b04de60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648510972, "uuid": "ecc8cc55-79bc-4765-9eff-037c53fd2ea5", "comment": "Malware payload (njrat)", "value": "1408be3f7bff0919e899d3cc81a0ba7f938508a1d33fcc432409ebadad1eaf320af2c29806674091d3c80e03c25981c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648510972, "uuid": "8c88fefb-f951-410d-b842-36399913ab02", "value": "T199032B4D7FE18168C5FD167B06B2D4120BBAE14F6E23D90E8EE1649A37736C18B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648510972, "uuid": "7a97e150-c9e7-458b-846f-4ffaba3763a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648510972, "uuid": "75db7a50-1f67-4614-bd43-c5e0d460d856", "value": "768:n5kQLCNhszg8QrEWmBrM+rMRa8Nu+rUht:nWQLCNGc8QrE7y+gRJNtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648510972, "uuid": "8c71b129-7990-490a-929d-7cefadc539c2", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648510972, "uuid": "21ab32b3-d82e-44c8-8972-2c76e1fa3c32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648510972, "uuid": "31358044-8cae-4185-b275-444565832d53", "value": "10182df5f86a76e27a54f98f8ebfc93d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03348302-aebf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648489595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489595, "uuid": "6ff3a7c3-63ab-40fa-b65f-71bf289179ba", "comment": "Malware payload (Heodo)", "value": "ed340cb644ee6455bb3f64af4b3b23b5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489595, "uuid": "01f8b039-1ad0-4e6d-84c3-bc19710652d3", "comment": "Malware payload (Heodo)", "value": "154df845171350b2fc07a54c0e1f13097875a6383c590a7fd0bb88e6afe8d7ad", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489595, "uuid": "db7f4a91-2c36-4ab7-b954-3a5332aeeaa4", "comment": "Malware payload (Heodo)", "value": "35172cdc7a261e5ad0fc4bef6f7bc498ad4aacad", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489595, "uuid": "c486e46d-4a68-4e23-bd95-e8372091c42b", "comment": "Malware payload (Heodo)", "value": "8eb3b2aee3ab6ea59b4b9666c3bb74fd1c1594fa491c97d89a80d848ddb9a903f63cfb93ec9f989cfaa5860f771d22b7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489595, "uuid": "a7dd3313-f2ab-4c03-9314-937c8c99fbab", "value": "T1AAE48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514D7432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489595, "uuid": "17719a88-652a-48d5-8d55-9a3f3d0af78f", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489595, "uuid": "d6ee2484-47f6-47f0-9d06-b6f4879e491b", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7dvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zjCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648489595, "uuid": "3d207ce9-b9fa-4fdb-b41a-0fddda751a74", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648489595, "uuid": "d6872896-3f24-4ebe-a557-b7bd336dd09d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489595, "uuid": "d0fd9aae-83c3-4458-9c13-0d6ad2141a50", "value": "JPeHYJULD7M8lnFI7p320umxhI72lPPp3v.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9256ee-aeec-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648509339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509339, "uuid": "864bd61d-c56f-4a8b-ac3a-ed44c110e289", "comment": "Malware payload", "value": "3a47c5d00f1bdf8943b595a2c92a53a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509339, "uuid": "34892591-5a64-4792-8b1b-9fe526ca94a6", "comment": "Malware payload", "value": "15a290552f9cdc38b18e6c0babe7fdd52ff8abfa73ff823220fa994e7f023dc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509339, "uuid": "8affdcaf-c10f-4d95-974a-ca1db2efec99", "comment": "Malware payload", "value": "6fe044af1a52ea91ba3a6538bf7a919f16ab36d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509339, "uuid": "732e3727-7b18-4cb5-8295-140caac19ff9", "comment": "Malware payload", "value": "5efbc191a940059d99bcfd2d339fe446e4e30c80bd3cbb0011f6d26d9133a9a80976066a2e9277e407119b88a5dea513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509339, "uuid": "da57cc6e-2be6-4c49-97ab-f8140b0bc23b", "value": "T1C5844A03F36260BCC16AC1788767A632F972BC0946317A7B67D0FA312F65B50A72E715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509339, "uuid": "9f7f45c8-6170-4a7d-b8bd-3edcdb81e8a5", "value": "40064c6eeb9f32dfc55bf2c7514305c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509339, "uuid": "5cb66c36-21f5-405e-82af-5acd95b08896", "value": "6144:SExR5Y1C1Do5RYNrDrbJ9z8XpiPOWGM/gR34O+O5o0WwE:SwR2C1WRYN/JYiCmko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648509339, "uuid": "d246b80d-9578-4132-ac78-c3b1d9b2da80", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648509339, "uuid": "78c02e86-6365-4502-ac30-0cceb42e0290", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509339, "uuid": "c7ef14e9-34eb-49b6-98da-163a71331dd2", "value": "15a290552f9cdc38b18e6c0babe7fdd52ff8abfa73ff823220fa994e7f023dc0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e7fd87-ae6f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1648455609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455609, "uuid": "d5a3d11e-dfdc-4192-8aa9-424a0ed0b018", "comment": "Malware payload (Smoke Loader)", "value": "0bd5e458f76279c6327e38ec17406407", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455609, "uuid": "cc85eb3e-9ccc-4501-8772-3f31b3fb8337", "comment": "Malware payload (Smoke Loader)", "value": "161da33d9550b2e9c838abc55513091a070af910a882eab015fd2a5f96e025f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455609, "uuid": "7e1d44e8-b2ba-4eb1-94e7-5816eef75d24", "comment": "Malware payload (Smoke Loader)", "value": "11e15910c0a4189865bd7f02a63c9913917e9b65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455609, "uuid": "285d5c97-5621-4132-8daf-07068f8a2e22", "comment": "Malware payload (Smoke Loader)", "value": "7cc49fb347e545ae154fe6adcc5d05487ad9b6e65e6c9203fc31d6f093ae89579b7fe14f912f59468710cbd67a7799cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455609, "uuid": "e61bf83a-acf0-434a-9788-4a1ffc3b8b65", "value": "T1F544BD233581C432E52222B56856C7B59BABB8311A359A8F3F94126C9F353E3DF76307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455609, "uuid": "0ac167b2-33d3-4d84-9ee5-da1a684ebb1e", "value": "4dfbd068d509e65cfeadeb4a32c65fed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455609, "uuid": "1887c07c-f906-44b5-95ad-fc37b83ee117", "value": "3072:ERN10JqcK4yunhv/h/olgInljShFi+VYjpEB7dS5OYBrs0reCv2l:ELgOehv5/ol/EFHYCb+rDqC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648455609, "uuid": "5fdc9cce-c3d5-4271-ba37-331c406e22da", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648455609, "uuid": "fa61130a-cfce-494c-9550-4926fadf96bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455609, "uuid": "02eea537-0908-4d18-9018-8fccf4a7ef1b", "value": "0bd5e458f76279c6327e38ec17406407.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657ff2db-ae89-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648466567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466567, "uuid": "a64b50d9-7212-4ee4-bd8f-ae3bc70daae9", "comment": "Malware payload (Loki)", "value": "cdde35311a891577086902a4958525ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466567, "uuid": "559accc9-87f9-499f-8ae3-b26f9197a42f", "comment": "Malware payload (Loki)", "value": "17550ab5a1de6ed2113f887ef72eebd0cac241a9bb72d0907926b972e38f9ae7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466567, "uuid": "0db9b750-a4be-4230-a96c-4761a1e48a46", "comment": "Malware payload (Loki)", "value": "0e8141547df534bd7709df64933d4da052c5715c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466567, "uuid": "f177d4f3-92c6-4483-88e9-b845f84c121f", "comment": "Malware payload (Loki)", "value": "17fc2e7b18aa9491b36902bf7309caa6698d0ad4ba2f43cca7deb456600a64fb0c5d788a5102e68aaa2660dd0a58ce46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466567, "uuid": "2dbef2cd-e1cc-4f0a-829c-eba2b82f18df", "value": "T1F434120675D24AFBD4EB1932283BA77CF73BC84E03B8A8475B655F6D295248E4B030E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466567, "uuid": "935c76a6-35c0-40f6-88d1-94a1b160b648", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466567, "uuid": "996cfb52-5873-4979-a48e-961dc7c1e9e7", "value": "6144:rGi8I57DCyzB4bUWVN5TUZJd5gpObX2LyVxfo:J7t6gWqvd5gEbXPfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648466567, "uuid": "da304aff-8b19-4352-a2a2-f6c1df79ed77", "value": 244800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648466567, "uuid": "c4e5dba0-61bb-4d06-900f-7bae34d12d11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466567, "uuid": "12f37efb-55eb-4cc2-9aee-4be83c59154a", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbc7616-ae71-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648456411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456411, "uuid": "408198ab-5303-4f9a-812a-72e1ece5a9fc", "comment": "Malware payload (AgentTesla)", "value": "1c6499284cd6d0c36d7909057ca867ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456411, "uuid": "58822c2c-df85-4e50-adee-16ecab1b20fb", "comment": "Malware payload (AgentTesla)", "value": "17608ed1dd1ee0ed6783729c6a4699e12b7e8f9a8a167760e2b3b387e208ba5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456411, "uuid": "bd7f4ced-8cd0-42bc-9e22-9351f58f6369", "comment": "Malware payload (AgentTesla)", "value": "4375270af6640c68a30896f2bc4aae38eed01b56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456411, "uuid": "eaa41652-7185-4688-af34-70dc0f4e0705", "comment": "Malware payload (AgentTesla)", "value": "c82f3b58e42990ae5022ee947547a9bbeef92d6918955130bc1d986681579a968f7176ca4fc6dac331326ace4f555719", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456411, "uuid": "80b054ab-fa98-43f4-8544-8e53592afa1f", "value": "T1032533D1DF99816DF0BCBF34920A575485EB842420ABBDC0744D21CC68F9D7AA1A3FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456411, "uuid": "8d396c8d-3318-4f85-b718-37aec44f55c0", "value": "24576:jFoKm2+zvlyevcC0w+Kvv9NxYS9HEgMnUBi/q5Do86YPg:jFod20v10w+KHNY6A/AgYPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648456411, "uuid": "c25d65c8-b6a6-4b63-a897-095c0e4739ec", "value": 1004276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648456411, "uuid": "91e685c2-2eb1-4acb-aab2-b056b2363db9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456411, "uuid": "8e7e14fc-ae26-4cfb-9237-8050074c9da8", "value": "Order356456.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c614292f-ae93-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648471024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471024, "uuid": "2b7b2f4d-150c-441d-9b29-3f3f6121e0bd", "comment": "Malware payload (Heodo)", "value": "3f6d7456f8d91f0a1fb53ad76c1bbc43", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471024, "uuid": "ea8bfa3a-8876-499e-9bb2-e5fd27687851", "comment": "Malware payload (Heodo)", "value": "177dfc7deb071d629d813d9451268310cff9c66ed3595a1cd61b0ea79a73d273", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471024, "uuid": "94efce97-1dc8-4b73-b77f-041e12f6758f", "comment": "Malware payload (Heodo)", "value": "d5360a8033556a572e13cce34bd5a32377e0f88a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471024, "uuid": "4baaa4ea-55ae-4fab-ac51-07be9302021f", "comment": "Malware payload (Heodo)", "value": "1706a4fe74c3c8b08d8ae137ee4739a2d114289b6996f171017928e4126176d87502a2df9288187da92ee19f62b13d43", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471024, "uuid": "669e367c-bdf1-4b03-b845-bd5b7c6c29fa", "value": "T15043E95BBA49985DEA14877548E743997323FC304F6B074B3269F3257FF89A05A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471024, "uuid": "6a3da7a9-c710-4ab8-8852-401cd6f17ec1", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umvD:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648471024, "uuid": "a318b5d8-ffd9-4985-bd3a-69b8a9b907fd", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648471024, "uuid": "0ac93173-999b-4451-9c80-1ec47af6188f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471024, "uuid": "5661316a-5581-48dc-9f7c-88171f02bd23", "value": "10031850712143407686175.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3960c36-ae8e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648468926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468926, "uuid": "73e0a5d2-a67b-4ada-a82d-47f8e7353ede", "comment": "Malware payload (AveMariaRAT)", "value": "b8664bd772766689b7bb0b6b905855da", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468926, "uuid": "ac589b91-768f-4041-8d76-fa683256b14a", "comment": "Malware payload (AveMariaRAT)", "value": "17db20ebfbce957562eb47a2a0db1a052df6352613d554fe707fae58b8975f81", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468926, "uuid": "2f6ee9b7-3933-4caf-bb3f-c02bf8033b12", "comment": "Malware payload (AveMariaRAT)", "value": "8df6eb97e75e2bd051b8050357c8ad858a7dbd53", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468926, "uuid": "da381d47-8f4b-4c3b-89bb-79ae51daaf84", "comment": "Malware payload (AveMariaRAT)", "value": "21215dace9211fb84212079b574ca3227d6e3c0243a43d03d9566a790693ce814b6951ff8abfbeed18160046b5963392", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468926, "uuid": "430a5445-5922-4ca9-ba60-484b4712e068", "value": "T13C74DA5A7A745132ED00CA3419F69E15D2EBEE6D2BE0551E24C8F66D1B322FE8F039C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468926, "uuid": "35d847d2-5c82-413c-a795-350b3abd2385", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468926, "uuid": "31fd9ed9-1b72-4d24-9779-7cc08a5c4e6a", "value": "768:djvSmGp5uQMQg2ZzEjss2VSg1I1cn0sspAgpq8hLyg1uMN0+dzsRs+eE/:drSmGp5DMQ7qPpqOLy0uyL+f/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648468926, "uuid": "269f0474-b802-472e-8760-c5edfdb3acf3", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648468926, "uuid": "11c57259-3e2e-4b85-bff8-529f5a8e97b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468926, "uuid": "f03cedc5-1397-48a0-93ac-ced61cbb2869", "value": "PO - Drawings And Specifications Sheet^^^^^dwg.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f44417-aeda-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648501404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648501404, "uuid": "d1acbd23-388d-47de-b788-d60f69122047", "comment": "Malware payload", "value": "f4e74e382502d391bcbec89cc8437fa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648501404, "uuid": "55efb69a-2dde-4db7-a1cd-847014f9e0e0", "comment": "Malware payload", "value": "1841ca56006417e6220a857f66c8e6539502d5e9f539cf337b83a25c15d17a50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648501404, "uuid": "232a2bea-9544-451b-8922-3388d39f278d", "comment": "Malware payload", "value": "d97928ab63122dc85cc1633adf47ab7e44cac0b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648501404, "uuid": "b5240316-672a-479e-b7d6-555f3ab71e5b", "comment": "Malware payload", "value": "dc2360056e25017d3862fca1a46167077d15888f496839d42367155967150dfefcdd03e9d53a120dea51b49717c2c24c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648501404, "uuid": "599cee92-80e0-44da-a858-5bd60e2f254e", "value": "T1B9943903F6A250ACC0AAC1788367A633F9727C0D46357ABB1BD0FA712F65B50A72D715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648501404, "uuid": "655a81af-a5a2-41c2-ab75-16ce44f19f54", "value": "a7031d65caab126e7655c41f3a209a13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648501404, "uuid": "d692455d-6ef5-4cd6-b611-711d90a11640", "value": "6144:yVFiqeniuHH1rd4pYCYfvZvJ5T25ztiOWGM/gRQRE383g2eefM9nutc:KF7eb1rd4pYC2v2Bv83RdfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648501404, "uuid": "25758809-79f2-4496-a1c9-fa22eb2728dc", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648501404, "uuid": "6314abbf-78a8-492a-9168-da53d0814a63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648501404, "uuid": "4b86270b-482a-4d8a-927f-202121874de9", "value": "1841ca56006417e6220a857f66c8e6539502d5e9f539cf337b83a25c15d17a50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036c10f0-ae55-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1648444069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444069, "uuid": "b0b16947-3dc8-4d99-94fa-6937818f0ef1", "comment": "Malware payload (Gafgyt)", "value": "210b3d7e470e8438a21248e4b2b700b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444069, "uuid": "3417ebf9-2539-4e9a-b3cf-902904a0ed7e", "comment": "Malware payload (Gafgyt)", "value": "189fe3ea3e3c161f9d42d72da8e4a020c4383ce7d6f2f7c35ae1899baa250f04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444069, "uuid": "2eb729df-92d0-49aa-831c-0e6bfcc3c548", "comment": "Malware payload (Gafgyt)", "value": "c7d48b94fd78297830bba36e2ddd955c47479367", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444069, "uuid": "292163e2-dfad-4dc0-b970-97ac40c1608f", "comment": "Malware payload (Gafgyt)", "value": "88ca5873ee3ad3fbb797077ef633bdb5c85bf6573824b6a6e185d7bd809d532ec0c13d540fcf890e2e7bd6ce23b22fb3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444069, "uuid": "f5d73914-8e42-48cc-ad31-9529c1d9a6ec", "value": "T121931943A8A19FB7C146AEB566675E640753FC512F0B1B89702CBAF4033B5CDB80EB24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444069, "uuid": "587aa6f5-6b02-485b-a830-51cb2399923d", "value": "1536:8TvqUqY5IaYXAK1QnDSAxyvtwGvcCZoVkMmK4Npbsizfn61NH:8TCxY5ItXH1BAxypcpVJmHNpbscfn61h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648444069, "uuid": "a6aadb54-4c3f-42c5-94e2-5e03ec1af5d1", "value": 91601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648444069, "uuid": "d9e97aca-d73e-4b7a-91a3-3159e18d46c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444069, "uuid": "e0e6517b-d42f-4e51-a746-8a509e79441b", "value": "210b3d7e470e8438a21248e4b2b700b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c33245-ae93-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648471031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471031, "uuid": "e6fc826e-cd81-48ed-b4c0-ea4d1af5d0e6", "comment": "Malware payload (Heodo)", "value": "ed25afada775e070f2ca629c1ced78a6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471031, "uuid": "2ef09148-8fb2-407f-be6e-635aeaa8a304", "comment": "Malware payload (Heodo)", "value": "18d26afa66bb23f4098cfd6480a2d93c9ebfb26a78979c9d04b8d7c32785cd6b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471031, "uuid": "1cfb2c73-9df2-45c2-a128-7dd53ff1b5fa", "comment": "Malware payload (Heodo)", "value": "dbcfc35c673480856ea5e1b8fe3684b776bdc364", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471031, "uuid": "c524e65e-be2f-4263-ada3-b764a83f6014", "comment": "Malware payload (Heodo)", "value": "ee1f705d46d9a3b5b17d56d65f364a9c733f633585f18b90ac12696791c7cba090da4391ca050ca8b2060002e792c9ef", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471031, "uuid": "9295c7f4-9395-4376-b1f4-8e16a1234aad", "value": "T1C343F85BBA49985DFA15877548E743A97323FC304F6B074B3669F3253FF89A04A0324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471031, "uuid": "370097b1-e16b-4e08-ae6d-708ccfebfa17", "value": "1536:IsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgX5G9XSZ4Jvb:9Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648471031, "uuid": "7bf604dc-aac6-42c4-8dd4-c4572df9fa60", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648471031, "uuid": "c5bc40b8-aea3-49c6-a573-99d3d8df9d61", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471031, "uuid": "b5574576-d84d-4188-a5a6-388c49c78fad", "value": "Contract - 2022-03-25_1924.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046df4d9-aee0-11ec-8e58-42010a9c0032", "comment": "Malware payload (OskiStealer)", "timestamp": 1648503771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503771, "uuid": "baf5b27a-2688-41b3-8b9b-9ba4e2f30888", "comment": "Malware payload (OskiStealer)", "value": "6a73a70fe64bd9079558ecb935a7cfd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503771, "uuid": "8a719757-edf2-4db5-a5f1-eb23ac1a9720", "comment": "Malware payload (OskiStealer)", "value": "191db013c67081442ef5e75edd00c2572f6ec9d7f629ddac9bba8942722c061d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503771, "uuid": "949846a6-1b24-49de-a492-c8b1d81aa31e", "comment": "Malware payload (OskiStealer)", "value": "ddcb6867ed961d1a00cb5467f63e45218a51f3ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503771, "uuid": "fe858c9e-27e7-4167-848e-a7ce6b71f989", "comment": "Malware payload (OskiStealer)", "value": "16820ebc56530c9e4664e5305afaa270fd9b18e70eb6c87e75e4f1a50eec75b60ce8ff9fbfaa99b4920e305bf6278da9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503771, "uuid": "386c8410-a037-4f95-9607-a3721ea581f1", "value": "T18745F113B6A99A05C43543BBCCAB80CC17B03E45AD5BD64F7DC533CF1A727865A09A8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503771, "uuid": "f1c24f96-acc1-47e7-bc15-39b9b014b57f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503771, "uuid": "048dae33-e8ae-49f0-8b5c-0d22d06e19f6", "value": "24576:QID4lgeriYNaGWugk24sDcSGB9nINrUzAarNeC:kmlc/Vgk9sYI68arQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648503771, "uuid": "46b0f1d0-2382-4a11-9f21-0c3b86544451", "value": 1185792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648503771, "uuid": "23c0405e-0049-4938-a345-d37179d0faf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503771, "uuid": "7b9088f7-a06b-43d8-93b8-f5dd23f82b5f", "value": "GT N\u00b0167238-09902022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f501206-aebd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648488998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488998, "uuid": "13741c01-ab6b-464a-870f-b10d12581a2b", "comment": "Malware payload (Heodo)", "value": "eec9206a1bd3c05ce916ec2e16e4a5db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488998, "uuid": "91b2c300-bbaa-4bab-a612-3f09091da1a9", "comment": "Malware payload (Heodo)", "value": "194a2f2bd2248cc23a2065ac7b3e806aba8cab3e972153cea8baea6b7e7caee4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488998, "uuid": "a94a3122-6f92-4ec3-a485-235963c17964", "comment": "Malware payload (Heodo)", "value": "b613d0a6ba7d863526fbc3427023d771fcc7184e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488998, "uuid": "003ea0e1-a912-4444-b03e-a9832c538d07", "comment": "Malware payload (Heodo)", "value": "5020c18d61fb9dc507f36762689da2c9c94117c6dbdc5a57d5eb6f5bedaf73c134a869ac5842464a183881292e112bb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488998, "uuid": "4b918c15-cefb-4f83-a644-3fe6d900dcbe", "value": "T15AE48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93FBFCD302514D7432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488998, "uuid": "5a3c0009-68cc-43ca-b33a-417d7c080e7d", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488998, "uuid": "7d691d66-023b-44dc-980f-c1504ca98388", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv74vK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zSCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648488998, "uuid": "2c6709da-50f1-4e92-95bf-fbbafc93dac7", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648488998, "uuid": "ebe27f32-5387-40da-955e-c98fa73d4864", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488998, "uuid": "afa49fef-b9e0-4015-93e3-ce31169085c7", "value": "eec9206a1bd3c05ce916ec2e16e4a5db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ccd6d7-ae69-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1648452831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452831, "uuid": "1e350244-8750-4b24-8631-87dfac184b0f", "comment": "Malware payload (GuLoader)", "value": "15f6dc0911a82ef05f9029f69a05ff13", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452831, "uuid": "ad4ebe01-e468-4757-89ae-d49cf2be1a23", "comment": "Malware payload (GuLoader)", "value": "1992c5d513f15ee980bebc27cd36cb68859a3a48a4cca63af4a359c24115b646", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452831, "uuid": "92342ca8-97b5-4a6c-a029-d73a5ab421da", "comment": "Malware payload (GuLoader)", "value": "f14bd528e75ff2d21b55ebaea24dce95abf7a4a1", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452831, "uuid": "9b949070-8029-4483-b61d-b438387079cb", "comment": "Malware payload (GuLoader)", "value": "67285f165b311a51177d5936ca216db49d137d027358782842c612b07ce9473a25bd2990c276b0dfc7da4e2b163dece0", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452831, "uuid": "26395807-8cb0-451a-af6b-6aa50f2d444d", "value": "T1D5051156A6AF3730FA30F60F867315265FA1E1C8A3EDE012C296C226056D85B5B47F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452831, "uuid": "d4e566f8-33b6-4204-81e9-e00de4b6f7be", "value": "1536:DEOeWgNjIIlWLuorP14T5KZCtftPcn3b984Nv2TP3RNqHF0fZVHAeOoWOjrY8/Aj:TU+dlvvloSujrkWOqHo5o7WWlsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452831, "uuid": "98c7c255-b28c-419d-b55c-08eaf1938422", "value": 845167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452831, "uuid": "dcd54dad-9541-46b7-bd05-b63fbcd591a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452831, "uuid": "7c0cdbf6-c546-479d-abdf-57eab5685966", "value": "Septocylin9.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea166ff-ae54-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648444007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444007, "uuid": "48c0385d-b969-4ca1-9b6d-8b81b6402ee8", "comment": "Malware payload", "value": "197c1d5af4e976982ff187f4d3b27413", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444007, "uuid": "9267d149-529b-4bbf-bf6e-617f774c69df", "comment": "Malware payload", "value": "19b194420147339e41630d5c4726d01259a69dda7ed6df10cd3f2514ff842513", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444007, "uuid": "a34db22a-8a87-4289-9086-771abcaa43b5", "comment": "Malware payload", "value": "0687c2435a10cc78248db99819abcaa8636c01f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444007, "uuid": "fc466d6d-1dd4-4a87-8ee0-9ecba63f75ff", "comment": "Malware payload", "value": "224984dbed54231af48d43b5117351e510d24d37158c7109b4141383e16538dca5fbc3a98681ac655ab9f7b86ab82a93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444007, "uuid": "730aed56-cc61-4407-a668-2f503cabf3b8", "value": "T11813F26D8241A4D3EBD59074C73D43D64CA30BA3A2DA8C09D238D5650B6C3F1BCAF6D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444007, "uuid": "4f544969-41b0-4e9b-8f5a-470aacaaa148", "value": "768:3hMAzqHfj1b2IGAH3HaXAlLKfhThq4C3VPEbd4JgGlzDpxYsRLNNvOW5oDjr:35zqZ2EKXqLKJT84C9EZ4VrYWNNm3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648444007, "uuid": "d261f8e8-cdf6-4d21-9fb4-1a828033036b", "value": 42020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648444007, "uuid": "974997cf-111e-49b8-8541-fc82886fc88e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444007, "uuid": "0c1cb306-ffd8-4051-856e-ba603918e0d0", "value": "197c1d5af4e976982ff187f4d3b27413", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9a97d4-ae5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447844, "uuid": "e1f05791-7b5e-43f8-a152-3c23530352de", "comment": "Malware payload (Stop)", "value": "dd5f5691ba33fd0bf605e7358962e4b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447844, "uuid": "3946fc8e-8be7-4765-81e2-9bed652b7bd7", "comment": "Malware payload (Stop)", "value": "1a08fad680a026c1168055baef403eb4aa36ddfcd6b96ab9f277fa120a360977", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447844, "uuid": "384d1bad-4660-4990-9e17-4fc0cde80e50", "comment": "Malware payload (Stop)", "value": "866a855f822945a2442ed11643a7a4df34a2ce40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447844, "uuid": "0cbc92b9-7a41-48ee-9556-88a5d7c54e46", "comment": "Malware payload (Stop)", "value": "c7cd563447cba56c1df96d95bc8f93c7dc5f9cf7ce75950ff85a58bd85d357091261df5c273c5313c1861825ee32aa08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447844, "uuid": "4535e216-c743-45e1-aeeb-b540dd25981e", "value": "T101F4232036007475C983A13174AEE7B4BEAABD7A42EA4BCE27D8E63C5F109D6115F31D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447844, "uuid": "68a0493f-5795-4b44-b415-a894cd56224c", "value": "ed1b2792ced7a8e7bb849a84d01e5fcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447844, "uuid": "e9c5c9a5-0b6c-4b23-8846-92526d1da6f0", "value": "12288:oJ2euampRTtrPFdBWQDsLxJ3tt42oDtoxEAlQ/DxlyAEYJBf:oJ2er2TPl2oDtoidREIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447844, "uuid": "2abf184f-995c-4b95-82ab-5f65a20e296a", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447844, "uuid": "4f1e75ed-f31d-43eb-b426-180b250cafbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447844, "uuid": "6d2ecea0-b713-47ed-b17c-736f69591b5c", "value": "1a08fad680a026c1168055baef403eb4aa36ddfcd6b96ab9f277fa120a360977", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38e7e3f-ae75-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1648458216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648458216, "uuid": "d2fa4d0c-e975-4352-98d8-30a037285cf8", "comment": "Malware payload (Gozi)", "value": "56af6074a589ed0fd684f0fd097887d4", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648458216, "uuid": "8c3c09d3-bbc8-4bd4-b023-17634527a90b", "comment": "Malware payload (Gozi)", "value": "1a16288bf4484b2a6692dcb7244942d7bea94ce3597c175910f91cc2b2613365", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648458216, "uuid": "2bcf2ada-89f4-4315-845f-9087a8e248b7", "comment": "Malware payload (Gozi)", "value": "6f3669d58b2744e12a3aa94f9782f6965efbf344", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648458216, "uuid": "a57cfaf6-2cb1-481e-ba0e-d85fbc121013", "comment": "Malware payload (Gozi)", "value": "5af0e1bef89c3ecd86a516b24b86d9967e4480b0b5d7fb95b2f2e8a9c83748299f334055922f87068f588405b839dd04", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648458216, "uuid": "fe1ed716-8f55-477d-b93e-b7fcb848c7f4", "value": "T1D8B4ADB4A8B07756E852137F4076EE129B24A5B0933355EF11A6EFE7B8CF0C91D70286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648458216, "uuid": "662fcf61-b05c-4d17-8ba8-2226a3b37ca7", "value": "a7e5dcbc7d03e95dc705d7e76f6a9fcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648458216, "uuid": "2916cf85-96d1-44af-864d-8e1919c6ae3d", "value": "6144:6wlVTdW6+iBeE6LvZiFH8buXjECZn6wfsfACoDnfWq+abuFGGGGGGGGHGGGGGGGu:ZVN+iBeHLvVa3n6wWKDnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648458216, "uuid": "5a1364f8-4055-4916-be4e-753b0c3b0983", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648458216, "uuid": "c773a325-393d-433d-a20d-9e7e32dd67ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648458216, "uuid": "7705a0e5-5765-4e77-bdf6-c3a157977e73", "value": "6241776210940.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "274455c4-ae80-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1648462597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648462597, "uuid": "e43f3fb5-2661-445e-9bc9-cfb335705aa3", "comment": "Malware payload (AsyncRAT)", "value": "ae942339e512444b692e2a1f8ad32828", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648462597, "uuid": "06554b40-edcc-43a4-a749-53bd76e9c49c", "comment": "Malware payload (AsyncRAT)", "value": "1a9e9deb92ea9d2cd35f94b5b0cfaecfd353fe71d886aa0ee4da2d7b454427aa", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648462597, "uuid": "35f87907-c413-4211-9cb6-5b66428abeea", "comment": "Malware payload (AsyncRAT)", "value": "54ca07035c9e6488fbaa974f3d6c64c82e9597b9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648462597, "uuid": "761320e9-65aa-4efc-aa62-8a829c4ae633", "comment": "Malware payload (AsyncRAT)", "value": "a9d4eb5a5b7ca6be11d864e189d35e28c914aaeb5d6566f3cdd69f2e6c81e56309a28a70446b577e66833eeefaed3913", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648462597, "uuid": "43a2f249-bc45-4c58-901a-1941dad0f603", "value": "T13A459C3572F4A751C4344272DEE6C0EC07E02F99DD96C30BE9E436CA6672EC62A4994F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648462597, "uuid": "69f4dd4e-64f4-4e42-a32b-656559884cf4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648462597, "uuid": "5354831e-bf5d-4636-ab8a-54d57972de58", "value": "12288:bKQ4XDpeDJtJ/IT3QXxjYobNrWUESH4b8sKR75gt92eqQjEJFe+Ne6G1nl1wB9nf:bXtOANrWgYb8n4YeljEJE+4Lnliv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648462597, "uuid": "9aa25baa-0c2e-4d93-8405-25a4c23088ed", "value": 1210368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648462597, "uuid": "32c9d364-7676-40ee-8791-949c485b93bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648462597, "uuid": "200b8486-dfa9-480e-9cb2-f8380adec7b1", "value": "Purchase Order15422.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "540ac073-aed1-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648497462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648497462, "uuid": "c716f3be-5b42-4655-ad74-fb09af95a01f", "comment": "Malware payload (RedLineStealer)", "value": "908a22019a94328f0680c4d236a280e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648497462, "uuid": "8d6c58bc-6716-4092-9ae9-3ec3e571042e", "comment": "Malware payload (RedLineStealer)", "value": "1ad7ed0d581fd1377ea7ed51b615b170ec42ac67c08e78211f56e350c91a7d5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648497462, "uuid": "64f54fde-ef0f-47f6-91e4-e46956c711eb", "comment": "Malware payload (RedLineStealer)", "value": "c2b027a811f6b6228763490488cf83440e089a79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648497462, "uuid": "21ced2a6-9f5e-4907-b8b0-3f19d036f595", "comment": "Malware payload (RedLineStealer)", "value": "d96736e3aecdb52d56ddd5b90f2680b64349465315e6ace5fb8956e3451bd5a2204e0e7aeb171e1ab54f6359392c9655", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648497462, "uuid": "5201819c-a675-468f-b15c-f9f9c2c7cb97", "value": "T18AD423C96243BF28D4CA18B47655B68B822E7370E98D1AD791720050EEEC546BF742FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648497462, "uuid": "699f7491-99c5-44e1-ad5c-1354a48c2c34", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648497462, "uuid": "57fb3246-9b89-4551-819d-1dfe3e62944e", "value": "12288:L4PXXJh0h/MrHi0/7cLt+QS03ULaHNqrxlKIQNoYg+vWvg07Y7w5f5nZ:onJ8UPcLQkEaHNYK3Xruvj7Y7e5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648497462, "uuid": "0b34af2b-5ca1-40ea-8be6-96370d949569", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648497462, "uuid": "13692616-4760-40ee-961a-1403cf197125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648497462, "uuid": "31b2bd1a-128a-4bca-b8c1-d8d49836b33c", "value": "908a22019a94328f0680c4d236a280e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13d5c3c-ae5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447850, "uuid": "b4a6cc5f-cd0a-4f9d-9c29-b0b80702422f", "comment": "Malware payload (Stop)", "value": "16ee2e7ad9300a2456a9bbf245aec566", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447850, "uuid": "45487e43-29c7-4581-9088-1e0310fe3493", "comment": "Malware payload (Stop)", "value": "1afa618ea5e953019173b3d0b4dad9082cefc71578b06e217ad58e4d6f7fdac3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447850, "uuid": "0d1f1b17-8228-4204-adfd-0d17e14441a3", "comment": "Malware payload (Stop)", "value": "1b17ab2cfcbe7065d164cc3ac5411870929eb0f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447850, "uuid": "51c0c76d-7e00-4dd8-b87a-87ff62fc8506", "comment": "Malware payload (Stop)", "value": "31a37a9b414841acc427e084b6ceedbc41232f10007b83bed666f600bd1be0c79ad98e1b6b3bd27e383ef869ef915d75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447850, "uuid": "36055419-92b1-4b21-b741-c8c24cfa6e37", "value": "T1210512223AE3E436C1861D70A038DA70AB7B783109A4955F37885B3E6F717D216B970F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447850, "uuid": "b2587d81-4138-451d-b0a9-57d5fb9cc10f", "value": "ceacc43c0db658592494aa369ad9da97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447850, "uuid": "044ef3a7-e0d8-41a2-aad6-d1b638523415", "value": "24576:LUN4FRyeMQqCLfAjFNzJML7A5dfAKiIuN:LmrPQrLAjbJMIr9PuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447850, "uuid": "a97701e6-0f76-429a-90df-cbe2d1857a99", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447850, "uuid": "b5192f2b-e809-4d26-9e8c-4597eba35606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447850, "uuid": "d4f17d82-85da-4eac-aa92-8cbb4490d219", "value": "1afa618ea5e953019173b3d0b4dad9082cefc71578b06e217ad58e4d6f7fdac3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed328256-ae90-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648469801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469801, "uuid": "67f55a96-1299-4017-87fd-4eeb03cbc203", "comment": "Malware payload (SilentBuilder)", "value": "103c3d963f54704cca1ac04adfc8525e", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469801, "uuid": "ac7b23c8-eb74-4688-b6ba-baf5b66c900c", "comment": "Malware payload (SilentBuilder)", "value": "1bce5462d1e38723dfd86953675b85e270cccac5a4fe10b640aec2938dd0cde9", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469801, "uuid": "7557c38f-0485-4fc6-bc8d-fc37d8fec504", "comment": "Malware payload (SilentBuilder)", "value": "d03b0007e00c43005328a3c0754785abd08b2768", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469801, "uuid": "96a06e14-dd59-4ce8-929a-3412a73cda94", "comment": "Malware payload (SilentBuilder)", "value": "a06465e599f24ef4a318a1126277ef7a6f6ac8fcde2c4f6b88ff18ce07ad892a094b837239889a5f10a8f69b76c2f53b", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648469801, "uuid": "6d6c634e-1a58-41b1-b121-f48acdeae33b", "value": "T10B44D04272459439E8EE973414CB4A96923BFC20DA5A5B4B131333FA3F796B05E133AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648469801, "uuid": "793bef49-ec09-4350-ba4c-748845bc973f", "value": "6144:SKpb8rGYrMPe3q7Q0XV5xtuE8vG8UM+cEpBLgoN8uJCLpgV2ZV2VUSpbLjtdA:dpBLgAgtgV2ZQ2ALjtdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648469801, "uuid": "6bb1a9d1-1d08-4dd4-a7e8-f215b59413a3", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648469801, "uuid": "574a0379-0198-4e70-8ae1-d5ca079bbf76", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648469801, "uuid": "be871476-652b-4ff8-904d-ae614b351f97", "value": "oitad.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194bd3d4-ae68-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648452266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452266, "uuid": "076f04c3-5387-448a-b3eb-283f64bf48d0", "comment": "Malware payload (SnakeKeylogger)", "value": "a45446231e82afed10fd821a417ef355", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452266, "uuid": "111b11ab-8352-4201-a78c-f1e964bffd52", "comment": "Malware payload (SnakeKeylogger)", "value": "1c476c0784486ed82583ae459f3ff12b42de483e19116ac879cfafe2d75d8d0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452266, "uuid": "331adc09-0b54-4b73-9aa6-61682e84c5ad", "comment": "Malware payload (SnakeKeylogger)", "value": "7f7edd85c017b97514014bdb0d1ff86c33e2c7cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452266, "uuid": "dba07fc5-2cf7-4734-a16d-ffb2779e8432", "comment": "Malware payload (SnakeKeylogger)", "value": "d51f7271ea692953d6e67d6847916e03cea79a5bbffb62a8fb44c6bf8708b16458292225054e6dee4c3dd6232e17255c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452266, "uuid": "de635b0a-b434-462c-91a6-df3a1749b788", "value": "T101B23E1566A8C665C9EACA3D5CF371FC423BBE03DC32A65BD4C4FF0E79322404A91A65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452266, "uuid": "920661ad-0556-40ae-8323-e7a58903a80f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452266, "uuid": "3b2b48f7-baa8-4fc8-b200-b46e5fb8028c", "value": "192:D3bcN/mhlCVaUzQpbyGlDGlpH46Rx928+:7bcN/5XQpbdlDGlJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452266, "uuid": "23912517-bfa9-49a5-8c73-5d26087eda8a", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452266, "uuid": "9cee3914-b52c-4e7e-b178-e8763399b00a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452266, "uuid": "59d77fb9-5092-4637-901e-46bf94e6c14d", "value": "a45446231e82afed10fd821a417ef355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da009b58-ae54-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648443999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648443999, "uuid": "7b6a2296-1a5d-4edc-b692-e943f258befb", "comment": "Malware payload", "value": "75bd3c9c2f3ddf43e34c95a92f703d1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648443999, "uuid": "a45f71ea-c241-4e3c-84a2-130c9b83a5e0", "comment": "Malware payload", "value": "1cd748c080036aff5b8a05cd1868f9d811b2d8dfb48af348ce6b03d1ccc42fc1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648443999, "uuid": "e845b5d3-cd4d-4fbb-bd2f-d6cf139d189b", "comment": "Malware payload", "value": "d02daed8dc9e16fb0a5936891db1d62c6d5d4a09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648443999, "uuid": "cec12f47-200c-4515-89f4-5ef38aba3c30", "comment": "Malware payload", "value": "3d0ab2fd2b3f5e8ac2c333ddf964af4cde9c447b41a20471007f008349b79e5dc46ecdc6277f66155c97c1ed1112bd04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648443999, "uuid": "b0d1c5fb-8ec0-40bb-b661-ae165b6bfc49", "value": "T1B603F252D16EB056C0B42AB3FAF941C5DB978F4C882277E82514D08D9E641DBA26F163", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648443999, "uuid": "e65d0872-8455-4588-9640-9ea61408f243", "value": "768:rJrTq6SaUDPjLjNyeMwXgVqj15LynU83UF6No83ik4oRB:r/BUTHjN9XgYmUDa35RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648443999, "uuid": "60e224b6-bedf-41b8-b2bb-0309424a42f9", "value": 41308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648443999, "uuid": "723e0c13-19e4-4e2e-b277-6e701a4f38b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648443999, "uuid": "b6a2166b-6a63-426c-935a-31e7097ea750", "value": "75bd3c9c2f3ddf43e34c95a92f703d1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb58825-ae90-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648469457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469457, "uuid": "7bfd049b-2dd5-487d-b3de-2726d5dbe155", "comment": "Malware payload (RedLineStealer)", "value": "2f4452cd2297b0d56003bea28336e12b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469457, "uuid": "dbe53326-c40f-4e00-bdef-98a7444c51a9", "comment": "Malware payload (RedLineStealer)", "value": "1d1b9bf21421307de579d650a5ebcfa0df585e27e2a8ce9fef7b3c352bb4c836", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469457, "uuid": "c8fc9eb9-bab4-4a20-9599-2d92d1f1caeb", "comment": "Malware payload (RedLineStealer)", "value": "c50fc72e476e8b45e1373c2cff703a7eae4129e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469457, "uuid": "3fda571b-6a62-4dbc-bc97-12804b2b8447", "comment": "Malware payload (RedLineStealer)", "value": "5fe59d0c98401a5e5e5b72178468bb9cf3e841d926bb90a199b37f300e452744efbd3ead354bbef3b9cda0be26aaf837", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648469457, "uuid": "ba8086c3-c8c8-4359-82a7-2167f57183a2", "value": "T12984BF10BB90C035E5B316F0497A83B8792E7EB19B2464CB62D86BEE56347E5EC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648469457, "uuid": "5b2f9d4f-e5f9-467c-bf93-3e95e3c0c82f", "value": "62cc0f071500a34baf4b74c917ef3797", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648469457, "uuid": "db1d3e6b-3374-4355-9d1a-c02124c0a3fd", "value": "6144:9FtmMd5ZDyI3RplxD+qCLlZOkhhO6D4BT3VfIhdjEv:ftP5ZDB3Rpk5ZOkhh7YTFf4dG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648469457, "uuid": "3f3b9a5c-bfa5-46b5-8305-3a91c44439d2", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648469457, "uuid": "ccda8600-2e6d-4f44-9800-739382002e1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648469457, "uuid": "639a4a6c-8cc7-42ba-83ad-8d09c789255a", "value": "2f4452cd2297b0d56003bea28336e12b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e87e1ba-aedf-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648503412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503412, "uuid": "6559f293-56bc-4f1c-9f30-8e723f9a342a", "comment": "Malware payload (SilentBuilder)", "value": "91731a779cafee2ec5ca1fc0ab792a27", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503412, "uuid": "5a14737e-d6e8-4331-9a3c-7257d9a59187", "comment": "Malware payload (SilentBuilder)", "value": "1d2bb24d8bfd6d58d7e1320a431a869392144003419b36848a887b53d8d3a4c4", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503412, "uuid": "46e1ab7a-1f02-4689-ab66-d3e7d82e98c3", "comment": "Malware payload (SilentBuilder)", "value": "cf7f2c2c1702a652e219d9aa3bd3a83f83716215", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503412, "uuid": "c1dcdf23-6449-4a71-bcde-b05292a8fa57", "comment": "Malware payload (SilentBuilder)", "value": "95b2a8ce259e074bd71a714161ccf035971c57d90a843854a0ddbe86478fc22d5e14048d5a0690a2372897d4a0f7b587", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503412, "uuid": "285165e4-1fe8-4802-813e-acdb1b0e9bf9", "value": "T14AC3AD8BB659486DF921877488DB879A7363FC344FAB47473214F3366EB95A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503412, "uuid": "95e76a5d-7e27-4845-b697-709214f07b7e", "value": "3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlCt:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648503412, "uuid": "4dc93ac2-635f-41f0-8097-b2ab1b1ea33d", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648503412, "uuid": "f6de0db7-a614-4b6c-b6f6-c622f96896a0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503412, "uuid": "a8a42324-8188-4843-b27f-8a03923b365f", "value": "91731a779cafee2ec5ca1fc0ab792a27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00da714-ae36-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648431071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648431071, "uuid": "1400e149-d3ce-4bfd-9d9d-914e01a04530", "comment": "Malware payload (Formbook)", "value": "aa5bec3fc7d67dff5a8f52483dc8b57c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648431071, "uuid": "6cc35939-530e-431f-ab26-bf61469825a6", "comment": "Malware payload (Formbook)", "value": "1d9709a43a56ed769aee507cd4b9116ca3d72d93a86d612c0984f6ab375c1717", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648431071, "uuid": "dc8c43cc-b703-4745-a1f3-8d23a4b5d55d", "comment": "Malware payload (Formbook)", "value": "caaea4dba262c6f133184d2ff63e3952df338aa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648431071, "uuid": "3b2fceda-ca74-4c0f-b3fd-34fee27fb001", "comment": "Malware payload (Formbook)", "value": "e155985c2c3e555accf83b8169656ba1915f627ee31ef48aaa69ad91088a0e3840a00767bd7a60218b0c82a8ec54028f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648431071, "uuid": "13dc09b5-f8b7-4c5c-947f-8d98ef1ee7d2", "value": "T1BD342227BBC06F7BD969283303728376F77DC604D1C2990787505E9E3B7A19721062B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648431071, "uuid": "311a0da0-08df-48db-af3d-4f4d1f94aa0c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648431071, "uuid": "c4e9319a-f933-44b2-82da-f8490c874979", "value": "6144:rGilkYiV5INf/5IC9iVVnYDKSpieBXTx/pEQZRE5iR:hkKaCsVVnYDiepTJC6RD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648431071, "uuid": "a7c9144d-fdac-4ae3-b7d2-e13f73e0bedf", "value": 247153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648431071, "uuid": "def77f5c-9d6d-4390-8a7e-000a6b4bec5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648431071, "uuid": "900dbb9e-2be4-4165-bbbd-0f0fb005897d", "value": "TT Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba589ea-ae68-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648452619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452619, "uuid": "1d241630-b4e8-4315-8584-40939a0c5978", "comment": "Malware payload (Loki)", "value": "622db4fff41639c0233af0206f53c08f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452619, "uuid": "04673490-31e6-4a47-8854-12d13fcfe184", "comment": "Malware payload (Loki)", "value": "1deb513e8c6641b99f1c451e74711dcf8a4414abc18413272d908ae8e0c0afd3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452619, "uuid": "d1c16640-f75a-48c4-ae10-d990d2710a63", "comment": "Malware payload (Loki)", "value": "53e657258339c3d75adeb09e2c458c3aec90e200", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452619, "uuid": "56482dcd-3da7-4e71-a4cf-9a2d293627af", "comment": "Malware payload (Loki)", "value": "ec59c24f62bc5e8639537a696f15138485b1b0cfd7771a6b535d2fc9c86b6e63d08a55add7d3b7ad3e398bf6efa536b0", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452619, "uuid": "0391f6ac-ba6b-4fe7-bd69-54f8c3512056", "value": "T19E141278B3FAFE97E50EBBBE59A05F27540E5E02CEC88270A715B36A78704474131399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452619, "uuid": "283e1695-ffed-4eb0-ba32-3bc5afc82943", "value": "3072:g8xewcqTsewzLEkuGxvZLU1lU6NVwj9sWeHeIjfbeGyj25adHFQIIjQ+x6H8:/owcqT+zLnuCv9U46NVwhraTjfbeGoHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452619, "uuid": "31738fbf-a660-40c5-b12f-de042e4e1371", "value": 192712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452619, "uuid": "2738e75b-fd9e-4f5e-98f7-20f6ff9192a3", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452619, "uuid": "2b50a6b2-c335-4f3e-b5f0-285a414f8b07", "value": "Quotation_via_ishipserv.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "532d6f01-ae8b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1648467396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467396, "uuid": "b6c7d54d-c550-447a-99fc-6046b9b7b1f6", "comment": "Malware payload (Quakbot)", "value": "151d000738c7d16c8fd306ea4a1c72dd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467396, "uuid": "8abc2d7d-527e-4672-b8f0-960dd65fef91", "comment": "Malware payload (Quakbot)", "value": "1dfbdad812916fb80278d27d1f518173d9f2d4d46d96382378ad153adeb157e0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467396, "uuid": "ea40afe2-f70f-4360-817b-5fe02d3a4c5c", "comment": "Malware payload (Quakbot)", "value": "b4c5cb910eb65384ed25de400d24b1eb54f44a26", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467396, "uuid": "784355da-5c93-4647-af62-856a75fa746e", "comment": "Malware payload (Quakbot)", "value": "5ef03e61479a6cdc80c2cecceee13901f87bd995b9b69fff436222b2470e820909c3db249f342bfe0e98c6288caedb73", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648467396, "uuid": "706b1362-ab93-4ab2-bf10-ec713b0ebeb4", "value": "T156A4BFB976043DD6E52E467BDE96ACDC13B61763DAC7D4C980A47BC306A3371EE02806", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648467396, "uuid": "fc422699-153e-4da6-aef9-124738d2881c", "value": "d2e55687d0da61f27b29b4c4cf28df38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648467396, "uuid": "1d7c5afa-f5dc-40ae-8fc2-057627d6287a", "value": "12288:w0zoTwP349Ps7Wq/p/rzHzLCKiNIyoHho+AlGm:wMosf7/rzfCKiLTlGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648467396, "uuid": "33fcc755-5231-4ebf-b598-12389a1da60f", "value": 453120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648467396, "uuid": "e981c297-770b-4fc4-9144-80bbb5ce30b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648467396, "uuid": "41e3553a-84f7-4b02-a710-d26a1052f39b", "value": "1dfbdad812916fb80278d27d1f518173d9f2d4d46d96382378ad153adeb157e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b69a81-aedf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648503429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503429, "uuid": "a7fc038c-23b6-4816-b5b4-c7de6f82f757", "comment": "Malware payload (Heodo)", "value": "8d3a4c4f1107de322796d212baa2b225", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503429, "uuid": "db5f480c-4e80-44c2-8302-9ccca5c80e60", "comment": "Malware payload (Heodo)", "value": "1dfe821d153613d89a745dbe7f95ed61c4f44900097cb93a9ec9d14e4647cc92", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503429, "uuid": "8fc21a5d-1e16-44ae-9383-eaeb04b61280", "comment": "Malware payload (Heodo)", "value": "3d352b86d9f0c3fc86b1a0bcd5d35ee589de7433", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503429, "uuid": "6236e0c3-46e0-4b81-9b0a-e11354e52647", "comment": "Malware payload (Heodo)", "value": "31eeecc8cd9a2dd48a1441dcb91c43686242237023dd2aca5dfb1c63f83ea4f7fc1beb64cd2cc614561f24fbea02eb84", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503429, "uuid": "28994d04-40ae-4207-bf75-102cb67bd104", "value": "T16FC3AD8BB659486DF921877488DB879A7363FC344FAB47473214F3366EB95A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503429, "uuid": "617524f2-6866-4c0e-ae01-d94fa4877ec2", "value": "3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlC9:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648503429, "uuid": "3b9d788d-90f2-48c2-b60c-7c8d6ee3fab3", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648503429, "uuid": "3d69d5b8-4ccc-4d47-bff5-6dda86a57937", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503429, "uuid": "6c428a4d-495d-4b50-9742-478cb1d1eac7", "value": "8d3a4c4f1107de322796d212baa2b225", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a75b570-ae6d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648454496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454496, "uuid": "396ad6b1-7a35-49a0-88a3-6c3242598580", "comment": "Malware payload (AveMariaRAT)", "value": "401c2310332df57b56b12416be948470", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454496, "uuid": "e0602d79-4a11-41a4-a389-591f3bc9f22b", "comment": "Malware payload (AveMariaRAT)", "value": "1e44c6643254f7547111c6d6b60167d3303af2b0521c355335a9d90621d5a091", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454496, "uuid": "839b5f17-84f8-4269-93dd-79d84e5558f1", "comment": "Malware payload (AveMariaRAT)", "value": "3dd043c0b8455e9328ef3e836958e6bc46b876ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454496, "uuid": "1dcbebd8-3ce0-40a3-b88d-d7f21d7d350d", "comment": "Malware payload (AveMariaRAT)", "value": "3c25f8d7370a1adda50547c0c4fe5c0551c3a115e6b3cb8ed2d78a2735ea3cff11b03daf99a4cc5160d54c933c407711", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454496, "uuid": "f8f3f3c5-8484-40bb-bf41-ba8cd1f8a6e4", "value": "T13525F00232A55794E03A53BACCA844DC57B17E4ABE7DD26F1DC132CF0AB17818A1AF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454496, "uuid": "b9fa0b83-5fb7-4360-8460-25e7e9f65fca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454496, "uuid": "38a99455-8d28-4709-b563-d89f2af5b998", "value": "24576:Np7uMQRhzdGjSURLjsdG5sEQbbCpa63vuBEGQkZWyfL:+hkmURLjsdGuV62SJXyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648454496, "uuid": "da7d352a-6b72-4579-a2f4-4dd934a2b46e", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648454496, "uuid": "180a9d21-3048-4df1-8cad-f116b5d36d3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454496, "uuid": "7f5431ab-b1a3-4973-bdac-7c56a901931c", "value": "401c2310332df57b56b12416be948470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7d6dbe-aeaa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648480593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480593, "uuid": "576528c1-00c8-4b23-8e81-10265d8cf05a", "comment": "Malware payload (Formbook)", "value": "eda9b32a9ab8bf74687e7cda51d0ad32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480593, "uuid": "5253b5e2-7bfb-4b78-9075-d7fd4b0fdf00", "comment": "Malware payload (Formbook)", "value": "1e7717a2d798ca288276e378b76ee35a7cdd11e0d32ed32f33670163a08c390c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480593, "uuid": "8ca2e356-0049-40d2-bc5e-a785cf676548", "comment": "Malware payload (Formbook)", "value": "8c323b066d1ab02a7ea0fd0c3f66a32dc073ff2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480593, "uuid": "60284e25-388e-4000-b772-70bac52890eb", "comment": "Malware payload (Formbook)", "value": "0d58e5f1a22d8ad9d9d8279454cb01e8353d73eeca88a9861dcfa03af95d60876208a59a1186f4dcf8d697804e2d3772", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480593, "uuid": "8d73cfe5-bb8e-4cab-87f8-c87f8040dd47", "value": "T11C057E2DB2915473D0332A744D1B93B9AD26BE002D18B98F67F92C8C9F7B39075252B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480593, "uuid": "54619689-3725-4d95-9b65-ef9cb38d900e", "value": "050411d35bbff71bc05083b3cfc98bc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480593, "uuid": "b39569f2-97e6-4829-b7db-e940baa34cf5", "value": "24576:K01V/cee2U63yS26THrITr7Ruy/dpjZO/PdCLHOmS:K01Ve2dyqql76PdCLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648480593, "uuid": "07e511fc-72d2-48be-9d20-bc0479922749", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648480593, "uuid": "188449b6-976e-4063-8935-517245018890", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480593, "uuid": "8392bf60-690c-40d0-af1a-5a1c992b6995", "value": "IMG_RFQ_Specification_PO-37287-2021-03-11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b3e812-ae7b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648460422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460422, "uuid": "96cdb3ae-1c1a-468e-81bf-9b64e9e51264", "comment": "Malware payload (Heodo)", "value": "cdfa5af44a071879cfea69bf5ba944d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460422, "uuid": "f838dbf9-f0a7-4aef-bbbc-a2499f7492c1", "comment": "Malware payload (Heodo)", "value": "1e8d25a5861ddd63f2bbc4af2bdc0b6ff454379a80f042dbc851ae869d2f5d2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460422, "uuid": "50471370-053d-4d7e-b307-536bcbb003cb", "comment": "Malware payload (Heodo)", "value": "c7bc17bc57785868f81402b1d9d3cb830ac2f793", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460422, "uuid": "7fe71b81-0f50-4732-bca9-cbc6e82e3cd1", "comment": "Malware payload (Heodo)", "value": "67f1f9936e6c8a59cab3a459672048f5c711f26c52c5f1a451764ef990a4718dc32e41fc6bc3086ebd7b6b1a38923c9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460422, "uuid": "435f6201-caf4-4939-8685-27ebffb8c57e", "value": "T10094CF0272D0C47AC6EF23785D239B5AA7F9FC208A75C647A751BF8D5E326C1893035A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460422, "uuid": "39fc32f5-fab9-4e5a-8be7-f07f3b061ba7", "value": "8f8b1cb86c6697dd342b65a36c6ccbb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460422, "uuid": "637741d6-7cf6-43a4-a871-4ebf57ef3958", "value": "12288:zwn2hR3547jpDMgySPxpuCMS5AhugWarPU:DRJ47xjyIpuCMSqumrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648460422, "uuid": "bc56938c-0f66-4d97-a798-b258f99a81b1", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648460422, "uuid": "344d55a7-875d-422a-a7b3-86712756325e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460422, "uuid": "55a0d85e-3b1d-4ca3-a185-4ab6df1d635b", "value": "cdfa5af44a071879cfea69bf5ba944d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b4775d-ae5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447854, "uuid": "92cbc27f-27d5-4553-bbf9-c0c7f37229d7", "comment": "Malware payload (Stop)", "value": "5253a0d43a083a5f04988c4c67614389", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447854, "uuid": "fa0e8da3-dfd3-4b48-b6ac-5d0e8432f741", "comment": "Malware payload (Stop)", "value": "1edff28923d68b2853d4fb78ac673c6ed4c6d00a1f6c53e160bb717a0906145b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447854, "uuid": "c66f2857-08c5-4811-bf54-9119a4625c5a", "comment": "Malware payload (Stop)", "value": "048630da2103795c899d41bd153b879e8b13f64a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447854, "uuid": "20b6aa38-e696-48d5-982c-5363f9b6fd98", "comment": "Malware payload (Stop)", "value": "8c18ef5c0422f526508f9f79254af3bd034d5ce18da08faee7a582e0ef429dd09c025d5183f1eedd41b66cd630d752a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447854, "uuid": "4ed1e034-907b-490a-b7a6-b6a6168e6840", "value": "T181F402007B90D039E5B712F4497E83BCB92E7A719B3490CB62D65AEA57346E0ED30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447854, "uuid": "c316380b-4b7e-4933-8d23-f7661ee79e3c", "value": "0aa6e337c2cfd6bc7063b3211897b34e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447854, "uuid": "dfdbb15b-5971-48eb-a119-f7a8c0a3d9e6", "value": "12288:Ud2bIyqXQ9XVuDBDbVVjch01HM0Pv7gE5SuZJd65CWlNwR13wq4Ylv+V2ciksZ/:DZB/WDbVVIh6MqvsE5SueCGa13wukKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447854, "uuid": "ae5a0700-6d13-47dc-8f44-4c31de63fdf8", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447854, "uuid": "18534de9-7770-4af9-bcc1-a8b44cd1c918", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447854, "uuid": "9387f1bb-47ab-4ad4-9f60-252e94e4fa5f", "value": "1edff28923d68b2853d4fb78ac673c6ed4c6d00a1f6c53e160bb717a0906145b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63ff55e-ae5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447859, "uuid": "63954cdf-1121-479f-a818-3cebe28cc987", "comment": "Malware payload (Stop)", "value": "0b4c619b7cec115112047a377d4b055f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447859, "uuid": "2a88836a-90be-4903-9cc0-ae6dc59aa44f", "comment": "Malware payload (Stop)", "value": "1ee44e7fdab4cae9c908b950b86a5141cde35be944907f542125ee371c137e28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447859, "uuid": "4e80a7d0-2335-4da3-8164-371aa58ad2d2", "comment": "Malware payload (Stop)", "value": "f630af47221bbaca5ae946e8eab461e9d94a838c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447859, "uuid": "0c538687-7150-4429-a315-2e1ad0abaf87", "comment": "Malware payload (Stop)", "value": "1ab6c61c8a1d2f2f7244c528346a552e9827d11bef6b83df820354989ead35761fd05bd160e1da904bf1d7311ae6c279", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447859, "uuid": "2ff54145-10f9-4a1f-9600-8236abd3d2a4", "value": "T1480522213A30E077E1A694706A2CCA206BFBF8751E32851A375C577D6F213D0CF36A1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447859, "uuid": "0f659343-9a6a-4409-940f-fcf97d53003e", "value": "faaf45f51400f48ccc9484bc4fae33cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447859, "uuid": "8d83fe2d-25e2-4416-94f3-e69cbe2b642c", "value": "12288:I4ur+OvKT96bl6P93zw88LwYeuoHXgxNcqlYERUgNOxdbB:XurIdPBzw8NYeuOgAPEBOxdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447859, "uuid": "d7cd681d-8489-4b28-b8c0-7f4f0007b677", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447859, "uuid": "7a2a524d-9919-4b2b-a887-47ba8f8c5079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447859, "uuid": "198c720a-dbbe-4490-8c11-0d2e20bbf1d4", "value": "1ee44e7fdab4cae9c908b950b86a5141cde35be944907f542125ee371c137e28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df805f8-ae68-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648452301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452301, "uuid": "ab18855a-1e93-4bda-90cf-84c46f817776", "comment": "Malware payload (SnakeKeylogger)", "value": "bb155e0582679e7da9d106f72dc104ad", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452301, "uuid": "36c6e9e6-2ba6-490d-b8c0-12f5e28ad26b", "comment": "Malware payload (SnakeKeylogger)", "value": "20d4be06e6eb3b24ad927696a212f26651e0bbba4f04078cc2d6b67679ab48e5", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452301, "uuid": "5fa2c3f5-dc55-4e83-be2a-c0b7b7f3ec95", "comment": "Malware payload (SnakeKeylogger)", "value": "ffdb36c401b5c31bd8445aed651cb0dd8ec97910", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452301, "uuid": "b9a5a3e2-f830-4ef7-93d4-e912eb75816e", "comment": "Malware payload (SnakeKeylogger)", "value": "7cb4b03c8bc2358029e04fdc599c94a9302c77b723ef29c7043a2e35832054423714ace67b2f65fff033def0fe167743", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452301, "uuid": "39b37f4b-d55d-4d77-b2e5-92d758b98e0c", "value": "T152C2D0E05F123A68C38609375A25C9122A18309BCF52FD529F2D677C65C1ED1279FE8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452301, "uuid": "314911f0-c250-47ef-a6fa-19e41f6bf995", "value": "768:qiZus6kp7RHizQYeHeCBcaC34jImh7LKMif/vpf1:bsoeHezsKtif/d1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452301, "uuid": "f593a27b-83eb-4118-98ab-f485dbe1edab", "value": 27957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452301, "uuid": "426a3eb3-6abc-4515-b939-db1db865e4d1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452301, "uuid": "4c47a5b4-d5c5-4021-96b5-41d610bc3a8e", "value": "Docu1067400023.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ec4b1e-aea0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648476641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648476641, "uuid": "ededf5d9-8a00-435d-994d-b59904ec1612", "comment": "Malware payload (Heodo)", "value": "a733408e005556a14eeecf766d436441", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648476641, "uuid": "e080795c-59b5-40d3-ae45-3118dfcc2e68", "comment": "Malware payload (Heodo)", "value": "211a91ab009d0048c062c536d0c2c7e3b70ca5584316c0abc2d7e5f9f8f3ce1e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648476641, "uuid": "055f59c7-1700-49c8-bcfd-292942d15423", "comment": "Malware payload (Heodo)", "value": "ca7cf3569f0b8eae8c3143678b4658e037bd1068", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648476641, "uuid": "84420ac9-d405-4d02-a13a-b2baa6782a1c", "comment": "Malware payload (Heodo)", "value": "d32bfb6fef2f967264da99f5f8aeae923c32c7343470be57526bfdd2e40a22e5d285f0cbd4198c2ef7598506cb0312b8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648476641, "uuid": "c72f4a93-6ef2-45e8-b95f-12830cbf41a8", "value": "T125F4D63D2FAE4062D8660770145C0FE991ABDE25BB2255FF25842E2E2EB57C74879F0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648476641, "uuid": "c767333d-ff5d-4007-8869-af3d506a6bbb", "value": "70b8cfa68ef2c7898ee65b9a0ce218ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648476641, "uuid": "6ee3fee8-6912-4a10-a891-adbbc0c88ea3", "value": "6144:iKfJCALkjp1g4SbsLyKilbNUBmB5XORDlsOMAidDNcYs6kzpYmcHWk870zCxS87r:iKJCPjp1g4SbBKilbUD4LmQjcQ6JCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648476641, "uuid": "9732c3ae-baff-43a3-8b8d-fbebfdda0e8f", "value": 736686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648476641, "uuid": "44e2728e-8946-4943-a4e2-447ac335faf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648476641, "uuid": "a3b22b44-cf9e-4e8d-b493-bdaa10c946f8", "value": "emotet_exe_e5_211a91ab009d0048c062c536d0c2c7e3b70ca5584316c0abc2d7e5f9f8f3ce1e_2022-03-28__141036.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b07b80-ae54-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648443984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648443984, "uuid": "a3f254af-b666-4647-b362-51df2f1f9252", "comment": "Malware payload", "value": "aecdf33a76fac5f043f271aeb8700550", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648443984, "uuid": "ea0d0cb2-6353-482d-ac40-fda6ce5129c4", "comment": "Malware payload", "value": "21488d68fe4a472262bdae4b752585648a76192b71147bcd48a221be52e0a4f0", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648443984, "uuid": "6682667e-a8dd-4c01-9c04-0a0e0bdda826", "comment": "Malware payload", "value": "2f3c4fdbe2b9b508b8dc297a386d9005b3057a06", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648443984, "uuid": "784ff94f-facb-4582-be49-1216d778837d", "comment": "Malware payload", "value": "049cac5207ada76e02bb7c8d9d8b7e7d5ca300d0f35d1b4c79543e51fb496722f0f970037b02d54044efe1c6e1d5321f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648443984, "uuid": "8386ad35-cc1c-4f26-885f-418e4dfdaaf3", "value": "T1AA13F18B0777F874D6632A39A16CF580F9623A57A459AB47088E30FB4C57C322E31B71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648443984, "uuid": "e9cd977a-f1fd-418b-b6a5-d06f778ca55e", "value": "768:vTXHm1e/DmH0v8CSyfOX3zI1ahRD8XIvO13WlQ6lsET0Ksv9sPtPnta1R02BL6:vTXrXN0zIYhRDJvONkQsTYFudnAt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648443984, "uuid": "f8f2bdec-96aa-47b2-aaaf-f4a022d6ac0e", "value": 41532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648443984, "uuid": "cbd71687-0f6f-48ab-b3c1-3c87d43e63e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648443984, "uuid": "13fc93bc-b04e-46d3-b30b-23a8b90baa72", "value": "aecdf33a76fac5f043f271aeb8700550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1f5fec-aebd-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648488941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488941, "uuid": "792690e5-2ed8-4fbb-a512-2e303c96cf3f", "comment": "Malware payload (AgentTesla)", "value": "8fa00921f4b9ac2101681ec1994882c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488941, "uuid": "c12cc4ea-5643-46bf-8ed5-80b79afd0797", "comment": "Malware payload (AgentTesla)", "value": "22f36813e0738cad1fd9d651c46f8e61ca8481215231149e117c103ac25ac74e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488941, "uuid": "8021ceae-b9e9-44f6-8fde-b5b52b15bb3d", "comment": "Malware payload (AgentTesla)", "value": "b4f0c1b7905533bc761c87690ed614a7f85c3510", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488941, "uuid": "807d3faf-2a41-4b63-97d2-531bb29602e4", "comment": "Malware payload (AgentTesla)", "value": "e6c1b69f8bdf8883a1f66591ea39e7f8c6144e9d27e9b50ec38bc82b5b2e51a0a93e4afcaad041b1e739c64e5902f282", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488941, "uuid": "162d8419-fa86-4528-b5bb-1cfc6ef17734", "value": "T1F5A480BC7B414A72FD1ED030AD510AC9BB670B036280B99657FB16CA874F1F76E45C8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488941, "uuid": "4299f86f-847f-4e65-b088-fdda9eb93c08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488941, "uuid": "70d81da4-1438-4df3-b94e-cf72892f424a", "value": "6144:pgCKfzkJlz2JUZQixRlwoZw9/F2VcjFzsUbElccrmK2rzbB4RK3uJbRk:pg5fzkJt2JmQs/i2VcsQsdrfQ3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648488941, "uuid": "189d79d2-7b11-461c-b286-6ed24b4b9c11", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648488941, "uuid": "6b5a617e-6485-47e2-aa32-831e0c1d34bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488941, "uuid": "78e5e090-5487-4c56-a506-c5c7c4b84356", "value": "MV Blue Everton - SHIP PARTICULAR.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225007d9-ae30-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648428229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428229, "uuid": "b37ecdf5-317d-4e79-934a-2fe5dc3d1362", "comment": "Malware payload (Heodo)", "value": "641498203ec173d69281390743b58114", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428229, "uuid": "08891f71-1ec4-4ce7-ad8a-e6e97ac6cec6", "comment": "Malware payload (Heodo)", "value": "238e891532fa4ace1475695ff2c70e0891566a28f0f6eae2be8ef87c3d9482c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428229, "uuid": "a1d98b95-94d8-4926-b54c-e77493a6d26e", "comment": "Malware payload (Heodo)", "value": "12ebf66acad5f322878a75060208459300fa3db0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428229, "uuid": "90e15efd-e928-459d-9d7c-1de3e0d2d931", "comment": "Malware payload (Heodo)", "value": "6bece74fdac0343e8462fd44b9c8fdf30c16a75d7fc21e3cf46b9d11049452a6f8c21da9bb620abb8b0e3eb3f95d446d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428229, "uuid": "73836da8-7786-4977-b23a-d6c86c18f318", "value": "T122E49E1177D0C072C2BF3630551AA3B566EABC708DB9860B6FD42A7E2E745829D3871F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428229, "uuid": "1e3ea408-f30a-47f0-98ca-f48e43c6996a", "value": "923a5ec702466ffd61b422bacc94c6f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428229, "uuid": "5eb63a61-7168-4700-b95e-858a14a404f1", "value": "12288:JSycC8Tu2EEAeClIHRFa7UdUzrAKStI8X0oXYl2N17OP:JSDD7RDhH3dUfGtj0oXYl+OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648428229, "uuid": "5405c2a5-b0ca-4592-96e6-9f146d44c171", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648428229, "uuid": "0e2586b2-5406-46ac-a9aa-c9aac6b02eca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428229, "uuid": "d2a44ec0-a2e3-4593-b981-13305282cb9a", "value": "641498203ec173d69281390743b58114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0416cc-ae67-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648452160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452160, "uuid": "d84d2b55-6821-40ea-aa83-64ee9b54d326", "comment": "Malware payload (SnakeKeylogger)", "value": "4de14907731f6ca9f949e5045399b709", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452160, "uuid": "3e89fdc3-6c7b-461e-a52b-331ee12ab9bf", "comment": "Malware payload (SnakeKeylogger)", "value": "23951679ec5343e7c0fcc3cee890be8f5088b8b439cc844b298abe4ebf050aa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452160, "uuid": "c8b1db88-9578-49af-a517-4484d1a865eb", "comment": "Malware payload (SnakeKeylogger)", "value": "e05a5c8e45ef8b2bd1613f2712e9b98b4e30adac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452160, "uuid": "d1026db6-25f6-4908-b8f3-9c2faf1c37dc", "comment": "Malware payload (SnakeKeylogger)", "value": "02605eeaf9c5a2eefc89ed7426cbb6bc24ff2e5bd97507030806beafef4e671aad5009f234eb8a3815165fda33bed3c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452160, "uuid": "c0eb9098-b20d-47a6-af0e-031f55c0ef43", "value": "T1CE6423C63AD0C5BEE744607850BBAE7AE7FBD6A500C0DA4F2B101F6C39D5587EA1C484", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452160, "uuid": "4ef603ad-ef53-416b-95df-b1f8714326a3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452160, "uuid": "7f7c8238-a259-4617-b423-a1da5fb052b5", "value": "6144:rGitzOsTgJruXzYrS4jaeVIsOMKgr/wgm/dAYTYEkWmJpiJiJMyPOhn:xzOs9zYrSbeDOMKg/wgAdcmm7iAqyP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452160, "uuid": "d270b072-5912-49d7-a6f5-3a86b5fcd31e", "value": 309146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452160, "uuid": "4adb0c5f-d6d2-4dd3-a511-3bdada6299db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452160, "uuid": "516eeab1-302e-4728-8277-9358f231c9a5", "value": "4de14907731f6ca9f949e5045399b709.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e6d931-ae94-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648471532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471532, "uuid": "84604abe-9799-4a39-a488-a69fd0f5d6c7", "comment": "Malware payload (Heodo)", "value": "0368648696a66c57d207f7714157ed47", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471532, "uuid": "945d38c4-efcd-447c-ba70-43fea44f8032", "comment": "Malware payload (Heodo)", "value": "23d9f8357b53fa1ae0112f46b61cd73a323cb6a2cac8ca9fd0efaa25344d76ed", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471532, "uuid": "cd927ce5-d08c-49d0-a15b-1cecde94b112", "comment": "Malware payload (Heodo)", "value": "05c453b87be547d60d073d0d68d840bbc4899137", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471532, "uuid": "ca4b082f-1926-4450-b63e-2798058ac3bd", "comment": "Malware payload (Heodo)", "value": "0efce12ca33160d560f9e60ca83ec245cb26ae50f0ffb58d3a4a43afeca2a5e1c28a4f352f4d3c0b0c25cffdc13f2fc0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471532, "uuid": "eb0ccf62-1dab-4553-8e07-965e7acece07", "value": "T10394CF0272D0C47AC6EF23785D239B5AA7F9FC208A75C647A751BF8D5E326C1893035A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471532, "uuid": "87c9f7c0-3eb0-4d66-bf26-77319252bb0d", "value": "8f8b1cb86c6697dd342b65a36c6ccbb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471532, "uuid": "5a6f1a41-32df-4162-828b-a0bae2e71588", "value": "12288:zwn2hR3547jpDMgySQxpuCMS5AhugWarPU:DRJ47xjyzpuCMSqumrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648471532, "uuid": "0d3be4a2-0cb4-4bc1-bf74-c6be753f6416", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648471532, "uuid": "dade599a-be64-4c38-a0d8-bbd1cecca789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471532, "uuid": "c58c6d0f-8520-4d1c-b0c9-9fc828c7d822", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66eb89f7-ae37-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1648431351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648431351, "uuid": "787532bc-ddb3-4f4c-b756-89d3b44a7985", "comment": "Malware payload (njrat)", "value": "5124b1427fb904a73d6636e6028d4aaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648431351, "uuid": "06436567-5c31-44a6-b78b-037a51663af5", "comment": "Malware payload (njrat)", "value": "2409d1664ad7cbbe19b0991d4bf92303dda0de873508e95ce518f8e0127cba54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648431351, "uuid": "4a91cb39-228a-47ef-8791-ab57b0ffd15b", "comment": "Malware payload (njrat)", "value": "61fa4e55fd3d28fe5a30516299005e576c0ad318", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648431351, "uuid": "4628128c-5312-4434-bab1-b8a9d15941c1", "comment": "Malware payload (njrat)", "value": "db7edbb6333d5d47ce63ac72afef9ca9a2e9b180812d4ca9634c401e59671ed0daa2a82f42f0fb4c7f7d6d5ed83f7449", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648431351, "uuid": "ea6e3f28-a5b6-4b42-a4a7-866a7203cff5", "value": "T18845D02373EE8361C7B25273BA557701BEBFB82506B1F86B2FD4093DA920121525E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648431351, "uuid": "5958a686-f1ed-496a-a856-3f37860c445d", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648431351, "uuid": "9d066530-6e36-431d-b7a2-c09f75994d55", "value": "24576:Ttb20pkaCqT5TBWgNQ7aW816x6OpnqZV48K8kAIOw6A:QVg5tQ7aWa6cOkDBLQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648431351, "uuid": "998fb056-a44e-4ea6-a1d0-020b51f92734", "value": 1279488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648431351, "uuid": "b8e0aee1-29c8-4481-9e2f-587d80d0c124", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648431351, "uuid": "03895126-23f9-4880-8df0-8061d8b35871", "value": "2409D1664AD7CBBE19B0991D4BF92303DDA0DE873508E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de5854a7-ae67-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648452167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452167, "uuid": "c3497fba-d971-4d20-81a0-17f3cb212092", "comment": "Malware payload (SnakeKeylogger)", "value": "43e58e7b5b6b2aa698a3b47ca2fa8464", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452167, "uuid": "b91a159c-8265-4ba9-9747-e9d083115071", "comment": "Malware payload (SnakeKeylogger)", "value": "24b1f2fff317a93945c0ea8d3eb01b1dae964844f818b54f4896804b632776c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452167, "uuid": "cebe10db-4eaa-4983-8f13-1da7fcdea5e5", "comment": "Malware payload (SnakeKeylogger)", "value": "80e2d93c6968d036ccd206d9fe6dcb0ef7307924", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452167, "uuid": "6bbcd416-8faf-459b-9c69-62b8a0547d7d", "comment": "Malware payload (SnakeKeylogger)", "value": "35fc8162186e46fb080e9bc6507a92aa0d762d75d78fe2dad708fb70f9a838b17eb24f1dc51e5446c198a9df8f7fef12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452167, "uuid": "374caedf-dde4-4fee-9840-ddfeef2683bd", "value": "T1E73512A026A44269E57D93FC9456108003F6257BD4BBE78E1FDCB4EB2F73351803A96B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452167, "uuid": "ea993bf4-31c1-4021-9031-a5271e0415d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452167, "uuid": "0eeecbe8-b4dc-4630-9c91-10f83d29f6e8", "value": "24576:KVDmgwf99Ay354pbJchzVS0e/RS444z3Z3oq1Qfmj:KVSHVOy35miVKpm4zpd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452167, "uuid": "71bf5aa2-30bf-46ec-af2f-2d01149360c5", "value": 1120768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452167, "uuid": "55b775e6-efe4-4e86-9d46-34bf568747bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452167, "uuid": "aba5ff0f-01d7-4852-92d6-51a93df4af91", "value": "43e58e7b5b6b2aa698a3b47ca2fa8464.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6edf7a8b-aea3-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648477750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648477750, "uuid": "afaf8743-c9fd-4b99-ac9e-7d056f72af04", "comment": "Malware payload (SnakeKeylogger)", "value": "d524f7b851d2384c1c498d63c6d66c19", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648477750, "uuid": "eb7f0e1c-55a4-46c0-b32d-7ee61252126f", "comment": "Malware payload (SnakeKeylogger)", "value": "24d396e3d7b8c14f2a6908ebe8df1af7ec8cdc0075d73fdc3e02636c0730ac33", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648477750, "uuid": "05b2977e-51aa-4aaa-b009-aefcce046c51", "comment": "Malware payload (SnakeKeylogger)", "value": "5c2528d84242eaaf213e466329066ab0d10941c9", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648477750, "uuid": "8d70a2b6-4feb-4d26-82c1-9b988fe76abb", "comment": "Malware payload (SnakeKeylogger)", "value": "0ff645d9a945461937740f656c6b4be47d6ff5489f306527413c690d6ca13c818d5f7b12aea502e0a94578de20663094", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648477750, "uuid": "ed7d01a4-68f9-4c35-a856-e3b94c495a70", "value": "T13B730A119694D166C9E68A395CF276BC0263BE03DD76665BF8CDFF0E3B332400652B68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648477750, "uuid": "e611b685-9539-4aa3-9c41-237d91ddf887", "value": "192:Bvbcpr7T3DZygKlu/ZrpbyclDAJvW86mx92in:5bcV1Wu/Npb1lDAJvKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648477750, "uuid": "388a023f-f779-4f48-bebd-ad017366c621", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648477750, "uuid": "33f20d25-901e-4040-aed6-25f0a0180594", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648477750, "uuid": "8631fc18-dd0f-45ec-b22b-6b0f84c148ba", "value": "BTL4605781031110.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67234e1-ae6f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1648455536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455536, "uuid": "d66cc43f-168c-419b-a7d0-4e6ad645f4b7", "comment": "Malware payload (Smoke Loader)", "value": "3f95f2ba2181e0d2d426433f0849b0bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455536, "uuid": "4aee6e20-3887-42e8-9988-76da17bcd97d", "comment": "Malware payload (Smoke Loader)", "value": "24f86ebd6788dbb22a7889fb0a483fd31f92552523e9dee8231e02adabc2375e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455536, "uuid": "afc135e0-8497-4080-8fcc-405bc9d4b735", "comment": "Malware payload (Smoke Loader)", "value": "0f47da7a2e0af7c825afd07d6554ad5bfc74d591", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455536, "uuid": "b34a4569-eff7-40ba-a8e9-d7b7e49a428c", "comment": "Malware payload (Smoke Loader)", "value": "0f3734d71889ca9b10aa0311d9828f6bc9c447e9deff2708f0ccde6c9461477a02b108c818993b76e08d0a2d673d9186", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455536, "uuid": "abc0a629-c734-4d23-94a5-a3ab8bc28c08", "value": "T17A34D0113690D471C897613578A4CBB05A6D6B3253B6488B3BAC277E7F303D11BBAF4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455536, "uuid": "54679fbe-de21-492b-bae1-237bc31814cf", "value": "7d2f3e2df9d6e9df3acc14e0869523dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455536, "uuid": "2a966147-27a3-435e-9740-6497c137fa61", "value": "3072:6317gcXRhS0Frmr3QozqudBa5rl/dKM2l:kFbS0yrgfudBcl/dM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648455536, "uuid": "96adb00f-9ab1-427c-b1cc-659980160aa9", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648455536, "uuid": "07e76675-a0f4-4a9f-a13e-ef7f91636bd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455536, "uuid": "69243e61-54fb-4f20-b932-356110d512b3", "value": "3f95f2ba2181e0d2d426433f0849b0bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a1cf97-aee5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648506316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506316, "uuid": "71e42f96-52d0-43bc-9c8d-747c16d7c7e4", "comment": "Malware payload", "value": "61e580007a1e3a51b7095d235c777a33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506316, "uuid": "9a4cc58f-1af7-4641-a557-4ce7f64593f0", "comment": "Malware payload", "value": "252fe42ab7c5c6bcfebadef19354105dfcee481d8bfa11bfb35db4184627230b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506316, "uuid": "6cd67b98-d263-4528-a07f-360246cfb405", "comment": "Malware payload", "value": "0349f2bfb1066a9f5550cd66dea09630458822d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506316, "uuid": "a7be1708-8388-45b5-88b4-3165973e38b1", "comment": "Malware payload", "value": "60b4a62d465439d4dfe708971e424a3b38db6a368c9a472b57e9e143329041dd51fc952b2656614cdcda609b41bef863", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648506316, "uuid": "f18a8474-892a-493d-b018-c3e3fe1b4b58", "value": "T184E48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514D7432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648506316, "uuid": "65aebf20-3b41-45cb-b421-1264450da5f3", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648506316, "uuid": "31ca7b8e-e7e6-4126-9340-b9041fb3621b", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7OvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zQCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648506316, "uuid": "bbdad5ac-e3ad-4da2-b8b1-64a4fe5a002e", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648506316, "uuid": "531358ac-cbf2-4312-951d-bbfb53e9dff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648506316, "uuid": "be7a1761-00f4-4e5e-a4d7-1fb5e539582e", "value": "61e580007a1e3a51b7095d235c777a33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392002fd-ae70-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1648455755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455755, "uuid": "d10d2bcc-f5d5-43a1-8e57-8344e7d30658", "comment": "Malware payload (Quakbot)", "value": "d54f00a0375ad98be93b19c8f6b6c812", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455755, "uuid": "403c23d9-3a10-43aa-be02-74207e2283a3", "comment": "Malware payload (Quakbot)", "value": "25809794d0353c7d1d5d3b492e23fb844b549dc96a45da28647291523e95c629", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455755, "uuid": "c49514cd-4cc7-4a10-8d3a-97bdc10bd087", "comment": "Malware payload (Quakbot)", "value": "580434f93c4328cc5b7c3cf4d6559ee9dca7d88f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455755, "uuid": "3cf86575-5347-4160-b493-5e4af702dc84", "comment": "Malware payload (Quakbot)", "value": "8d133dd1ae9dda47cd6e50a15168d1a25e4e5c433193966f2419836abaad0efbd77aadbf92b1b957868195e5a6a4afc7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455755, "uuid": "cea161b6-439b-4330-8208-3230a644de88", "value": "T16524125F60B685E783BEBCAA6425168B9DF6DD9C3FB0C59B460CF3051738C24860FA19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455755, "uuid": "f52b622b-ea23-4e18-9b14-5f3b617a765a", "value": "3072:h7QFyESg8mpZDt/CsJLPXiuBNA/WKmRk+qioOuPSobszInV/oUQDznwCsK:xFFmpLPJzyuNW9mVxX834ARSfnZsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648455755, "uuid": "03d64e72-b52a-40bc-b2f2-0b5220ab9295", "value": 219435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648455755, "uuid": "d6d84163-8b1a-4f6f-bd65-ba6fc4718ded", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455755, "uuid": "556755b5-a153-4cce-b4c7-f0a92c84c55e", "value": "inhmllluia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc71065-ae3c-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648433455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433455, "uuid": "39b25d62-e13a-430b-ad6d-66bc3f921779", "comment": "Malware payload (RedLineStealer)", "value": "7237bfb8401387e95bfc69a0679bc0e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433455, "uuid": "150c79f9-7829-4dcc-bbe7-0e99c0339d24", "comment": "Malware payload (RedLineStealer)", "value": "26a6f78a219cf69956b9d58fb4ff2a7fcb80534e9adaac70a9d695b386d48b75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433455, "uuid": "9326aef6-97f2-4a83-a899-77c3e0f60888", "comment": "Malware payload (RedLineStealer)", "value": "9cb7d15ced86b1d27f1b3759ad69c7b9783cfb4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433455, "uuid": "becf8520-7174-451a-9cca-40eb089d71a3", "comment": "Malware payload (RedLineStealer)", "value": "35162cf5baf5273c87d619de99a1a77eb9ed1c674b112f5c940eb697745b9485656d49eaa58e448941c09e4e5089a60e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433455, "uuid": "763e4308-03ed-405c-bee4-a1758f6f332e", "value": "T1FDD423B702A4DBB9C64F79329B68FF37EA16557493F08122722DCD6C1F14021E62A1E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433455, "uuid": "4a9a0d72-ace6-468d-976d-0a7931738851", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433455, "uuid": "b737552b-e1b6-4549-82c5-8b0d04d06612", "value": "12288:ktBchWcuhrb+4MgSVGt66vlqQS03ULaHNqrxlKIQNoBIEs5cKIo7rUjRzFV+PrqR:ktBb04MxMt6hkEaHNYK3Qq5cKh7r4Zq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648433455, "uuid": "3ccad917-d598-4bae-a3e5-834ddad98dca", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648433455, "uuid": "370ebba6-a203-42c7-bbbe-b5be22344ab6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433455, "uuid": "e8329f6c-598f-4103-855e-a775df57180a", "value": "7237bfb8401387e95bfc69a0679bc0e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0421d7de-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447936, "uuid": "a1f61867-cc54-4392-9d3d-6ec1607306bb", "comment": "Malware payload (Stop)", "value": "470547041f213ab6faf909b43ff62e42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447936, "uuid": "aae9ca5f-dcb9-4ebd-9472-a1e9ab4a3a4a", "comment": "Malware payload (Stop)", "value": "26da4bf440b1709fe00d64826185ee8ef62a5885bbfc8c835511b7202865adea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447936, "uuid": "e0c7d16a-19a9-4242-a2f1-2afdd42fd09f", "comment": "Malware payload (Stop)", "value": "22d55933e4f557a555ef9094eb6541a95b954f8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447936, "uuid": "9615a407-bf8d-4148-8aad-3a4d2d40d9cb", "comment": "Malware payload (Stop)", "value": "873d3cf8d21c1d26c54bdb77d560e8ff8c1201e7481e155781470bd116edd75804f5510867668e21237b8b62c93565de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447936, "uuid": "cfbe38b7-2315-4450-a65f-4cf360e5648b", "value": "T1B7052210B951D0B2D18F633A701ADAB4AEF9856117D18E4B3763467E9E203E31B7A387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447936, "uuid": "8a98ce53-5c23-476d-888f-437d274fabe0", "value": "a945bbba5e19a9f29aa1458bdc91ed8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447936, "uuid": "bb0b7676-4dd9-427d-8586-1a68febcc15a", "value": "24576:rz7Gi6SukIBlWcmeAJRhlW0D41RN1Jcb:rzj6SR2WcmpJRhlKb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447936, "uuid": "25d90731-3afa-4831-8016-f986d58401cf", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447936, "uuid": "404bdcf8-dd5f-4702-af00-8d5667ad9a63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447936, "uuid": "ce47e213-250d-4ee7-97e2-3db1cd001be6", "value": "26da4bf440b1709fe00d64826185ee8ef62a5885bbfc8c835511b7202865adea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c59f682-ae6d-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1648454419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454419, "uuid": "3fb298eb-66b0-47e7-8ab1-0ba4303ef563", "comment": "Malware payload (ArkeiStealer)", "value": "02fd0c038edab225e44611026e0a17b1", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454419, "uuid": "af8d0f86-e7d0-4003-8c5c-af98585aac25", "comment": "Malware payload (ArkeiStealer)", "value": "274dc05ddbbe13a60b18703b47b77d54d70ac40d8ac3419c3ffe1d7a5ba66113", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454419, "uuid": "d549982e-95cd-4c15-895a-7a0575ee22aa", "comment": "Malware payload (ArkeiStealer)", "value": "f9dc6d6ba1219614a5bc37af7e6c4617d8884598", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454419, "uuid": "ba997b99-3f99-417f-8dc1-4fc6f5b6e503", "comment": "Malware payload (ArkeiStealer)", "value": "023d73afd3c58954f392c5dc9a9999373cfcf6843f7f4ef0a190a3627d2c0d1c0e826b352a490fe0afd74cdb1bfd66ae", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454419, "uuid": "4ff1f20c-fbc1-416b-abdc-257452ac06d5", "value": "T120E412227682C473D12602B0280BD7754BAFB8321AB16ACB3FD555ED4F343D2DE6974A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454419, "uuid": "d1964243-f007-492c-bbcc-f5a30964c9c1", "value": "cd8ed96dcf990359020da5c59a04eafe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454419, "uuid": "8342d6e5-7588-49f3-9514-b00089cc95aa", "value": "12288:UXIQZhd2ttrGet4z1hwMGEK0xaTS7jXGyyIh9Z:cHjeaetG8t82SHXqCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648454419, "uuid": "009bcfdd-7730-4b32-bc9d-d4d8a410016a", "value": 664576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648454419, "uuid": "6ca36dc0-63f4-49c8-9076-7e66f2bbc9cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454419, "uuid": "fec1e35f-c972-4b57-b2a1-c3c117c586b0", "value": "02fd0c038edab225e44611026e0a17b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4605b8ad-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448046, "uuid": "66e02a9a-5b33-4485-8763-ca289869eb19", "comment": "Malware payload (Stop)", "value": "572d0c4cbbca6aca5c6c6a228f6f9cd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448046, "uuid": "237b4b67-f65c-4463-a09b-57a0798b8f3d", "comment": "Malware payload (Stop)", "value": "274f789229cfb721debcb8538e1bb6c7dc538d1afa74de51173343c6e030ecf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448046, "uuid": "1d694321-bf7a-4b7a-8d5a-7d984aa6cb06", "comment": "Malware payload (Stop)", "value": "03ef88a7b0bc2992493ed7a2c401319a330d21fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448046, "uuid": "34b736b9-2662-4067-9859-5475175aaf52", "comment": "Malware payload (Stop)", "value": "f4a105e5b833f7667345a0587b3bfa87749564cdf4df5984708e77618b8046dc2b37971abec173943894df485379667e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448046, "uuid": "62acfb1d-5b63-4a1b-84f4-0ce057567c14", "value": "T1C4F423293C50B431C59B987A640129DC6B7E7C7002B158873FAC56AE2F64AD2FFD538A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448046, "uuid": "ef60ffe2-4ede-4ca5-942a-71eda1d3d7e1", "value": "ed1b2792ced7a8e7bb849a84d01e5fcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448046, "uuid": "3155e921-5c2d-48d8-9ce8-8011715aba23", "value": "12288:HvbZW2sjOZsD/oPnumRoGReNmZne6eYAIQVrsnSwP2tfjYx4:HvNZZsD/IRHZnpuI0HJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448046, "uuid": "f1e8da19-a476-43a6-b981-891ca699fac2", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448046, "uuid": "5120ae39-c565-4273-a47d-626dac744bc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448046, "uuid": "dcc3b93e-3aba-4ac4-88d6-e50111f4e89c", "value": "274f789229cfb721debcb8538e1bb6c7dc538d1afa74de51173343c6e030ecf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec61a96b-ae6e-11ec-8e58-42010a9c0032", "comment": "Malware payload (LoaderBot)", "timestamp": 1648455197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455197, "uuid": "987fb02c-4573-4a88-9348-1d4dec5c1fb0", "comment": "Malware payload (LoaderBot)", "value": "987b894efcecf9c750aa0109679f5f94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455197, "uuid": "316bc50c-d549-43c5-bb4e-5499ef2d2633", "comment": "Malware payload (LoaderBot)", "value": "27872335f6209985f6af4b0f94c4df41f3fd8c1da25c3dad3bc0498df07a1966", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455197, "uuid": "b6451190-a72a-4104-8356-610b4ba1afe2", "comment": "Malware payload (LoaderBot)", "value": "ce476461fb924ac2429c79732eda6246c4aef1e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455197, "uuid": "31f04641-4d88-4f9c-abaf-f385848c4e05", "comment": "Malware payload (LoaderBot)", "value": "690429e59277b9e683c72f1d574d7fd0235b49c31b36af70ddb88424a5c3c934b0482e8abb21b89e4cf56684c678623e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LoaderBot", "colour": "#C02BF2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455197, "uuid": "c20ff030-f88d-4b06-a550-be887a27d072", "value": "T1D6D59D46BBD08F27C16A4B798AE787157339DC449F435B0B6348B2193CB23F46B926D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455197, "uuid": "96b80659-30f0-4892-a744-5bb9ffbd6ec0", "value": "24576:kHnNi2Lx6OFvpxJY5BHwDYtFy6b8XxU30VUV78d6ij+RNqN+7A6RdexYcer+:kHNDFFPJu8fBsVE6ij+RNg+UKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648455197, "uuid": "34dc6c3b-791d-49fa-b825-4781d45aaf01", "value": 2984287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648455197, "uuid": "c37430b7-72b6-43cb-ab92-ed28acb8e768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455197, "uuid": "238498e5-35be-4c46-bd7a-59b6ace69550", "value": "987b894efcecf9c750aa0109679f5f94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab681f7d-ae7c-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648461101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461101, "uuid": "ad7c8b0f-e3a6-40de-80e6-3742ad65f943", "comment": "Malware payload (NanoCore)", "value": "1b0469fef5a448ab9e2bc597da8554b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461101, "uuid": "c8ec0e31-42d5-41c9-98d8-2e95d56dd804", "comment": "Malware payload (NanoCore)", "value": "279b0de566cfa70c9f15ff2499b62a12d47d627eaa7912c719f57443e8eadd49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461101, "uuid": "064533a1-0821-43a1-b598-6899e639f989", "comment": "Malware payload (NanoCore)", "value": "ac54bd52b0eb40ab039bf763b6c47213dbd6ac84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461101, "uuid": "9032571a-b165-4ca9-bf53-f3ad5ea1ad8f", "comment": "Malware payload (NanoCore)", "value": "1552f8bd407166b2a5111947e47cb53b834c5ccd079e67f5f96933e6024a7203da704d9a0d3dfafd0ed03c2f4ec16570", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461101, "uuid": "01fa73ae-c84f-4313-967b-f138ca6c25f6", "value": "T10E043002657CA8C3F69C6C73A8DC975E1EE06C6C4676106DF247B6E9E53F103E6212E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461101, "uuid": "c60c9e2c-44d1-475d-b0d8-90ee09277f9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461101, "uuid": "b95c567d-0535-4552-a960-f8135051aa81", "value": "384:ZTgbWNCb3kKBS+yVmROla/bhFVeGYdNETT4k4g6tGocA04sQm6eS2KWVAWne3MeC:ZMbWY7yVm/b/VeaaMe3EkGGPr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648461101, "uuid": "912e6fe6-e6e6-4559-93ff-b850a07df0d9", "value": 174592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648461101, "uuid": "dc20a787-e808-4e83-9678-ad4a4f8d0754", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461101, "uuid": "1ee41502-95a8-4f30-99eb-f53ea60da997", "value": "PURCHASE ORDER NO. DFT-000184.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07794dba-aea9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648480153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480153, "uuid": "9845b3b8-ea33-4615-a0b6-d5d852345057", "comment": "Malware payload (Heodo)", "value": "e9ccb488bc7b527459c6417f0cb93c65", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480153, "uuid": "df923fb4-62d4-4560-bf23-49389a9504fd", "comment": "Malware payload (Heodo)", "value": "27e2ba9d9ea2c27be4c627356d09616e50318761fe207dbb9bdb80fafddbb2c7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480153, "uuid": "9de41951-afcf-44c8-a5b4-dc363c3367c9", "comment": "Malware payload (Heodo)", "value": "448bb4463964c3bcaa868bb9b1263051e3bf8a70", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480153, "uuid": "166f4a7b-03ec-4ecc-885f-1d97f3496578", "comment": "Malware payload (Heodo)", "value": "800c27768f628f1c07e4168c14085d523db86068b346387615d46b76d61939ac5ef6b49bcc34b856c2569007437e1d4b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480153, "uuid": "d8d06e7d-9019-47ab-8e3f-ca55b768df16", "value": "T15BE48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93FBFCD302514D7432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480153, "uuid": "1d991bad-a4ce-4016-a75e-57e8f1dae6b1", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480153, "uuid": "ae68c746-92f4-489e-bcc6-43086c2d64b4", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7dvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zvCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648480153, "uuid": "542ffb3c-60fd-4921-8301-5964248d7043", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648480153, "uuid": "b21d4fde-e294-4c23-931b-4a421e387e42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480153, "uuid": "bac10d3d-8a8c-4558-bf99-62167193ea4f", "value": "emotet_exe_e4_27e2ba9d9ea2c27be4c627356d09616e50318761fe207dbb9bdb80fafddbb2c7_2022-03-28__150907.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e332a237-ae6d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648454752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454752, "uuid": "16ae4c3e-bd9f-46d3-a0a3-b36235344fab", "comment": "Malware payload (Formbook)", "value": "c1bb3b62a19bbca75a02771672bee634", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454752, "uuid": "bba6920b-2fab-4b0e-8f46-8e524d602367", "comment": "Malware payload (Formbook)", "value": "290a46cb558e5a98e28e74d3da5264d41bf2c9a6f20bf13a34c76037413b84f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454752, "uuid": "c52a05f9-7c52-4e5a-b47e-e8436f617984", "comment": "Malware payload (Formbook)", "value": "4390b977551717f392678d5ce12492fe84a70e1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454752, "uuid": "4d38a0a3-51ca-4b81-9c17-1fb002e3e266", "comment": "Malware payload (Formbook)", "value": "b148c8ab875af3f99cbc8ed6c277cf6c84a7f3fc36bfd24ca3d08f7d0650800c2bd0824b03f6b06745e18d3a7b72adee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454752, "uuid": "57bbf857-ed7b-4e70-96be-12fb8eff482b", "value": "T14235F01132E45B85E03A63B6DC6944DC83757E1A6D7CD22F1DC271CF1AB1B828A2AF47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454752, "uuid": "986ff5ab-1b59-419c-a027-d2041473e242", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454752, "uuid": "61dbc160-c14f-4d0a-a8ff-90f70f20edb3", "value": "24576:KpM5UjoUr/CFpmh20jS87lYSm/VatUSJimZK33:AjoU7CFpmhHu8JYSmfQPI33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648454752, "uuid": "147979d2-2b97-4c70-9272-832b0c7910c5", "value": 1105920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648454752, "uuid": "b35fa987-ff65-49a4-978a-73aecd7ddef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454752, "uuid": "6f521b4c-577c-43c2-8bd7-e6444060df8a", "value": "c1bb3b62a19bbca75a02771672bee634.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2963915a-aeca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648494384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494384, "uuid": "d1e803a9-e253-4f26-82f5-a49aa618ba52", "comment": "Malware payload (Mirai)", "value": "705a33affcef18c489ed78f0ee94afdc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494384, "uuid": "0c36a89d-c5ad-4e9d-97c1-8c2286eac26b", "comment": "Malware payload (Mirai)", "value": "296096e9e17e080bc571adc13426da21ca9ccf880dc759e46c02bd1c51a32c1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494384, "uuid": "9552896e-27e4-4b9e-9ca8-1a0c3f760cfa", "comment": "Malware payload (Mirai)", "value": "f466f9d23d0b0f042066c6be28072bdd48f885c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494384, "uuid": "85d48a92-9af5-4140-b2a7-776c21f629d8", "comment": "Malware payload (Mirai)", "value": "29f68ce7b67f2366a735e6f9e57d39caddd049c6d64961af49b0f4f18e710032f658ec813e7e1370ffb204dd1ebe2777", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494384, "uuid": "85b43de6-c878-40e2-8500-8f9303e61536", "value": "T1F0D2E1017640FEE1C5B00236E967869B722A3D79D0D134FB8A3C0DF8A6E951D47F4983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494384, "uuid": "7153b4d1-d341-4e31-a5b6-bf8a2fafe9d8", "value": "768:EusHfRavjynNKnjFcZIhQzhKMXg+9q3UEL7U:WRwynNIOQQ1KMwjLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648494384, "uuid": "c9e65192-4671-4518-abd8-1807fca8a7b6", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648494384, "uuid": "b943e528-cd42-41d2-a0b8-2aa072778143", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494384, "uuid": "4b8e701c-c65e-4352-8ba1-504542ca5055", "value": "705a33affcef18c489ed78f0ee94afdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08cc0eca-aea9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648480156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480156, "uuid": "a842776d-daa7-42d6-8527-2f416e24842b", "comment": "Malware payload (Heodo)", "value": "a7dbb80448cd409fb956bd0012b902fb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480156, "uuid": "0e2ee5ea-651d-4472-935f-650ec3608e39", "comment": "Malware payload (Heodo)", "value": "2970f8bf60a5545676e5652b3582b6aa6c9339e4fd3644040d86dad0e1e9a22d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480156, "uuid": "ce588015-8483-4d66-9f17-0667d107d8b4", "comment": "Malware payload (Heodo)", "value": "2f852ce0407993e0195ad71cb8dcb56446fba749", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480156, "uuid": "5c5a101e-302b-48f8-969e-6449ba2cc45f", "comment": "Malware payload (Heodo)", "value": "2c8bb12e729ab21ba209ae8d77d75aa86c032dbf0a6328e3a042827a47635e6f6aedfdef5868f8cfb5222b78fb7b5a89", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480156, "uuid": "847a6b67-b63b-4ea7-92e1-4509070a8ad7", "value": "T12CE48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93FBFCD302514D7432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480156, "uuid": "dec63205-c075-4905-b9f2-3d93c0f34adb", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480156, "uuid": "3bb0ba01-a20f-4f6d-a20c-04242d2a1869", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv76vK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zUCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648480156, "uuid": "58a707ce-6a42-4a37-801c-a4670e8ecbaa", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648480156, "uuid": "3c4b05c7-7774-453d-b077-dda91536502e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480156, "uuid": "ad4d8112-0963-40dd-a28a-c7cd89a05eb0", "value": "emotet_exe_e4_2970f8bf60a5545676e5652b3582b6aa6c9339e4fd3644040d86dad0e1e9a22d_2022-03-28__150911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c17ee0-ae6d-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648454495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454495, "uuid": "a172c99f-a1f0-4d0c-b447-b9bd0e0e5044", "comment": "Malware payload (SilentBuilder)", "value": "4e50469d604a7736440f3484ff1178c3", "object_relation": "md5", "Tag": [ { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454495, "uuid": "e57119d2-e205-4dfa-9a2e-60dd2401f308", "comment": "Malware payload (SilentBuilder)", "value": "29bcfe676160be417d74a8813dece47684adfabc3ca5977ba38fb5f27fd36475", "object_relation": "sha256", "Tag": [ { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454495, "uuid": "e87c2a16-1b45-400d-8f1f-6d454271333a", "comment": "Malware payload (SilentBuilder)", "value": "7d9343f76f0db8e8e2431cf7a3f21416f84c41c2", "object_relation": "sha1", "Tag": [ { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454495, "uuid": "0a7588db-a91f-4e3c-91a9-89369b91468a", "comment": "Malware payload (SilentBuilder)", "value": "8f32e0dfde64ee5547e3d55f537243011d294923e63d16e6415b5ad49be5ec84352afc56ffd131af95fb372227c6cf25", "object_relation": "sha3-384", "Tag": [ { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454495, "uuid": "d3b7ad68-a543-482b-a655-bd0174499f81", "value": "T1F943E95BBA49985DEA14877548E743997323FC304F6B074B3269F3257FF89A05A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454495, "uuid": "3cde6556-bac9-4475-81d3-7a6a4e307060", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umvj:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648454495, "uuid": "e29ebdc2-3bf7-4f42-91dd-8597a970c383", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648454495, "uuid": "648cf289-af73-4c03-8e24-e9c1cd3f9028", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454495, "uuid": "4127a0fa-3847-4827-8bd9-894bcefb03b9", "value": "form.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b11b30c-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447947, "uuid": "6cf2ec86-01e4-40d2-9be6-1b4258adce4c", "comment": "Malware payload (Stop)", "value": "713f27026abe243b665885a989be3cd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447947, "uuid": "7a56dad8-8f53-4362-a583-a5981d83aee7", "comment": "Malware payload (Stop)", "value": "29fa88d3a26da9c979c5c10df4a0bf9d2a972fad38624200ffe80853455711e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447947, "uuid": "d568cef2-c653-4ddd-b9eb-8d048523c408", "comment": "Malware payload (Stop)", "value": "7770cc9291fd1d96b375d917d42ed30c27c12d8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447947, "uuid": "32ac6207-1529-404b-8717-ae2e21d8ef04", "comment": "Malware payload (Stop)", "value": "fe0e14b1c42fee78899079dbb9d69c5f4aa0dbda5d62e887d582afe28330072b8c45ec42e8f9c18cf5ab0a9d8486a59a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447947, "uuid": "701f9c58-5830-46d5-af93-37a6c08c5fb9", "value": "T121051202348AC036EE5383755D15C6B04DDFBC721AA5D68BBBD6016C8E356C7FEA9382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447947, "uuid": "7fa08981-752c-4db2-b2f0-36a383616265", "value": "1690f0efc188c620ac36940e114b98ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447947, "uuid": "2c3e9e07-74df-4a37-bf25-1962ad59fee4", "value": "12288:fLmD9Hp4GSNJmIiThRisivGnvW+O2MF4P7Jf5p9jtFNcjiCpJCw4:DM9HpINJbiTP1cGnl7rJXEiC14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447947, "uuid": "bd87b47f-2d82-41e6-acb1-0139865e0ffd", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447947, "uuid": "fba5fa4d-bb8b-4852-aafc-ff5deb257030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447947, "uuid": "9bdd823e-5908-47f7-9754-f673c765cc03", "value": "29fa88d3a26da9c979c5c10df4a0bf9d2a972fad38624200ffe80853455711e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a042822d-aebf-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648489859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489859, "uuid": "181fd49d-cbde-40d1-8ee6-aec0f0e36a7b", "comment": "Malware payload (RedLineStealer)", "value": "a7af04178434115650a216c3d0788acb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489859, "uuid": "bfc4550e-12c3-464a-aee1-c3d1d3c59a6b", "comment": "Malware payload (RedLineStealer)", "value": "2a113ee60a247825cea2ec2cd7bb1b33302729ee6fbccb2a9fd23f582ace7746", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489859, "uuid": "9b30db00-1025-4bb0-9d31-db9e2b2706bd", "comment": "Malware payload (RedLineStealer)", "value": "04b1c548df2ba5c8639e2b3fd5ec65b8bc56d995", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489859, "uuid": "00da3066-bbca-454b-aea7-f153f1a684c4", "comment": "Malware payload (RedLineStealer)", "value": "1669615af19f331bf1602cc85be5d952328600b165d8f5e42db06bdd4d5789de656149cce42bf916b4c2fd7d1699905a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489859, "uuid": "a1e7b18f-1daa-44a6-9a84-4917a515f803", "value": "T17784CE00B790C035F5B716F4597A93A8792EBEE19B2555CB72C92AEE5630BE0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489859, "uuid": "9177a844-d9d7-4950-9599-d39e6b9cff22", "value": "9dc95cd500d9b0e61eeb42c26e483caf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489859, "uuid": "586cc44d-750a-449e-9554-1bc85f6ff8e6", "value": "6144:sCMUh3750S0fn6r+i0VrLllPbcL57SjyKcwniTPhj+5RuAYQCDkQ2:sCMUF50Swn6rQ5lPbmSUY5XD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648489859, "uuid": "2e92e053-6ccc-499f-a9c8-442a7430ab59", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648489859, "uuid": "84bf25c0-0a43-487f-8c31-a9dd394b90b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489859, "uuid": "a7e8e135-3445-42d1-abd5-4bca8c2f61f9", "value": "a7af04178434115650a216c3d0788acb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8da21e2-ae7b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648460694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460694, "uuid": "18e5fe8a-97bb-4c42-8ce1-22d783d64324", "comment": "Malware payload", "value": "bca5ee5314cd77530cdbe4995c2cabff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460694, "uuid": "208f7ec6-e2ec-4407-8b96-fbc0a6c4fc0f", "comment": "Malware payload", "value": "2a19c25305e2b810307e6b5170d14838e2ecf77ce2ef9ee69049d6ed0232e81b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460694, "uuid": "921243cd-e53f-47f3-8333-9fb3da41d270", "comment": "Malware payload", "value": "3ee3d7fb3d562a30ec09279c39321652dca68798", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460694, "uuid": "84ac7582-b0a8-44f2-b35f-925cbe928eca", "comment": "Malware payload", "value": "a3ceb07088e1407936d4e0cf23ffb75b0da860b5609ea2b80893c88abf5b626510b389990a9c8b1633e6899879494eaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460694, "uuid": "8f043a77-fec7-432f-8370-474b81a2070d", "value": "T11E524346B690DA3FC49AD33445DB422075B4A4B09B31473B3205A67A2D5338C6F7E7DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460694, "uuid": "85bc9676-dd69-48f1-be9e-7b6eb317ec1d", "value": "192:Rq9swUsk1iDsO3gvxGaH5oHyUVIgfkgypSi2M:9sXGR+38kM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648460694, "uuid": "973d1fe3-178f-445e-9b31-9322d266cfb6", "value": 13368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648460694, "uuid": "3d841578-8070-4c7e-bf64-bb921cf25544", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460694, "uuid": "c9ee0ece-2c6c-418d-be75-072270b9fe21", "value": "22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0967a00-ae7b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648460680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460680, "uuid": "da1185f5-2e64-440d-8331-9ec4cba478b1", "comment": "Malware payload", "value": "672ed4819678a497da39236e202b501c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Magnum crypter", "colour": "#5C56C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460680, "uuid": "fe870845-cbd9-4889-a52e-96918c851b1d", "comment": "Malware payload", "value": "2a3a5667694764c87d846c7cd35db64dcaa21360c8be6260068025c40f33e1be", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Magnum crypter", "colour": "#5C56C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460680, "uuid": "c13f97bf-f780-4aa3-ab74-f500ccb2c297", "comment": "Malware payload", "value": "a0704d22d8f0ea6b37aeadcefde58db404a5d704", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Magnum crypter", "colour": "#5C56C2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460680, "uuid": "47e5a95d-c02b-441d-a85e-7f36732ffa82", "comment": "Malware payload", "value": "1f3cf0a65de43aa05141b3e3869e32ce6ab2615cd7e83cfa5338c870bd7f90684f74fbc3e61cb18e395f8780f123fa9e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Magnum crypter", "colour": "#5C56C2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460680, "uuid": "c142d354-98c0-4b8c-8a5f-ddfb0f6d6d56", "value": "T1B91175AD7B048D9D04B7A547EB790040E7526E2727840B10B8DD4C52CF3945327B6FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460680, "uuid": "a4ee4e36-b831-47eb-8b48-0ed5fc48a540", "value": "24:6lJvbEzL44HJX3r3FWr3Ffjoz0E3Aej0FeIIgFEE4/WDMt0vbt0VTpXgXeKt0Y:KvQzXpFKFbozsejbIHEEu+QGOKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648460680, "uuid": "cd77e92b-a9dc-45ff-a602-d47c53fa55ae", "value": 1071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648460680, "uuid": "d597e50b-f2d4-4441-bcee-35b5858510bd", "value": "text/x-c++", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460680, "uuid": "cc961b96-e7a4-4715-a1dd-b5de1945cd17", "value": "Program.cs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a301f0-aed7-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1648500172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500172, "uuid": "84089457-7c40-4c58-a4f2-a66551a793b0", "comment": "Malware payload (njrat)", "value": "a90f19b1239e6f7102883c0367d3260f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500172, "uuid": "33411732-f517-46a8-940f-a4696e0681c7", "comment": "Malware payload (njrat)", "value": "2a98483b2c29cd11268760efc696729b1e318979c8c94fdbc0beaadd043e6365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500172, "uuid": "62ff7f9f-5c21-4409-84e2-b4412298e112", "comment": "Malware payload (njrat)", "value": "a6f0b13ab6b8c11e31c32c44d79f394a470bbd40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500172, "uuid": "50c5d7d1-6a12-4cdb-a021-fbdb0c53c4df", "comment": "Malware payload (njrat)", "value": "3631181855d9fca569ec183a68ff3cf4e87e44e0703d68a6fc42a3fd8dc0d16b347f077719efd4e78f3d6fd2e55b1847", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500172, "uuid": "179a696f-e3d9-47aa-bdf4-e2302e0401be", "value": "T120A423968F27B170CE093E7BDD3F55574EB6E28986EF04C2829AB431706324934CB695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500172, "uuid": "bafbbc27-cd1f-4c5f-a0af-a083ff225b9f", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500172, "uuid": "cc98a78d-fad9-4b29-a0b0-f58e43440e5a", "value": "12288:AWQhUVSCxrA/2HQNZlqBmhw/aNgf3Zjc4aE6m6jd90K9PLhlG:ihUV5A/AQNZlqBmhw/ikjc9E/ML9tlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648500172, "uuid": "59407975-edf1-41f6-b7a0-ff9a7618e454", "value": 471552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648500172, "uuid": "35d90b36-5d38-4450-97fd-91bb9c3a3ad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500172, "uuid": "c5ada711-36ed-47e8-af40-3cc8d1f804cc", "value": "A90F19B1239E6F7102883C0367D3260F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4113ca-ae93-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648471035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471035, "uuid": "87893ec5-5138-4b17-a026-a4ebe65ac4ef", "comment": "Malware payload (Heodo)", "value": "b184d6529e2ef5047d8fccf4d9fa68f7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471035, "uuid": "b231af56-5ff4-45d5-a6e4-2aa6a3ee03ba", "comment": "Malware payload (Heodo)", "value": "2b44725408afe929787105ae990cd10c0b8ab6b3d88bb45824b6f0d7689f209f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471035, "uuid": "c20add8b-feeb-4b4c-a296-97e24bc3b7b0", "comment": "Malware payload (Heodo)", "value": "a6262f7ae507e592b30f11372e251cb39481eb1f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471035, "uuid": "54f4f7de-c803-4248-bb73-a3f906e66590", "comment": "Malware payload (Heodo)", "value": "c46e82f6796b87b76ae080ce865b4d0de144e9afd505a415d0d7a436d93e0e7c99d3af64075b7603a5fa3ed2c0b323fc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471035, "uuid": "56f279df-f701-48c7-93d5-cf0cd1383706", "value": "T11A43E95BBA49985DEA14877548E743997323FC304F6B074B3269F3257FF89A05A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471035, "uuid": "097a0252-3e1a-4db4-8af6-f280b838d34a", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umvz:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648471035, "uuid": "bcc4c711-b8d8-4653-8123-d9288171600d", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648471035, "uuid": "438ef7bd-c9a2-4810-b67c-d79f0b5ed32b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471035, "uuid": "d0348a40-f394-49b4-9d54-0e4ad62fd644", "value": "Electronic form.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19c1ec7-aed8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648500652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500652, "uuid": "e221807a-d4d3-471d-b4d3-680cc159b9da", "comment": "Malware payload", "value": "f33f0f3e2121ef97f18c6bfa3392de7a", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500652, "uuid": "ab17dffe-ef2c-48b1-b4ad-5f50051bf7bd", "comment": "Malware payload", "value": "2bd036ad0f30544cd2827d671e9332ec3cd3aea06257bd15d507cbd03b7ddc6b", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500652, "uuid": "80c5f944-9d3d-4714-84a0-5702eadc7fdc", "comment": "Malware payload", "value": "7612ac1a87c5efee3d85a2eb167f457019f1dc02", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500652, "uuid": "97dcf269-33b8-4046-ba37-4a6fc30e75b7", "comment": "Malware payload", "value": "cf21d685fe86162454e6f8e143ef8e491a9f9629cab0d083c6b534f9ca25c0f8e8435768a4ec1eaf996dd07297f92b53", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500652, "uuid": "2cd60e33-1e15-4edb-8d32-e62f30c5822b", "value": "T1130120B170B940240BA2C32BF57BAC46A33090D429E1E7EC818E020EA2E0194FB607D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500652, "uuid": "229cf8cd-56d0-42c5-ad6b-1ffcc3eece5e", "value": "12:x3voQByxH5QwMO76esFskSX7KtnGywKhKldKCSRrF7DGHKEA4qkz6gtL:x3QUyt5QwMI6eKFk7KwLGMyh2bF6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648500652, "uuid": "69afbdc5-8908-4587-a9e0-f3bc3de8c1a8", "value": 749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648500652, "uuid": "c8c16e04-dab2-410e-abe3-58863c13338a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500652, "uuid": "22b8ddf5-9709-449e-9ff0-8369cfe3ca4a", "value": "dafixUve.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7626aae-ae67-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648452156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452156, "uuid": "425c89aa-a0e6-47e4-9d1a-010f4da0963d", "comment": "Malware payload (SnakeKeylogger)", "value": "51046497196ab830a7c1c1b8db094536", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452156, "uuid": "f90ffa27-545a-4fc0-99bc-c23a973f6aa7", "comment": "Malware payload (SnakeKeylogger)", "value": "2c3fb11bca6734496b45207b04de2c3258795ed86b27fe83ff540c51f91a6f16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452156, "uuid": "3e663a61-76be-4e56-90a3-27a974a3684e", "comment": "Malware payload (SnakeKeylogger)", "value": "2aaae9e073a1df11ef0cbd8a10f5bac6de2c34d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452156, "uuid": "9a58cb7a-e466-454d-b472-7047a390f909", "comment": "Malware payload (SnakeKeylogger)", "value": "205cf0a762dd1b15648858e0c29a0b357087327eea1853b235be0ad863e63b9eaf90208018ee9ebf618bc801ee820ecd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452156, "uuid": "bc8fc422-9b21-4073-93b9-50b9273a9f57", "value": "T1E37523707A9A9F36E5AACBB0C41417890F7173A2C160E7191BC877CC760D7194B89BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452156, "uuid": "26b94e3b-b5ac-4701-a372-d4a97bab1a37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452156, "uuid": "4fe63ebf-a082-44d8-8bd8-41c298264e73", "value": "24576:jYPDTdPN/rvWkSg9tNL0zmtCV5Pqz4GN80TsYKaBtlG78ezLcOObT:EvdhvWZOtNwzbWzEgKaBt44QL9Ob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452156, "uuid": "c447fcd6-a4e9-41ea-8411-12dca6b9d873", "value": 1569792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452156, "uuid": "5b77b35a-ae53-447a-abed-d3dd200a30e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452156, "uuid": "96e3a27a-72f9-49d1-bbcd-311bce066668", "value": "51046497196ab830a7c1c1b8db094536.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b37d582-ae73-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648457155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457155, "uuid": "e14a0c01-275a-4d34-8fd1-6136833e8bad", "comment": "Malware payload (RedLineStealer)", "value": "a2dba513466982f3ce41489c6bac6b9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457155, "uuid": "e2f98bcd-f568-4daf-b61e-d9dd7e0b7f70", "comment": "Malware payload (RedLineStealer)", "value": "2cfe5a7627ed577d81c0b00256c06a8cae2f6912d971bfc7b7e67e17d977e92a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457155, "uuid": "a941dd31-b553-4c6a-a90b-b539632470ef", "comment": "Malware payload (RedLineStealer)", "value": "fff5e6efb110c1bb7ca39f7c2fc5cbdfc2159e36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457155, "uuid": "3af4ef58-5dc0-42e3-a65e-db981da67c26", "comment": "Malware payload (RedLineStealer)", "value": "7340e6f06a5de9122b93d5d0769a17833db6d1c7febb26ada7297c007754974d022f4a3941aabfd3a73d30ee46f33d8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457155, "uuid": "814f28c0-f742-457c-824e-c8db8becb0dc", "value": "T13974CF00FB90D035F5B762F8497ED3A8B42E7AB06B2494CB62D41AEE16346E5ED30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457155, "uuid": "157e445f-a950-4e3e-bd71-0d0318306e30", "value": "112f301b72f7079fdf51b59676b2b142", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457155, "uuid": "1305d39a-4096-40ab-96f0-ab74f7996505", "value": "6144:3OR5jYA9X17ymoO6FVBNC9YbikTwhJZeJolGzCphVmHIrZWntt/GSKWIpkjuo:3kYA9F7yzfBNCosBLJphMHINWn23ppk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648457155, "uuid": "3963611b-85d6-4e4a-9058-59283f7d45ba", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648457155, "uuid": "9b6d8fd2-05a3-4e9a-af3b-47663f90f3e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457155, "uuid": "1c517cac-879a-4d0d-8fcf-8c0d7039bef3", "value": "a2dba513466982f3ce41489c6bac6b9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46bb14d3-aeb3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648484555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648484555, "uuid": "b02e09f4-3bff-4009-acb5-df4e95468a73", "comment": "Malware payload (AveMariaRAT)", "value": "a1af5ffab3507a683f676e584a4dc483", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648484555, "uuid": "99b5e7b9-694f-4ee2-9d64-d9e71741fab1", "comment": "Malware payload (AveMariaRAT)", "value": "2d0b2321eed0293d5c38e4462f0e86e2ca5401c126154469eee6be9beb5d2fd0", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648484555, "uuid": "a90e2c45-2cf7-445c-9a99-baf9b32dfb69", "comment": "Malware payload (AveMariaRAT)", "value": "608a0858c2c9964b3fbbd7ee334c31b40d394232", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648484555, "uuid": "34ec4829-0a4e-4ff0-9d13-c6aced0a6533", "comment": "Malware payload (AveMariaRAT)", "value": "089832770461e2c560d14af5da1024d2052cfc6555c0bcf5701114482b57478d9585a33f04700433e20e9b385961cffe", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648484555, "uuid": "dbaa158f-3f91-4fea-8271-67a767265f7c", "value": "T16035E01272A99A10C47543B6CCEA84CC07B17E85AD2BD64F3DC533CF1AB17C65A0AE5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648484555, "uuid": "a14d4b1b-a2c5-4aed-a3a0-8e75689d142d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648484555, "uuid": "99cd2494-b85f-41e2-ba31-9fa73ea5bdcc", "value": "24576:jcliJijo0o84z47RpJebE0T54LB/5mn8a87OC:Q1g3z4jJXTLBBLyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648484555, "uuid": "161b9917-70a6-4a05-bfba-e05a9a518c14", "value": 1107968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648484555, "uuid": "896e9174-45db-4f42-a0c4-d5b99a27dd4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648484555, "uuid": "654a388c-c467-4d99-96f0-7c298edf657e", "value": "DHLDOCUMENT.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea44867-aebe-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648489212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489212, "uuid": "e42a5521-b6e2-473a-8a25-4516d5cca0f8", "comment": "Malware payload (AgentTesla)", "value": "44db353c1996ef03020441a5e3106186", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489212, "uuid": "de93e1f8-6ff9-4cc3-a61e-c733814fceb1", "comment": "Malware payload (AgentTesla)", "value": "2d23632984a441d425d7005ac5501e1e67392627dba55377e9d5337c0501146a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489212, "uuid": "59ae5651-9f44-4801-b9b7-c9f7e59f05ec", "comment": "Malware payload (AgentTesla)", "value": "b1be5b1714028e6d79da51e0fe296fb3630e3833", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489212, "uuid": "628d6aec-6eae-4b92-93b0-40e8da4808a4", "comment": "Malware payload (AgentTesla)", "value": "ddfb102038f97557136985ca9eaf426b99d4f7a281547a63322a6cd4f1814e3abd24ec86762762fac6e6d8eace1abffb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489212, "uuid": "f3c8f541-68fe-44c8-9030-f2745a0cc7a0", "value": "T1B1A46F7C7E714B72FD1E91306D520AF4BB674B032284AA8717DB15CA8B8F0F56E469C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489212, "uuid": "8d5c8e80-5e2a-4c60-868f-a5549e5e1fc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489212, "uuid": "71829e99-8d4a-47de-bd7c-9531fb3a2845", "value": "6144:LStvIUYJtFxOY4/YO6MwxunCFwstGro99VKRjbNWMQEZYHPbA201u1LjtxUhbUL:L4ZYnnOY79lx8wwstoeVKRj8EZYH6MZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648489212, "uuid": "bd1bb400-ba2e-4a70-a643-fd0d27cd2fea", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648489212, "uuid": "8eeaf7bd-5457-4204-8a2e-145350905ea0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489212, "uuid": "261270c1-d563-41ce-bb87-0301d954ebd6", "value": "MV TBN VSL DESCRIPTION.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d762e7-aebe-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648489168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489168, "uuid": "68615643-6d3c-43aa-bfcd-974f4a0652a4", "comment": "Malware payload", "value": "7697b380a36f5eceabac543dbd6fafd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489168, "uuid": "2804badb-3638-4a55-92fc-41c899f80d1d", "comment": "Malware payload", "value": "2d4158772871be3f7e522bf37dfc01789234fceea5e08f3b779261cecd08c880", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489168, "uuid": "b0b63922-3e81-4839-9ba8-ae41d61c86d3", "comment": "Malware payload", "value": "6de0cda9c242e18abe2c496a3c75a552e9d7c6b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489168, "uuid": "8a63ec7b-7bdf-4665-b5a9-15bca8d3ba46", "comment": "Malware payload", "value": "6cf5c1d70d6f51594ee06434414977b6490d2e8109ff2007c2ddaa8e6f07e2366306b4180f38842add2b70e3d788ac6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489168, "uuid": "d19aeace-93c9-4f6e-8234-b05cb3041b83", "value": "T11925D71CFBC17A72FD9D823085550A38AB260F83B6409BB6179A3DC87B5F1FB5D04896", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489168, "uuid": "b9ec72f9-4bc6-4875-9522-dc77ef433b62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489168, "uuid": "0db71a46-a2e7-492c-88bb-47286f63dce8", "value": "12288:KLzuquKACO9npd4C1x/HFsEoPw2bX2OdLfh/4giiMQ5pbHyIByy:K5ybTlsDNLp/4giihpbSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648489168, "uuid": "288b9704-90c1-44d6-8057-bf0bf7849562", "value": 967680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648489168, "uuid": "1d61e825-01de-4a52-8df9-a4e8b176bf76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489168, "uuid": "228b6349-0dfa-43e0-9406-5b83f08bd6d5", "value": "NS Handy 28k - Vessel Details.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345261d5-aea5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648478511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648478511, "uuid": "c64c2515-d697-4411-9b5d-c8d478a6a2cc", "comment": "Malware payload (Formbook)", "value": "4ad7643dcac92ed33b069c9817251229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648478511, "uuid": "a60d702c-37aa-402c-93d9-d2478af1294d", "comment": "Malware payload (Formbook)", "value": "2d920ad3ec75b1ab2bf2424e446c18b5e6cdebc6f1ebadab88a5ad0e6cf32dbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648478511, "uuid": "5b8f6c7c-a401-4e59-8bf3-2718fdaa2c42", "comment": "Malware payload (Formbook)", "value": "462c94cf23ed6cee16614076b5bdc7aa6f3c5859", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648478511, "uuid": "301a0355-c5e0-4d0e-a6bb-bc14efb3683e", "comment": "Malware payload (Formbook)", "value": "8b74438dc0feaf627872c2fa80411177bb4fc00fe4e15da212ff2fbf0b722863e06f264e62cc6a27adef902e18929ad4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648478511, "uuid": "82490514-cba9-428c-9dca-6fb890a7c6dd", "value": "T10294BF81328448B1C87AD7339332F1578D2EAFE46BF1D51E12C53B9E377668986CB246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648478511, "uuid": "1f515522-462d-4812-aa29-044f50d2a1df", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648478511, "uuid": "972b117b-3e9a-427d-a73f-2715ebc6f954", "value": "6144:0GihQx8ayrbordmmM2ha9UEjT0b3KsZ9O/XxkL7Ito6etrB1JX66NP:DxPgUrIAhlEjLcO/X6Khe7BNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648478511, "uuid": "f3d91394-3f5c-4fa4-b09b-c20e28ee9ae9", "value": 436138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648478511, "uuid": "e90904d0-4cd2-406d-93ca-c045a732cc62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648478511, "uuid": "845bd988-dbc3-4ef5-ba4f-865f34fc74ef", "value": "PO-JST-270322.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f310638f-ae9e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648475824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648475824, "uuid": "3ec7e6c0-d52c-468d-b513-84f39800aea1", "comment": "Malware payload (Heodo)", "value": "971c98e40eacb94cbf226ab491352932", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648475824, "uuid": "65f5b935-09aa-42ea-b2e8-b831c4499966", "comment": "Malware payload (Heodo)", "value": "2de0bfe72592b29ace8ec3856632729dd780a0312a7353ee63b3940dec558711", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648475824, "uuid": "9aad9c17-3c38-4792-b218-3755b1aac606", "comment": "Malware payload (Heodo)", "value": "df7aa05098470a7f6726e946a6e425c2e5ee89fb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648475824, "uuid": "39551b54-b07a-4fa5-9f3a-818a9976d7c2", "comment": "Malware payload (Heodo)", "value": "891d5a81347166eee779ec5967d417e0ba2c99731fd7dd7467c077d1b56d94cf9436f05613ab5073b417fda60d0aa637", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648475824, "uuid": "df0b0228-4c83-4caa-b03b-64ef58efb411", "value": "T1B864AF40F2DA80B6D6B72B34257247366A7AF9027F38C28FB3548989DE31740DE3575A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648475824, "uuid": "d31217fa-561a-43ed-a471-bcd8261bfd53", "value": "c0eaca862e71892f0b09074d92f8955f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648475824, "uuid": "057f56a2-25e8-4fcf-bf3e-afb19fda426c", "value": "6144:3QfYaJlKdMDan9+2VhqOWOLt5ZZnB9iHC4Cqg:3Qw+CM2n9+6qsRlSLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648475824, "uuid": "9a89f83b-f258-420e-842e-07c73ecf1e79", "value": 306812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648475824, "uuid": "10d5a527-a013-4a36-92dd-936ed6247717", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648475824, "uuid": "e728f4da-b5ba-4a68-8d5e-971251408e19", "value": "emotet_exe_e4_2de0bfe72592b29ace8ec3856632729dd780a0312a7353ee63b3940dec558711_2022-03-28__135700.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0fa64af-aeac-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648481780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648481780, "uuid": "779bddad-5047-465f-afd7-b9ad183deb0a", "comment": "Malware payload (AgentTesla)", "value": "b55d7521839a60b744d32d7068edd7c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648481780, "uuid": "24ec8d94-3efe-4f09-8b9d-ac557c1b1469", "comment": "Malware payload (AgentTesla)", "value": "2df87bbf68e6ed077b39f398de69b81d97bbaeb8dfa80e6e305a422fe41881ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648481780, "uuid": "c7bbe1c3-5cf1-40a0-9b9d-94a78120d816", "comment": "Malware payload (AgentTesla)", "value": "fa280d23674a907663e8f0fd1b2a3a5f97cfdd03", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648481780, "uuid": "50872ad1-bffa-4faf-b36d-5cb67544f977", "comment": "Malware payload (AgentTesla)", "value": "42f71940f4d4198a057505a15a541ad6e965f853cbbfe98e796ddfaa9388a302f6a7ddab5bd76a9c44ad5d39ff581f56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648481780, "uuid": "cf47b0b0-c6c9-4369-aacb-7c3cf8d79113", "value": "T161657B98325071EEC467C936CDA81CECEA607C665F1BC107A053329D9A7DA97CF246B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648481780, "uuid": "1579f7bf-c7ce-4d26-8df7-a0dbceb338ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648481780, "uuid": "705aafe2-a158-46b6-a6ef-47f1bc72d632", "value": "24576:8pP0j1Qoq2vrkhpMYCj3vzLcnxF7JZKtAqUJzyaKh/q4v3XeyFYQ:00pQlgUpL63vz4nbKeqUN0q4/Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648481780, "uuid": "4dae9b33-e784-4a9d-aa7d-3a38889800b9", "value": 1421312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648481780, "uuid": "c66f97cd-c84e-46a5-8a8a-5fc8efa1c241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648481780, "uuid": "15c7c9ea-fedb-4fc1-8303-f14885c497f3", "value": "AWB5032675620_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331a861a-ae97-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648472496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648472496, "uuid": "e5010355-ee86-43ef-ab18-78577612a773", "comment": "Malware payload (RedLineStealer)", "value": "b19572badb34af219a9c66723e1dd19a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648472496, "uuid": "297a0ac8-d31a-4140-b22f-9745688434af", "comment": "Malware payload (RedLineStealer)", "value": "2e5b9ebfb2b81c5e512248e2e9224d1054defc4b027c0108fc10d268312ce290", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648472496, "uuid": "ff7c82a6-57c7-4fd0-a0c7-40693b148a53", "comment": "Malware payload (RedLineStealer)", "value": "b88a7596a0e6701c6f0a9612767fe550721be923", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648472496, "uuid": "1715c9a3-007e-41d7-a99b-32910d231700", "comment": "Malware payload (RedLineStealer)", "value": "84f16e25f328f8d4215a04ececa557c3e1d88ee0966b0c42d061f0a0412366d7ea1caa82d0bc9728df50655f42b931ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648472496, "uuid": "1ff47495-32a6-4d05-82b6-8771db2a99b1", "value": "T1780633CB9069BC78FBF0243DE2FBDAE551E873412E0975EE2551880C0BB84E8756945F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648472496, "uuid": "cdbeff42-2020-4d9b-afe1-a4990d1a156e", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648472496, "uuid": "bc7fd057-74f6-4bce-b899-ea4b31a0d277", "value": "49152:9Gzo9MTkMJCjqzr7inQArhjqhZRjfp7toPThhszE8Xs:wkDQYQArh2hZR9BoHso4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648472496, "uuid": "2340e672-6977-4cc4-8a76-d77daae0574f", "value": 3719680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648472496, "uuid": "6e282ef2-3a38-47ec-ada9-591439a000e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648472496, "uuid": "d9ad63d2-87dc-44b8-a57c-d8c4153a38d8", "value": "b19572badb34af219a9c66723e1dd19a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d9d19c-aebd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648489012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489012, "uuid": "8b9ae37a-e6ab-4277-b756-95ada793333d", "comment": "Malware payload (Heodo)", "value": "2612974157a9f14de26d49f00fbefe41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489012, "uuid": "cd244222-781e-4362-9c33-6fcfe09238fe", "comment": "Malware payload (Heodo)", "value": "2eaf79883fcd5b50dff216dce52d642bb307aab78afd62f59ac8b548d51c4935", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489012, "uuid": "3313f920-7ce2-4bbc-a607-1bec36d42854", "comment": "Malware payload (Heodo)", "value": "f07ca6ca5bdf3649b9438f0ce985d62779715153", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489012, "uuid": "ba6cb6b1-8666-484d-8059-b0c26980829f", "comment": "Malware payload (Heodo)", "value": "eb369a08d23bf4a26f84b4bb1675429efffc15914ca53bc9462beb5e25f07422a661824502904ef7c6b564b9fdd37163", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489012, "uuid": "a78a3b00-d5b3-4a4c-bcb0-5897420114a9", "value": "T15AE48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514DB432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489012, "uuid": "0c92923c-a9de-4cfe-869d-5e7d698dc5eb", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489012, "uuid": "cf50a3fe-ac78-466e-9803-0a790d9ee03a", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7ivK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zoCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648489012, "uuid": "4098390b-772e-44f8-a2c0-dcd4a9ce612e", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648489012, "uuid": "c2641018-8dd6-40ce-a2f4-14a26967e068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489012, "uuid": "a28b8220-dfbe-4dc4-bbb0-707eef19abc1", "value": "2612974157a9f14de26d49f00fbefe41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae5c695a-ae81-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648463254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463254, "uuid": "e01164ee-c3b0-4cd8-acd9-5d2d25875c9e", "comment": "Malware payload (Heodo)", "value": "fd1891f55229af75658a216713cb8b38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463254, "uuid": "e3ee3462-8c40-4104-ac5b-f415911b2305", "comment": "Malware payload (Heodo)", "value": "2f0cdfd1f2c127b92992eb192541788afb750aa2046f1696b9f281c72a4f1487", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463254, "uuid": "8fb1882a-9751-44b3-a3ae-6cd8af280ced", "comment": "Malware payload (Heodo)", "value": "a646d4f135786ded2d288fbb6059327a67502467", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463254, "uuid": "991d3ca7-1a4c-486f-bc38-6985976c1d75", "comment": "Malware payload (Heodo)", "value": "74681eb70ce3ab7587aa4a89bb40c83f3d09f44e9d397f30b72ce3ec9ac16ab01497a877c41a17e9fc576ad1f366e212", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463254, "uuid": "8675f4d9-c55d-42ee-aa24-d44388ffc985", "value": "T1D694CF0272D0C47AC6EF23785D239B5AA7F9FC208A75C647A751BF8D5E326C1893434A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463254, "uuid": "ecd9370c-c01c-4ab5-a33c-6b8fe95dbea9", "value": "8f8b1cb86c6697dd342b65a36c6ccbb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463254, "uuid": "c8e8a29f-f9c7-457c-965e-031843e30ecc", "value": "12288:zwn2hR3547jpDMgySxxpuCMS5AhugWarPU:DRJ47xjyKpuCMSqumrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648463254, "uuid": "1f807f28-8e9e-4120-a341-70d8432dd5ec", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648463254, "uuid": "23430d85-6d17-498a-bf26-b235ef6945b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463254, "uuid": "36d6cd34-6e3a-4173-a28f-7739345338e3", "value": "fd1891f55229af75658a216713cb8b38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc2fdb8-ae56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Surtr)", "timestamp": 1648444595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444595, "uuid": "e8a41853-bb52-4551-aeb1-eea7c4bf759e", "comment": "Malware payload (Surtr)", "value": "c966ff8e3fac016eeaecd307bd5654c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "surtr", "colour": "#AAE414", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444595, "uuid": "d5cd777a-4fe0-4c2a-a63d-dde328537c9d", "comment": "Malware payload (Surtr)", "value": "2f98712ad120c5528a76f58b75fc1e2955486a52a5ce35c780e6ceb8f24d721f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "surtr", "colour": "#AAE414", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444595, "uuid": "aaafdcfb-8886-4c78-8cee-421f355f8c94", "comment": "Malware payload (Surtr)", "value": "9c7c736b842e99389017635386fc9bea0dc2175f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "surtr", "colour": "#AAE414", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444595, "uuid": "05935a5e-151c-4c4c-a288-1da0c2b1bb9b", "comment": "Malware payload (Surtr)", "value": "ef4e164a2a496d5b3bb42630e5aa03d359b8a1a280d527c9a060520bc90215ef4b28a793178f13b22bb40e9bec050f7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "surtr", "colour": "#AAE414", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444595, "uuid": "a5efb55d-29f9-4243-9c54-dcd0fa29324d", "value": "T17014237496CD1D43C96C60BBEFC78C1624778A1EF74C14E2BBC8982BFB4126158A9B74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444595, "uuid": "a07ad965-097d-4002-8783-e38ebedb2f9a", "value": "680169a9b9ea22a62a2554cfbb27580c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444595, "uuid": "5c476161-863c-4078-a5b8-570acc0103a2", "value": "6144:E6Ti4GZqEblsPaX5P3j6MdpyR/zC67oS:tTzeoPaprjp2/zN7oS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648444595, "uuid": "de13e24e-2c36-4b41-b12b-9bf93750a40e", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648444595, "uuid": "89384a53-150b-4011-9662-6fb2095fdab3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444595, "uuid": "fa79d5b1-1480-46c0-b819-288f90876099", "value": "2f98712ad120c5528a76f58b75fc1e2955486a52a5ce35c780e6ceb8f24d721f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefdd83e-ae93-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648471039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471039, "uuid": "d26231b2-e4ce-4ce0-9abd-9558499c23d9", "comment": "Malware payload (SilentBuilder)", "value": "de9cf6fdb34a1d17cf82efc4794e23fb", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471039, "uuid": "984ece33-3e09-4bc3-9253-50cfa99fb136", "comment": "Malware payload (SilentBuilder)", "value": "2fa0009aaa9c1433894367d68a85ad492d9b16d83935fe545a7713a206012f6a", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471039, "uuid": "58b66aee-eddd-4016-8237-584b04739c51", "comment": "Malware payload (SilentBuilder)", "value": "ac342290120d6d495d5a5489aea0baa82e506e48", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471039, "uuid": "28af826b-e5d0-4b9b-a7e4-73eb661ecec1", "comment": "Malware payload (SilentBuilder)", "value": "5ba078085d2a0491fe2dcf9e1e3b9a324d69a955be7ed783f148c72d3b36e54de538eb3008c3de6d2519b5ba8d678506", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471039, "uuid": "a54ef3d2-b6e5-4ea7-abee-7c085b7e9196", "value": "T10443E95BBA49985DEA14877548E743997323FC304F6B074B3269F3257FF89A05A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471039, "uuid": "021bea51-a952-45c5-8eb6-7c722265309a", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umvj:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648471039, "uuid": "4ecdb69e-f5e7-42a8-9b2c-e6d5bab18a0f", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648471039, "uuid": "0a3a290d-a762-4f7c-8b15-3803fb5cdf4e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471039, "uuid": "401e3edb-ebac-450b-ac8f-4a1f48d09b81", "value": "form.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1fe1898-aebd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648489003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489003, "uuid": "106a181c-3158-4b5e-a305-02762db4f539", "comment": "Malware payload (Mirai)", "value": "d900f81da22c968b6f81657eedc90495", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489003, "uuid": "d73d25fd-af5b-4716-a428-5c1ab96691c0", "comment": "Malware payload (Mirai)", "value": "2fa02acee5ba19806851358e4c754b1de1a37a2e0ac71e9b7b6222e77bbb0aa4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489003, "uuid": "ceb59cc5-ccf3-4aae-8b0b-46cf5eaed2dd", "comment": "Malware payload (Mirai)", "value": "96788150177a2c449033c87feb75d4fa801d5622", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489003, "uuid": "d8923870-dcd2-4a9e-b5cd-f9a1d1d53315", "comment": "Malware payload (Mirai)", "value": "afccde98454ebbfc9c2ae2cd27a27966159c6fade832cca6411585fdbe5d435f6a3e7fb6cd2b75b39ae69f1bad298bf1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489003, "uuid": "4187519b-c003-44b3-8caf-717b8e010eb2", "value": "T18ED2E1709665D0B0EAE00E347059008B61881668D1F7B1A2E3298F5AE6FB6C77F7F817", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489003, "uuid": "386e51d1-0d16-4be5-b472-189c912b14a5", "value": "768:OcnzgGyxd4RRZ5yTetFM2jTgFUcv446q3UIsu:bG0biyFMcgFm4tz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648489003, "uuid": "0bb7a6e2-f33a-497d-9cac-6ace3eed9ddb", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648489003, "uuid": "e9752650-0ce2-4170-9f2c-bc3166cc1aa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489003, "uuid": "13c8b39b-392f-4bc4-bc57-ab619bd06825", "value": "d900f81da22c968b6f81657eedc90495", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f01a64-aed2-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648497785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648497785, "uuid": "c8e33964-e89c-4c41-a702-c19ac59eb7ac", "comment": "Malware payload (SnakeKeylogger)", "value": "698f3b32c063af628fe3aed3e57cc6b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648497785, "uuid": "493b8e6f-84f8-4fca-aec7-5357253713b6", "comment": "Malware payload (SnakeKeylogger)", "value": "2fba7d5558a1486afdc8cb5592514f8eb689ea2b99f07b9c844794f01c758045", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648497785, "uuid": "e3ea068c-6bc5-4653-8116-06e893fc2d3b", "comment": "Malware payload (SnakeKeylogger)", "value": "f7d367c6f1272cd458f128e0effeb60c8ee2e7df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648497785, "uuid": "2272c514-3c61-44b5-88b6-7ac48e343831", "comment": "Malware payload (SnakeKeylogger)", "value": "0d0f88688fa13af3788334676d2872a0035b6d8084cacd89c44fcd43505bb7310a61dda3b595a39374552969c57d0cec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648497785, "uuid": "02e190b2-7c75-42ba-9476-43f813fee5bd", "value": "T1F5556B98325071DEC467C976CDA82CECEA207C665F1BC207A053329D9A7DA97CF146B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648497785, "uuid": "9372b4ec-5b07-4454-a0d4-6005db5621bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648497785, "uuid": "c8026c87-bdfd-4614-a7a7-e9db79f105c7", "value": "24576:P0JNRwzpUhe7fmmnJ+vj1yKP+Sg/J12BAFgkVGBcNf5:eKUSJ+oKP+Sgn2BAFgkYBcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648497785, "uuid": "a89cad95-2dbd-46a6-a557-b91809e06fb1", "value": 1345536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648497785, "uuid": "1b17c1d2-9cd6-4c4f-b8a6-faacfc46a570", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648497785, "uuid": "a9d24a56-92f3-4e0c-a846-bf7675324002", "value": "Remittance Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b607a89-aebd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648488777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488777, "uuid": "31d0e31e-5a4a-4880-8737-8bb62dd5562f", "comment": "Malware payload", "value": "a7162131dc32fb8889d92f7cebb3b9f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488777, "uuid": "2ab9ff95-dc3e-4a82-8f8a-7cfd30ff0d3f", "comment": "Malware payload", "value": "306184f80f35fe16aa55a93c9e11fb2d9af6fe2d850e0919e1adba3184516ab9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488777, "uuid": "c4c8f0dd-7ef6-4c90-be17-25497dbe80ad", "comment": "Malware payload", "value": "d57af1af280db028fbb0192d6d7bbcc9586c3103", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488777, "uuid": "f786f0d5-a5b5-4128-af60-e1bdbdd66cda", "comment": "Malware payload", "value": "0a83e6b8d0ad07bdd2a8f114edc09c11a8ed25a97a592714e535705b95d6b37f08072cae561b92d9370243c858c09fd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488777, "uuid": "9e84abe1-ffc1-4b86-9c2b-e489fbb86c7b", "value": "T1F48419C61F2A9696DD475AF8F7207C5346723C8D0ED4BDC1B4C07A3A2E3AAB061B9531", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488777, "uuid": "7dca5f16-6eef-4dff-90e2-388510d315dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488777, "uuid": "4da6dce7-54a9-419d-a08a-a00a103602e8", "value": "1536:nNelAbnmZzP/6qincpw8Cl6055rpKhEEIxEWv2Qs+1yrOKcuVdhmXK79eV5XO:5bnMzP/6D+CQOKcWyKw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648488777, "uuid": "6c618c79-e5ec-4c74-9365-18806cd3bf36", "value": 397520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648488777, "uuid": "5bf769da-8ec8-47be-97a8-faab02fe85d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488777, "uuid": "8d92c449-f025-40fe-baaf-580875b5e598", "value": "MV TAN BINH 99_Ship particulars.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2ce8f3-aebc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648488406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488406, "uuid": "3490c79f-8ec3-4e3c-b824-62d4d9be4fb0", "comment": "Malware payload (AgentTesla)", "value": "a8fee8a2cf334614bb72e912facb1c5b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488406, "uuid": "92503dfe-ec86-4053-b6ab-dd0ef3f9b61d", "comment": "Malware payload (AgentTesla)", "value": "306bbb7621ea9775793c25a9f1878d34c8a98a02430d452a0907f5ccfeefdd96", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488406, "uuid": "5d67f91d-120d-4308-954c-d4fde02c0df3", "comment": "Malware payload (AgentTesla)", "value": "9d7e473fe7cce2bdfe5f991c19fabaa333f29fc8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488406, "uuid": "e5e32332-8f37-4739-9a38-eb350a7abb1d", "comment": "Malware payload (AgentTesla)", "value": "9511aada8bb58ac8a78115b7d22fe69d3954f92048de7584957738c2f0fa13dd409c05b0c0a9f5bcf7858e5d416ae0cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488406, "uuid": "3ded9cc0-6355-4ef5-97f5-f03548281937", "value": "T14AB4BF33D3F82F5BD07E5339542054153BE6E786A628CA45FEBA30A68572BC245B2F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488406, "uuid": "cf34d5b1-6a98-4dc0-8120-b59098d7db49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488406, "uuid": "a4f41538-241c-4c42-b1bf-7eee63367c48", "value": "12288:zvHm2QhIdi/gjjktf252XtFwFW0AWhfQ8iyhy53:jHm2Qhqi/gjjf2LwFWtWhfZiyU53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648488406, "uuid": "62286cbd-4ae5-44ce-bc05-fb1ed9232dd0", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648488406, "uuid": "bef0a175-5646-4aac-b384-c967c8a1bb72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488406, "uuid": "7ebf81e9-2fda-4c2b-accc-d66326c5d2a8", "value": "UPDATED SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad200d1-ae6e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648454899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454899, "uuid": "5ceaf7d2-012f-4294-94a5-ba442a86f92b", "comment": "Malware payload", "value": "e3bc22a4406fea519a4d7128b69f0585", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454899, "uuid": "a2b31fd7-dc9c-42c7-9561-d42d5f28c05f", "comment": "Malware payload", "value": "307efac9beb7bf9e2e6f6cee019143c12b536969aa25a4cb3f46a0a14dbb3240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454899, "uuid": "e4be64ee-c6ae-4db5-81a0-c6fab864d92c", "comment": "Malware payload", "value": "5577d7d65d5226f6f74bbdccdc83d9b084838fbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454899, "uuid": "c0295018-c17a-4efe-a212-c29bd5bdf795", "comment": "Malware payload", "value": "b03247749a6c00910d49231cf130b5c05a067a80ed2629c9bcc0397fdea23b406db872f58a7f7eb21aac137793546915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454899, "uuid": "7a178901-c774-4feb-bc11-6d91607a5ff6", "value": "T18056E041FB51CE07D3C91B7A41A3921C4774D62ABB03B35B0F7DA5BA7C2627A49023DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454899, "uuid": "39b32ba2-24a4-4fb2-b0d7-5b93b13dc5f7", "value": "98304:d2I4sPFaYVogjv2SMEjXuCdQXQjKy2/6vRnrXRmEYRbsCKe:dx4sdaUrZM8mXQjp2GlRH2bs8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648454899, "uuid": "a8eaaf9a-40c4-44a3-b1a3-5479016809bf", "value": 6247930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648454899, "uuid": "d539731b-633c-4052-99f4-2f68dedfdfd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454899, "uuid": "38d9f925-f906-44cf-9ee1-893e209ce8e9", "value": "e3bc22a4406fea519a4d7128b69f0585.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad2c373-ae93-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648471059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471059, "uuid": "9de50edb-8467-47b8-9478-1d8f9f8bb7ec", "comment": "Malware payload (SilentBuilder)", "value": "ebe1ddae073746f2ebd2c4c97120fec5", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471059, "uuid": "b9744c0e-10e0-40ac-a654-4284ea4ada1e", "comment": "Malware payload (SilentBuilder)", "value": "30a9bcf93a957f24769c8b08f7312f429ab4936f83c26b9a3082057ff001157d", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471059, "uuid": "e5f0524b-4c07-4f38-992c-ab66c97cbf54", "comment": "Malware payload (SilentBuilder)", "value": "b7a130da20eb9aafae21b0d743d34ee947faa95e", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471059, "uuid": "fd51f3f3-f14b-474b-9dc8-8d9e059d2f5a", "comment": "Malware payload (SilentBuilder)", "value": "b497a9fbb6554c542252bd2d20a109c52746d644083d703d9d30f3fe7fdd77a253d2ddc13704d7c85eb31d79f0b1a7e6", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471059, "uuid": "228f3d94-a497-439b-b921-e5266d5d8250", "value": "T12743E95BBA49985DEA14877548E743997323FC304F6B074B3269F3257FF89A05A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471059, "uuid": "469d2b50-43d5-4803-bbd4-08addcf4823d", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umvj:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648471059, "uuid": "832c1f21-f291-452f-9f3f-36117bd0bc38", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648471059, "uuid": "d77e0e5b-9dbb-4b21-a406-9ed3a8f3c95c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471059, "uuid": "719a0fae-0302-470c-9bd5-9bde1e790f50", "value": "PO 28-03-2022_1252.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7bc0d5-ae79-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648459576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648459576, "uuid": "e2a599a7-40ad-4dc6-b894-94ec4a02ff90", "comment": "Malware payload (AgentTesla)", "value": "f54292a40d98264b1eff0c8025e49e3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648459576, "uuid": "578307a9-d998-40c6-89ac-e80610938e47", "comment": "Malware payload (AgentTesla)", "value": "30cd7f01c1cb441af3d2ef097f030b4c87e0b96d4be226d0cb470bba1c9b887b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648459576, "uuid": "1cdb7dd5-a2c8-46f5-99b2-61076940e434", "comment": "Malware payload (AgentTesla)", "value": "f8a40d15a1016f9339ad91bb80a75582afd40992", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648459576, "uuid": "146dae1a-c738-4b66-8fdf-e0a99c51f830", "comment": "Malware payload (AgentTesla)", "value": "5466d2dec7f83c07f405ac712752e2514044443a3a73ee7de49ae8968f125f1e2f5144db7adc0678a6132009f0137d03", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648459576, "uuid": "6f9603e0-fa32-4e1f-b750-48d67612a5d8", "value": "T12BF47D63E2E50674C6B594AFCFB55D9484B802033982B8FC47CBD8D26C952B597F0F8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648459576, "uuid": "c94cb86a-da84-41dd-bc69-16a18f6132ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648459576, "uuid": "26a758ce-3293-4a6f-abde-b23840caf0ce", "value": "12288:elcrTHsGfAaGcsTYM1jGQRRFC9VYJSSFT7JgMw10EII8u+omrzjgI+7xCPZ:el9GFGcG1RRFyRw7DEM8I+7xCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648459576, "uuid": "ac210805-d713-4e0d-98cc-73b4a01ab6b2", "value": 744448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648459576, "uuid": "e43a279c-1489-4ada-9dc8-54dd935e32e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648459576, "uuid": "e13ab734-1a0d-499c-94da-05422848c675", "value": "PAYMENT COPY.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d892ba-ae69-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648452713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452713, "uuid": "4258baf3-2ad8-4fca-9ba8-77c3a40761ef", "comment": "Malware payload (Loki)", "value": "1b1ab3bf7568467ab74ba55523ed5783", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452713, "uuid": "f00a2eae-bfe2-4fb5-9552-e91fa633468b", "comment": "Malware payload (Loki)", "value": "317360c46f9c886eb94ef304e7ee3c7b7e17a1f7e12681eceea5fcfcabea5300", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452713, "uuid": "3746d4fd-8259-4abf-8dde-002f82609d6a", "comment": "Malware payload (Loki)", "value": "2629027abfbec51670cdb5664635366a9fade791", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452713, "uuid": "b5f660e7-235d-471c-9992-880469af8198", "comment": "Malware payload (Loki)", "value": "2b98407cee3a4a182dd7c19d3864f2a11c520ba0b365d3316d8c39d23cb7839256d851d360ce99456975acf6cd66449c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452713, "uuid": "458b250c-5308-47ab-9a63-e4cd294eae56", "value": "T139141220A7569901E763DCB6F8760D1AD2A3CC1590E697537481FBC388B1EE4AEF352C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452713, "uuid": "b94ab9d6-881e-4ffa-b686-3a220498da34", "value": "3072:7XeQ5joz+fnNnF8aGjF4LV6Jt2RhaLWiPCU/VRv9/G/SSbJrlO4dhq+:6Q5jozAdGjF4LcJtpLWiPCm1/2dMk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452713, "uuid": "c0c09927-6945-4cc1-aff7-fe0b51b59ff5", "value": 191832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452713, "uuid": "4cf4e52b-8fa2-4bd5-85a0-9a90052d28a8", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452713, "uuid": "18f437eb-c306-4af4-8286-066c9c3070f0", "value": "Payment Info.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "238c53a9-ae99-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648473329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473329, "uuid": "7186d189-fab8-4f66-9c07-19dd4c1dfe7f", "comment": "Malware payload (Formbook)", "value": "cac5faddd256a2def7028798da3f49e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473329, "uuid": "586c04b5-8ea3-4fbd-bbf7-c0a637f21f20", "comment": "Malware payload (Formbook)", "value": "3183ded89e1a175de5bb2db96bab4827a3b51d16ca43cbc54b10448cd39c2cf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473329, "uuid": "282207a8-317e-468a-a1b5-59dc9c600384", "comment": "Malware payload (Formbook)", "value": "62055e2514e233c7bc85caab2090997f242b9883", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473329, "uuid": "94653e84-d415-4681-b2f1-d573544e8db4", "comment": "Malware payload (Formbook)", "value": "c7a90072ee2405ccea8d2d56e2cc7d12a8a97e9a85a11369533646dfe80d7f8d175a2d47d94d9b6a1713161a4f10d53d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473329, "uuid": "88038557-5334-4646-859b-7ca0ac35cd9c", "value": "T14BF48E325C0A8D67FA558CB232B3E2F57E3501C02B81E968E4449EEE757C53274EEB16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473329, "uuid": "b3b66a37-cabd-44f0-b2f4-fade8595bee9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473329, "uuid": "e357750b-35f2-46d0-a663-c32375a2b4ee", "value": "12288:4tR8DgghGjMjuOPZLO4NMPkwcUMRSD0xAzZG:3gfjBRbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648473329, "uuid": "c0eeecca-723d-4f1f-b9f2-2ff86f0cad1f", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648473329, "uuid": "b76afdec-321a-4ad3-b902-0b144cfa93eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473329, "uuid": "e0c5cd06-a31c-4805-8058-4c0724108efe", "value": "damianozx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb74fb2-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447953, "uuid": "594df0f0-692a-42dc-9c0c-1e7ee5b9d569", "comment": "Malware payload (Stop)", "value": "2ed7fd0e795d6db1c68163bfe58be492", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447953, "uuid": "4001b5e0-2751-42d6-8276-7047547b9e21", "comment": "Malware payload (Stop)", "value": "31b6af9b32727f5c93fa714da47cae02d7fe019bb99ef04c9bb48a316f3096d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447953, "uuid": "c21a6a2e-8846-4e23-827b-a310af870e81", "comment": "Malware payload (Stop)", "value": "d79a996cc8a1d9ae86fddaf8ca8b5f46b567b047", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447953, "uuid": "9164c11b-a73f-4324-aff5-bd814a8e06dc", "comment": "Malware payload (Stop)", "value": "86d2dee5d89d5d92f65d350a082380519f3f53a59d912d5eef314b0b30e05f83b966314162d06e1c6bc503f5bce4daf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447953, "uuid": "372e1e37-b49f-45af-b1c2-dfab5a46903a", "value": "T1D10512023587C032E15B017574AAD620AEA6F9705F742F8B3BD646AC9F322E3ED75346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447953, "uuid": "3efcf132-0ebd-46cc-822b-2d6f51301b5d", "value": "4dfbd068d509e65cfeadeb4a32c65fed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447953, "uuid": "82242f75-5713-4fd9-8ecf-d5894812054b", "value": "12288:aiDjcTEeZhtig4t1HHemVCj9g4bmmrBI86wWnkjphSLjFyKdF49xjirhnNMCC:hfcTE2h0BHxVCm5C5wkjUO9xjMhCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447953, "uuid": "330be3c1-ad6b-4a28-bbe3-421a50a1b4cc", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447953, "uuid": "985d3616-5d14-4d60-b0b1-231b0ee1376d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447953, "uuid": "fada59f9-c6cf-4c93-81b6-8f063c5903eb", "value": "31b6af9b32727f5c93fa714da47cae02d7fe019bb99ef04c9bb48a316f3096d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb87526-aeb4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648485155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648485155, "uuid": "cd0510f5-9b2a-4580-a089-b7b343d53d4b", "comment": "Malware payload (AgentTesla)", "value": "3452655c55b598a91c43307a644e4afb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648485155, "uuid": "57872ed5-9544-41a5-b612-442f1ea69dbf", "comment": "Malware payload (AgentTesla)", "value": "3232449d83a3c38d2defd321c67d5f5d8cd826be133bb46efd6b278097e56fe5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648485155, "uuid": "6e76d4ef-8a9f-4a1b-ac3d-708ab29db84f", "comment": "Malware payload (AgentTesla)", "value": "31ff420ab82c73af0862a7244b0682a5343b52bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648485155, "uuid": "edb173f7-2c12-473d-966a-acbcb90a47c8", "comment": "Malware payload (AgentTesla)", "value": "84b84fb1587a05e97ca9b174b18221a71d5c423bfbc172c62a43dab4157bbb0c1c931e7870097d397de0250c60b907e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648485155, "uuid": "1a4e838f-d309-4b24-9b2a-88cb481cead1", "value": "T1B7442226721B51BA7E61F187FD827B60BAD31DE35E3D77D0117DFC832801AA68828179", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648485155, "uuid": "2ebce5f3-543f-404b-8900-8efc26b335a8", "value": "6144:lmv3NT3zcZ7TTfUxMRdYYYMZEwVr1umtlbYYgNRZfGFgVw2:Mv3tAxfSM3YTMZEwr5aNRZf1Vl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648485155, "uuid": "21911aca-8fd8-4408-bcf3-43f6a4195eff", "value": 277959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648485155, "uuid": "ca7007e9-a4c1-438c-ab89-dddc390dce28", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648485155, "uuid": "3c2a2c2c-55e8-478f-9343-ecba5ec3ae6e", "value": "Bid Invitation.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5612772f-ae51-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648442490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648442490, "uuid": "272620aa-6d8f-41a7-9cea-610e72fffa54", "comment": "Malware payload (Loki)", "value": "4a00861ef8e1202cfd1a24c6b53e60dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648442490, "uuid": "21929a7a-0185-46dd-8b24-2869a660b45a", "comment": "Malware payload (Loki)", "value": "32b20e8f7149db647ede3aba8219380f8f910b73fef5c32d03141a647f981976", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648442490, "uuid": "60ef8ce3-9048-4d3f-98c4-370989eff91d", "comment": "Malware payload (Loki)", "value": "19c6e4804efd9a32c367de6ff7ff433411016295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648442490, "uuid": "27e143a5-54ec-4972-9013-19fd88a00c36", "comment": "Malware payload (Loki)", "value": "86103a91f15bc7b713fab0caab0fc9aeb12ef142c0f3657f006df3d895cc599b98224772806a0839dc2beedfe82c575a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648442490, "uuid": "3bf63ce8-5caf-4b9e-bc8a-88f9501feb82", "value": "T18925F00222B05B45E07653B6CCA544EC57717E1AAE7DE21F1ED132CF0EB17818A2AF67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648442490, "uuid": "e5602d70-e5fb-400f-9ce2-38c4aed616f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648442490, "uuid": "10003f4d-50b8-4884-ab3b-062a2c6be5d8", "value": "12288:Fp6c6WHNiFgI5Krll8hNRoH6XAFwLZqE+11coNQaT3rmTO0CoCqtKi0eg965fcxr:FpoQNiq0mll8ZZ321cMTCixoP35fc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648442490, "uuid": "6be402b6-3be8-4380-970d-1fb991b20bca", "value": 1048064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648442490, "uuid": "114d0e7d-d055-4480-a448-bd36265de52b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648442490, "uuid": "5fc1b61d-ed6e-41e3-9dfd-d9a7302231af", "value": "Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada15773-ae36-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1648431040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648431040, "uuid": "a9863e38-5f18-4c58-9f17-9ce56d3d5646", "comment": "Malware payload (DCRat)", "value": "5079b53ba1062de7563df6c0ea657e44", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648431040, "uuid": "e8dd8537-b406-46fa-8556-a5c484a77d35", "comment": "Malware payload (DCRat)", "value": "33003b17e546af80cf3e1cf2bb98c2d78b2bbe5d87c4c8b1ee57e145c0e412ec", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648431040, "uuid": "ab315843-5bd9-4395-8ba7-cdf092f8a5f7", "comment": "Malware payload (DCRat)", "value": "1367c030f3953a05bedb0218b08010bb52a392b6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648431040, "uuid": "6b6316f4-a9f1-4854-b11f-d8569fbf57ce", "comment": "Malware payload (DCRat)", "value": "e1c4a4f58fcfbdefb508e66c4c17794b57c08f7d2bb990a2cd0baf6dd03071f696369f3c2c695e6bf40ddfc88e342926", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648431040, "uuid": "5b6ee511-8eed-41ea-9eff-1f0b639561d0", "value": "T1A565AD067A55CE43D0694733C4EFC12843ECAD462A66D75ABE8A33AD25013E71E8E5CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648431040, "uuid": "f57a15e0-70a0-4d2f-b752-3a56152fe089", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648431040, "uuid": "5fc003b4-8b72-45dd-8eb1-0c2af0120292", "value": "24576:0NNUtQhWhtqDfDXQdy+N+gfQqRsgFlDRluQ70eJiVbWpR:EzhWhCXQFN+0IEuQgyiVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648431040, "uuid": "edac3e21-9ef5-4bef-85ea-27e51f404bab", "value": 1532928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648431040, "uuid": "958111be-cc67-4e30-9e37-0a9a1c9760aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648431040, "uuid": "4ae39016-f41a-4c95-b311-7a9dd43dccd0", "value": "5079b53ba1062de7563df6c0ea657e44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1039f244-ae69-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648452680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452680, "uuid": "9fc107c5-9453-4a7b-bf34-2e80e4eca635", "comment": "Malware payload (Loki)", "value": "5eeb66a549b3cc145f41e1b226232758", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452680, "uuid": "701ef9fc-aa06-4c39-abec-3ae3dc8928cf", "comment": "Malware payload (Loki)", "value": "3324f8e7c91100be8ab35f890123ddcbecfc881383a6400e5c5a78ae758bb706", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452680, "uuid": "6e1ae5bc-cdcf-4a60-b41b-d102b484a0a9", "comment": "Malware payload (Loki)", "value": "4f7249834a99bb9d3351a512d434066749433801", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452680, "uuid": "7beded8f-1baf-4d5a-97be-f88be5d267de", "comment": "Malware payload (Loki)", "value": "02146b4cecbe56cf9c7fda014f636a622363f7ccd1a69fa1ea91d41bfa04fd3faa223437805c70c0ef17779ff040a99b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452680, "uuid": "202fea64-0fae-4ff3-8fe4-9ca5ec025dfb", "value": "T1FE14125EA9065820D099A3BEE7575DE89E7BFD03EC25158B7CEA720B50BDFC001E3462", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452680, "uuid": "bcd603be-e831-4e0d-a13c-c31c0f9f05cb", "value": "3072:UDq0YXzTej2LyFUFUGfO1rOE3BhNQmak7T+liy/9LX2kpVvxh+TkbSjQAiU:KCTeiGjq3/1k+D/9iOv+T8jJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452680, "uuid": "4cb42e95-8ab3-475a-8891-7ab134609d5f", "value": 192984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452680, "uuid": "50c76489-d94d-4f8d-adf6-d1e277fd016e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452680, "uuid": "6fcc8880-9ad5-42cc-86bb-3821b58b7a2e", "value": "18022020135702-2200.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e921ac-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448051, "uuid": "a3061cfe-5804-4537-a733-7d57ac9242ec", "comment": "Malware payload (Stop)", "value": "835487246d7e6f397c6460a9041dc6ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448051, "uuid": "fae1b004-2c80-43f5-968c-7d7113bf1d7d", "comment": "Malware payload (Stop)", "value": "334b8a74d8431027e9a01439ec7ef905e4b6899498d7a9995b3f718aedcfdfaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448051, "uuid": "4a7b365e-d441-40fe-9e85-3eda756bea0c", "comment": "Malware payload (Stop)", "value": "8a579fc62e074c9a8caf0e953b1d61bf05029deb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448051, "uuid": "444a350b-65e3-4f9e-8cf3-a186cd71f30e", "comment": "Malware payload (Stop)", "value": "f0644adaefd65861924a347b5e46cfdbcfb6e74b0b835733e68531ceb4c5a7d2754049ff9a0965a6b0f9312f319e59ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448051, "uuid": "fa253e19-6a01-42bb-8959-d6031dd0df75", "value": "T1D905222A29A2D6B2C79219306835ED351E7B7D321CE998073B5E272C4F30BE159B7347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448051, "uuid": "c7a72ff2-3aa1-4784-8caa-b0e899ab6dbe", "value": "5b75f173c8dbe5d769232e05f53b6e20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448051, "uuid": "1567ee59-c70d-4d52-978a-fb0f4dc9b2b3", "value": "24576:127rpIqSysEFOBhbON99YK5FqgvgEkOd:1K+ypFOBhg9VFLvjka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448051, "uuid": "507179f1-3b87-4dbc-8eb3-9d1e6e664014", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448051, "uuid": "573f962f-0263-48de-bf51-8df12d72b6f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448051, "uuid": "deb4dd13-97fd-4d78-b9fd-2a7fd7a9ab80", "value": "334b8a74d8431027e9a01439ec7ef905e4b6899498d7a9995b3f718aedcfdfaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6e977a-aec4-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1648492084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492084, "uuid": "a1cfcdec-cc83-4f6d-ad46-cd6f282fb24d", "comment": "Malware payload (RemcosRAT)", "value": "64d7045bb593fcb01e73d22c1cfcc38c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492084, "uuid": "fe05034f-c889-49d6-aaea-eaef87ab8179", "comment": "Malware payload (RemcosRAT)", "value": "334df0eb8ebc67ddd2eb7ad5f680c3f2701321ddc2df1dd8a16d395cb5af2da3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492084, "uuid": "09879112-0add-4321-b9bf-32b73d87e2b4", "comment": "Malware payload (RemcosRAT)", "value": "4abfcc4412a522b80ebcc1e776c3e70b66e3df18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492084, "uuid": "5e312ddf-0fd1-4e62-a8b6-c2143ab18662", "comment": "Malware payload (RemcosRAT)", "value": "751369e3da75fc661c622307338594f770cf9dd1406f671fccf83b61c143cd714be16c0a73c52645e72343b253b303d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492084, "uuid": "3f1a6345-445a-4af2-85af-930e0a40fcde", "value": "T1E4A4BF11BAD2C072D97251340D29FB35DEB8BD202935857BB3E61D5BFE30180A72A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492084, "uuid": "3aa2e54d-c81b-4233-ac93-e535b4f4e3ef", "value": "029a987f21e33b48f24d21b6f9ff1129", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492084, "uuid": "dc4f696a-6d70-482e-bf21-cf26ba860880", "value": "6144:3OFBH/FMNjt18F+9a/NgAeDB4CcOtKp03b13a4LJ+sAOZZPWXbTcU6yg:3OFtiNBuFgawDB4NOmuwsfZPpyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648492084, "uuid": "767f4d48-ffbf-4ab5-90c9-5126c4bdfa32", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648492084, "uuid": "9165355f-78e0-45a6-a521-28688329d393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492084, "uuid": "a5a5010f-7857-458f-b27a-d08e26cd8446", "value": "64d7045bb593fcb01e73d22c1cfcc38c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98fe23d1-aebd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648488988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488988, "uuid": "4d0e38a1-e591-4a9d-ab79-470d08d6b504", "comment": "Malware payload (Heodo)", "value": "9be44c9ada76ba7d199be581eb33fd77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488988, "uuid": "095abc47-68c9-40f6-a401-c21e76951f93", "comment": "Malware payload (Heodo)", "value": "336476060543e9697ed8d8c220f381788ba7c8fe3c69321571a93eccc3874ea5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488988, "uuid": "e152dac3-675f-46f2-b2fa-746cfb3a8741", "comment": "Malware payload (Heodo)", "value": "9515c2b3a63c1bb37c2838603ec98ef13c597e07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488988, "uuid": "d1b02de1-a71f-410c-80c8-2e4713edbb91", "comment": "Malware payload (Heodo)", "value": "c0b1872281edda04b0e13a3833e1bf9df9335990c26e0cc67514939932582b5278f1b7b8eb86ce1381ef0994cc23ddb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488988, "uuid": "14eabf16-6e84-4723-956d-e0f93804f8fd", "value": "T11DE48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514DB432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488988, "uuid": "ce24cd5d-d088-41ce-aa0c-92573baafda1", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488988, "uuid": "f50a59db-5ffc-44fb-9d1b-e96646894633", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7fvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zpCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648488988, "uuid": "75fdf347-fd1f-4fe4-a27f-29c87f8b42c6", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648488988, "uuid": "129feeac-04e0-47d7-8a27-6bedbcdc9c21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488988, "uuid": "9ef71d31-5172-4424-87a3-3cbd739788ed", "value": "9be44c9ada76ba7d199be581eb33fd77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5809a7d4-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448076, "uuid": "35ede71f-1078-4a98-9829-5486e12fb5bc", "comment": "Malware payload (Stop)", "value": "783f0b98fbbee30d108824ed5b78492c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448076, "uuid": "84cf5c13-412a-4001-9261-3760104a7a65", "comment": "Malware payload (Stop)", "value": "3371e19ad7bdfd3c3ce5a63dd4105541a4c4a36a45760dc51da17ea2d41c3f69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448076, "uuid": "70dfb88e-3b0d-48a7-bbc6-c5a374f2e2e2", "comment": "Malware payload (Stop)", "value": "dae620be212a083fe4b5d7b9146531c4b8e6cad6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448076, "uuid": "10525eda-f3f1-4b41-85bc-8273e777481a", "comment": "Malware payload (Stop)", "value": "99ab17b8ddab62453ebd8210e44aeb3603ceffff395304717f861ec4457e2833b9f45339baff42fdea229ee9bb8f8b86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448076, "uuid": "4f84efff-a891-4314-9f75-120336f5f1ea", "value": "T1B8F42344BB325433D0579636A83CDB62CAAE963069EC06C72F5834B50DA33E5EE75353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448076, "uuid": "71a9d412-8215-46ff-85b0-10f1eccf3a90", "value": "98af1336ee9a8378f1e2c2d0d9027760", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448076, "uuid": "e5ed1ec5-5685-4be7-9f7f-91781b7ebd3d", "value": "12288:UYA3FvwNgE7usLRtrw1bolvGjGyrhXMyUCtCHYborEv:UVpIgE73Rt8aVLyWytCHYEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448076, "uuid": "c064a31b-6ad8-42af-b3ec-8ce08a12b254", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448076, "uuid": "ee31e621-56ad-444b-bcea-ee5946f6bbcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448076, "uuid": "56c4b727-2f1e-4f2c-8e9e-dc38e291b9f0", "value": "3371e19ad7bdfd3c3ce5a63dd4105541a4c4a36a45760dc51da17ea2d41c3f69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31102624-aee4-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648505564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648505564, "uuid": "f8865f19-b14c-40ac-a428-73dfe4ac030f", "comment": "Malware payload (SilentBuilder)", "value": "7fa1b7176ce69d730a2757f2be698a56", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648505564, "uuid": "6bfdd801-3225-475a-88ef-7759a3718a22", "comment": "Malware payload (SilentBuilder)", "value": "337ee78277daf4f7c28f4a764d468d4e364a6751d2351cbfd0989b4f95bb275d", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648505564, "uuid": "476b29f1-0ae6-45e4-9fba-3bcb18dcbc84", "comment": "Malware payload (SilentBuilder)", "value": "21a5f3a1c38f1242a4bfefcbf9627434fae8cf94", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648505564, "uuid": "604d675c-b786-43d9-8fba-d86ac804a390", "comment": "Malware payload (SilentBuilder)", "value": "362beb23e5a64b0cd69c8d6f9bbe88a0870de8fc31bae786fe488b4395d9176cebbeeadb600a745299c56fcf2606054f", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648505564, "uuid": "ee12866f-6dba-46a9-8472-31fd1ca38949", "value": "T1D2C3AD8BB659486DF921877488DB879A7363FC344FAB47473214F3366EB95A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648505564, "uuid": "bb3ccb5c-c765-4f52-ba15-3c380abe99bd", "value": "3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlCN:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648505564, "uuid": "1a408f82-c877-4ca4-ac79-1d134bb4e9dd", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648505564, "uuid": "2019e162-64db-4ecd-afd8-797e0562d7a5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648505564, "uuid": "a5490729-d1d1-4c3d-92f7-55bb269f8c02", "value": "7fa1b7176ce69d730a2757f2be698a56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4029f1-aeca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648494582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494582, "uuid": "f7e3344a-01e7-4725-834c-ffdcf7794960", "comment": "Malware payload (Formbook)", "value": "165016ad794a7b0a8efef59df5751ff5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494582, "uuid": "9cbe8059-17f4-4f58-93ae-0db422875965", "comment": "Malware payload (Formbook)", "value": "347896fb026502c0f75752046a15ab355fe09808e30b09578a18bce28aa71658", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494582, "uuid": "953ea56c-9e08-4c4f-b5a5-cbd7768fb267", "comment": "Malware payload (Formbook)", "value": "397e45bd4a9d1ba57f7a9cbbbaca81f7c3cbb611", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494582, "uuid": "f4bff0f3-c00b-44c9-9ae4-06a4868e5877", "comment": "Malware payload (Formbook)", "value": "6865c40a93104a5f76584bb84d367626d0fa640f3fc4347511f662ea50572bbf47d3f7b11202d960f7d1b8ab572e3df3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494582, "uuid": "cb593789-35e2-432f-99cc-c8f03b2114e7", "value": "T1DDA4237470E887DE6FDE6C98A06D03C2993A2AF9F5BF35041419912E3DB153B5EE00E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494582, "uuid": "f51250a8-d395-4fc3-9ff0-aeab10d3d0c6", "value": "6144:BdnIl74oNbKWAP+X2VOOAK8aLD3sUuTKT6EHOWi1SxeBwmIuM0aeltzZB6y+WxMv:TAMCKHnOON8cB8Sw1SAr+0awrlUV+sP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648494582, "uuid": "7542809a-b15a-48c9-87bc-bbfd9cc9dee6", "value": 487394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648494582, "uuid": "e19df236-b26d-4e50-b3f1-ac3c05fb5c23", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494582, "uuid": "a985b53f-39ee-4d8e-8445-76bc8a33e7d5", "value": "$38,000_Payment_receipt.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7a404c-ae7c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1648461106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461106, "uuid": "49b1643c-fdab-46ad-863b-d2738830c38d", "comment": "Malware payload (AZORult)", "value": "733bbc6a2e675cd0b9a16f292145773e", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461106, "uuid": "01e7b525-4e4d-43fd-8634-95b7b2ec86be", "comment": "Malware payload (AZORult)", "value": "347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461106, "uuid": "2fa0e602-3b7a-46ef-a5aa-94394a56e147", "comment": "Malware payload (AZORult)", "value": "40646255b358627cfc64e0bac2826909e13c4295", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461106, "uuid": "44d93f5c-296d-412a-835e-58d338fcb2aa", "comment": "Malware payload (AZORult)", "value": "d967e50d301c404d6187f5c5ba5811db3a37c44e31662bf1e6e1780f40a6407ace9e6e10eee632885da275700ca52735", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461106, "uuid": "47e2fa05-53d2-43fb-acee-f5a009aaed6c", "value": "T17B35E0137769CA45C4754377CCAA80CC03B07E996D67C64B3DC637CF1AB27869A09A8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461106, "uuid": "150053e2-4bec-4659-9245-6415baeb1725", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461106, "uuid": "820641ef-1350-4efa-9eea-cc5f4962704b", "value": "24576:IoQaIoW0fQ2tLPMBLkEaiPLWsZwY7T+8pBMcXqL9qfM:FRLUdks6sqYDZXBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648461106, "uuid": "7dac5b65-5daa-4d5e-8dfa-ba9d4fbbe4e4", "value": 1149952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648461106, "uuid": "bfccdcd8-da50-4c0e-b7a7-184e55ad014a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461106, "uuid": "8a5e286f-f3e8-4fc5-b391-b9ce3a8cc462", "value": "Dhl Documents for parcel confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5417f1-ae3e-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648434345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648434345, "uuid": "60931d27-6c0b-42e3-9429-f8be0f0af040", "comment": "Malware payload (NanoCore)", "value": "7d18221fcd5ca3f58f37dfb05351ba32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648434345, "uuid": "bd4b8fdf-c44d-47e1-9fdc-fbfe43d41829", "comment": "Malware payload (NanoCore)", "value": "34bb8ab4f4af2b2834e83d1cbab2bc16baa1a0c536d0721531b4072fb40629df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648434345, "uuid": "bd3bae67-a569-4736-9d23-1029d789d88e", "comment": "Malware payload (NanoCore)", "value": "29a4b433843c85da132da6ca5253bbe80b9e5320", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648434345, "uuid": "60a402fa-4a52-4d18-8838-8ea49c4e49d6", "comment": "Malware payload (NanoCore)", "value": "f125a428deb5fb5e35b308650a8fdeb374329dc06586baab1cd847ff147b160421310aaaee427d91a3166c5c466d42f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648434345, "uuid": "697edc32-2ac5-42b2-bb1b-d26034993186", "value": "T15D2523CA33E4931ADD786BB8E46085650F72D55B3442FB39EE84B4988B73781CE605B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648434345, "uuid": "b8c74b7f-7d79-4265-9463-3301149d9da3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648434345, "uuid": "9863d5be-6fe2-4a04-b1be-06a94d0a0d34", "value": "24576:HxLjtXm3fo6WRm50l97RHGY7HEGpqP7BZ0lb:VBKAx7RL7HEGM0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648434345, "uuid": "1ebc686a-7c25-4eed-9af2-c914a4794283", "value": 1027072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648434345, "uuid": "7706bd51-f78a-445e-a2dc-2af982d2d14b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648434345, "uuid": "e8583464-1305-4894-8331-bc57fa9cfb82", "value": "7d18221fcd5ca3f58f37dfb05351ba32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54c369d-ae8a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648467211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467211, "uuid": "732f8158-ab0b-4750-8c08-8d8683bae4fb", "comment": "Malware payload", "value": "e578b9ebee4accc888cb80abf5d7035a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467211, "uuid": "7d885c81-a772-48e7-8939-cf49a0f37447", "comment": "Malware payload", "value": "350e1a4912942119a0971b0b44f32168aeecefa35bf4df40d8c0ca2e5dcd75cc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467211, "uuid": "72a68604-60b4-40b6-abda-77f36c7d97c0", "comment": "Malware payload", "value": "ab033a81686e67e328054e4ff3987378f2313029", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467211, "uuid": "bef9fc85-1829-4355-81b9-477a67ce3441", "comment": "Malware payload", "value": "29dd5abd0dba44a857dde782a96aed734d14be8777744d0579db7378c7cc8b78f3b3225705b5727faeecf9638081ebdc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648467211, "uuid": "6a8144c5-6011-479c-a0fe-081c1f323169", "value": "T15C64CFA447406B99FE588927C0BD565D62B3472EE813B3CCAB723907276FD4D2B06C87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648467211, "uuid": "baf95be9-6780-4a0f-ae2e-19c7ed0dbf5d", "value": "6144:ek55z6jNI5TGUh4OeJXvDcFHs63B+ZhwG+sKii3BvUgBeCfWy/:Rcmxh41vDcdR3cZ+G8BvnfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648467211, "uuid": "31690c35-47a4-4cdb-9778-6e0eb4fafe4b", "value": 323536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648467211, "uuid": "dc05f885-0f39-4c11-b29c-ae76e69585ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648467211, "uuid": "f8f7541a-c03f-4688-a57f-3827e3173a87", "value": "QL_0091446.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46d36e8-aec2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648491235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491235, "uuid": "8baa8397-af3e-4499-8bb5-88b424374ce1", "comment": "Malware payload (Heodo)", "value": "1fe370c887044a7e9ed49405399cbe32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491235, "uuid": "5c27b0f3-da02-44c0-b1a3-f8c74ac0f191", "comment": "Malware payload (Heodo)", "value": "356c93fd7af34dc488caef44f28cdb1504adaad2515f67a503da0546ee3497d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491235, "uuid": "cefe5ce2-6c7f-4cfd-8244-5e2623ef15b8", "comment": "Malware payload (Heodo)", "value": "69da7f72699fe1b3f094d9250c807be9f6789397", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491235, "uuid": "1d06428d-eb17-436c-a1c4-748b89c3077a", "comment": "Malware payload (Heodo)", "value": "a58b35c55a8a94804a4d63840b4700e85acb182e7f2b798325ec76df9679a9279be9554322d5bbc455fb66d1a1a0cf50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491235, "uuid": "8fb7fbf3-5b91-4f67-9cdd-00186fa15695", "value": "T124E48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514DB432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491235, "uuid": "b651943a-ea22-4763-ac4a-83a73552dbc9", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491235, "uuid": "01418a8e-fb00-4a6f-8500-b22137c4d52d", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7hvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zjCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648491235, "uuid": "9e3999ca-fbd5-42a5-84d8-30f57e90c067", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648491235, "uuid": "6b7c2cf1-2617-4241-97a1-2bc69b5952a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491235, "uuid": "8a89e061-afa1-4437-9504-35dea46ef7bc", "value": "1fe370c887044a7e9ed49405399cbe32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc63e535-ae68-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648452540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452540, "uuid": "a48e9bac-89bd-428e-9ffb-2483c636c69f", "comment": "Malware payload (RedLineStealer)", "value": "266103db7a5bd5f71e5b74772f5a75bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452540, "uuid": "b4163188-6058-48f6-b8e9-af0a49fe1044", "comment": "Malware payload (RedLineStealer)", "value": "35b717b579cb272c8beb73a265807bc25c45598c1615e7dc24a3dccb98db8e13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452540, "uuid": "b088a931-20d0-434d-8584-e0bd65341c59", "comment": "Malware payload (RedLineStealer)", "value": "a507519c74fd8694508e0e807d8b0e8573b64587", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452540, "uuid": "ba1a6294-c73d-48fd-9d71-3960ea102e3b", "comment": "Malware payload (RedLineStealer)", "value": "f424bec498d95e41a81f80c38bc30d0a52827a2b2684f53c2785e68bf8711b619dd8b9fd42b57a180a1f6743db28af3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452540, "uuid": "f657dd13-20cb-4808-8f56-ea613b823a80", "value": "T117C423396FE00604F694E6F6171F790D98ADEE0C6212D1292095FB66EC7F7118E7930B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452540, "uuid": "76904ea4-8785-47ad-aae5-4fc58f210e2b", "value": "c7d9d387ac26194d035bc62a0aabbfaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452540, "uuid": "dd9dd815-ae53-4031-87aa-1a5208f02362", "value": "12288:eFyoE2aaTWp2SWuWO7ZiaDkWRhIXJYmYEkPsepfwEy3pXWbkYNYuS:eFy5p2SWuWO7VZhWamzkvsQPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452540, "uuid": "0f38f0cf-cb28-4448-bf10-9234789108f8", "value": 589600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452540, "uuid": "a7c5704f-5ef4-4ac9-831c-ddb997403151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452540, "uuid": "278a8390-f2a4-44fe-9f03-cbf8681c9cbd", "value": "266103db7a5bd5f71e5b74772f5a75bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb01844-ae2a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648425863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648425863, "uuid": "7b2b9031-9664-4123-a225-5690d293ddad", "comment": "Malware payload (Heodo)", "value": "676cb205bda59fa2e34fbee6651399d7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648425863, "uuid": "eb29f156-c96d-4362-9921-c9b718e9a86f", "comment": "Malware payload (Heodo)", "value": "36abb002f589a8c2fc3045eceaf846e93f56a0bd15bd0ed3c4f20d4015bbb5ed", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648425863, "uuid": "432fdfec-96bb-4533-9588-e86da7e157ff", "comment": "Malware payload (Heodo)", "value": "c00d7526399ade5140ada7169364b64d35154833", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648425863, "uuid": "979bc9e6-f95c-45c6-80f9-500f5fdb2493", "comment": "Malware payload (Heodo)", "value": "59016fa5f65c67edce792882bf38d6c59412fd6733487b40e07c6dc6d98fb0ba2d1cfc007587504045a7cf9d28c65514", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648425863, "uuid": "15cdd177-0d6f-4b9c-827e-cd9d973b8ef4", "value": "T137E49E1177D0C072C2BF3630551AA3B566EABC708DB9860B6FD42A7E2E745829D3871F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648425863, "uuid": "97fc8363-efd6-4739-811d-e187a426e67f", "value": "923a5ec702466ffd61b422bacc94c6f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648425863, "uuid": "fe813a48-1046-4c79-85d3-04054441869f", "value": "12288:JSycC8Tu2EEAeClIHRFa7UdUzrAKztI8X0oXYl2N17OP:JSDD7RDhH3dUfXtj0oXYl+OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648425863, "uuid": "26f57715-d475-4257-9008-ba6d7fc4ed02", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648425863, "uuid": "ddea2843-461b-4293-9d34-6ab4db0717fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648425863, "uuid": "81daa9ea-059e-4b4c-bb6f-9af67430fc31", "value": "emotet_exe_e4_36abb002f589a8c2fc3045eceaf846e93f56a0bd15bd0ed3c4f20d4015bbb5ed_2022-03-28__000418.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce351687-ae93-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648471038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471038, "uuid": "f31abc0a-8fd9-4203-bd65-0246d4ba097b", "comment": "Malware payload (SilentBuilder)", "value": "236531fbe0614c238aaa3974736f8e38", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471038, "uuid": "09899d5f-3b98-4373-9447-d327b1fdb7cf", "comment": "Malware payload (SilentBuilder)", "value": "36bd9d6338b1d2cc24c0fd37089a4cbc49e2e086e738007e56150e9640acda3b", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471038, "uuid": "a1c076f6-ea4d-411b-be75-390db1428656", "comment": "Malware payload (SilentBuilder)", "value": "bf2700b9996dc7b19f146f178104f7ccf71ec795", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471038, "uuid": "a357bf74-c60a-4292-913d-75067a7e3fb4", "comment": "Malware payload (SilentBuilder)", "value": "6263ffa23e231c75b28884eb6ca0f810776fca2fae5fae71c778474ef8c37cef66c1bfeb442bfdaf20f77b5e077fa3f6", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471038, "uuid": "0c7597ff-e55a-4f08-9cfd-84877b01fa76", "value": "T1F7734C46F789D899E525C7350DAB87B87662EC244B5B07C73206B7B87FF44D0AB0321A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471038, "uuid": "dd1fd838-c2ac-49ff-a841-92cdab72c9de", "value": "1536:/jKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgeJvhqkCGKL9l7FNc5eQpBMawepUNUDpK:7Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648471038, "uuid": "4e7d4b00-8a02-4480-904d-f6127faec939", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648471038, "uuid": "e002336b-00b9-4d33-a143-abf37d1324f5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471038, "uuid": "45cf1525-7bb1-4ef3-8fd0-edfb967d0736", "value": "Form - 25 Mar, 2022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53c599c-ae5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648446515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446515, "uuid": "a942f12f-0558-4f37-ac76-1ad1440313e5", "comment": "Malware payload (AgentTesla)", "value": "31b290da9304ac91d1f7c2dd10ec379c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446515, "uuid": "f8676ef4-4e57-4624-a03f-a744019da4d0", "comment": "Malware payload (AgentTesla)", "value": "38083f72bb53d42e0b5c1b12bad8916872e0dd00a30ccd5b900e28481ba5c47d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446515, "uuid": "e975df86-4712-4e07-98cb-060519b006bb", "comment": "Malware payload (AgentTesla)", "value": "73a81ac136613a7c0290e2ab5572f7b815f7c416", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446515, "uuid": "65ada3ec-9f7b-40d5-8fbe-819ebc76030d", "comment": "Malware payload (AgentTesla)", "value": "0e899833e5a9ab15ab1de0d1f13202ff5bc811b93c0385bee32718fe3079f9077f2f82f7063101f32eec8a3966b4a4e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446515, "uuid": "7c3d9bc7-14f3-4468-8563-6d08b1e98f9c", "value": "T1E535229137A9C396EABC9BB54032446047B5B9BEB4B0D60C7E8CF1CE6A32B11C215677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446515, "uuid": "3b8258b7-17d9-4fb0-92ee-adec6e4e888a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446515, "uuid": "98ff1a02-4138-43b2-80fd-ac56143cb669", "value": "24576:b8w5pBAvEdOjKNuT3FVM/esTIjjlzT1PMWCls:35bSOubFqmjjjPMWCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648446515, "uuid": "9bc4f641-a3bf-4eda-9354-9ac79dd4e676", "value": 1103872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648446515, "uuid": "6da376da-6e84-488a-b21f-205832d0ad8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446515, "uuid": "0905f6ba-a796-4bb7-b8e9-f5d929695075", "value": "723J55eZAL5HfMh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6791dbec-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448102, "uuid": "e41baad6-ca58-4275-af19-83845fee11dc", "comment": "Malware payload (Stop)", "value": "990aed9bbfae0ce838cfae223710df0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448102, "uuid": "f4273716-a96b-4e14-a716-7caa58c29d08", "comment": "Malware payload (Stop)", "value": "38184b7ce38e838ee66079a498ec93128332e3a3d6dd55d779d8896c92b423a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448102, "uuid": "5efaddea-495b-487d-839b-77ca0d42b031", "comment": "Malware payload (Stop)", "value": "5e5473bc1cde554d3de7e48eac2f89487ce0887b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448102, "uuid": "23627d79-0a33-42ac-b461-30d309dfd643", "comment": "Malware payload (Stop)", "value": "b8100cfe3769e7ef0b05e16136a4e3042c09f2cf0cf2aac4957e2d22247ed4384ff0ea71855a486d0f44639701cfc025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448102, "uuid": "18be7807-cb92-4222-a95f-0e760e83a000", "value": "T1220523066A929835C4AB19347116CBB33F3C7632075B9ECBB788963F9EB01D1957470B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448102, "uuid": "2e3a241c-27ad-4f0c-9d67-f8dc0bf48452", "value": "82d4c36ef8d8d93a7382f02fd78b23b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448102, "uuid": "9a464b9a-9619-4d82-9231-fb3aab80aa2a", "value": "12288:5ul0Vm+PL7UA2VLAnwP1Oo6TQ6RecCFOIqilWnlBeQflfXlbroQUrT/1AF:59sdVLXOowQ6RecCF9WnlPXlT6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448102, "uuid": "b1aa10aa-033e-4fb7-a7b6-01e14f919e38", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448102, "uuid": "f0c53258-c69d-4cec-b249-583046260350", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448102, "uuid": "3738836f-e6a3-4524-aa7f-0867ad91ed60", "value": "38184b7ce38e838ee66079a498ec93128332e3a3d6dd55d779d8896c92b423a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f8f9ff-ae6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648453770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453770, "uuid": "76ab5cc1-f8ac-4759-92b1-5164b4f80bcb", "comment": "Malware payload (SnakeKeylogger)", "value": "01f8f8783947629e177080e6bae5486d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453770, "uuid": "eed4f8ad-2343-452d-a4cd-8703893dfd1a", "comment": "Malware payload (SnakeKeylogger)", "value": "38be14c79750f9ed159b5727b78c22c2510b18635c1893cb842749140d4bd299", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453770, "uuid": "f424987b-fe49-4c6b-84b0-1da1478b1dca", "comment": "Malware payload (SnakeKeylogger)", "value": "4f835e6e2f75dcb01b6be3a07b60e4e1fce48a0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453770, "uuid": "95489ee9-c82f-4da1-9db4-1535cebbf899", "comment": "Malware payload (SnakeKeylogger)", "value": "d636c62de4b81cc2e2671bc4c1746ab655bee1546e86c03ed6986b9ac17781c1fd0f248843190ac9b4a70d4b1792d7eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453770, "uuid": "513a42d3-0da8-4e08-aaae-409ca34f482c", "value": "T111430883E7C48311E8284974693B5E281737BF89EE42790A31DCF51B1EF77C69922867", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453770, "uuid": "04579255-3bae-4d99-bc7b-43e6e81cee66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453770, "uuid": "11e25e57-88e8-4156-b7e7-ca77aeecde63", "value": "768:iIHQbwbMmvwgQxiK56WHCfUHQwP0Z//amaOgqxsCsoKZo7X:HWwb/vRK5Vh0FaOgys1jZo7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648453770, "uuid": "276b5b6c-8bf7-46ac-85e5-7e72e00c69f6", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648453770, "uuid": "fac67fbf-3012-41ad-b3d8-76758a551dc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453770, "uuid": "79396b31-4b07-43ff-8c71-abddb637b8cc", "value": "dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e788e771-ae6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648453901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453901, "uuid": "cd517691-4924-41a2-8df7-c77e1d32bef0", "comment": "Malware payload (AgentTesla)", "value": "3fa8bf165ac14c09a10f795b491e9139", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453901, "uuid": "eaa9622b-4c1b-4b8b-a880-196a6f34cdd4", "comment": "Malware payload (AgentTesla)", "value": "38c815b73003ac08bc279d3a880f5d79279795a9154377e58fe52790fcb0473f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453901, "uuid": "634e3aac-e170-4523-8642-a083dba6de24", "comment": "Malware payload (AgentTesla)", "value": "24660ddd4b9925420a4aac36c239c52d8711cf06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453901, "uuid": "c1e6d2d9-a9c4-4ace-a76a-da5b8e486d86", "comment": "Malware payload (AgentTesla)", "value": "8f352b41c2aa8fd237d262e50f76547a127fbf2386b95fc34ca41913a87927d1b220178dfe0846892d04f68b0471d841", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453901, "uuid": "c9952511-91e6-454f-bf4f-83b94e77d9b7", "value": "T19E55D157B7D623B1D2BFD279C6A24A38EB727412433DAF8F6390419A1E23391443971E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453901, "uuid": "caeb6bc5-7fb9-492e-a8b3-ce7229ffaeba", "value": "95866651b7f95c626ef9a4c17f1bbf30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453901, "uuid": "38ae8084-b4ce-454b-b0a6-6c6c29372f70", "value": "24576:TXNPzPgTdggincGp+FGmCA8+hRYJ3UvLgqv9X1iaA6qRKUaQGW8G7AYy4LW6KD3:TXNPzPgT78+RE3U8Wq8ULYGc136KD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648453901, "uuid": "2fababcb-0d33-4332-8ac5-fb1b951ff7d0", "value": 1325568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648453901, "uuid": "7892eae4-3c79-491b-9170-c5a46d0e7557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453901, "uuid": "8358abc3-8778-4203-98c3-a69decabaeb3", "value": "POFTY6100.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79285b53-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448132, "uuid": "cbe45fb3-5d56-46d1-b11d-e481794c8211", "comment": "Malware payload (Stop)", "value": "643f7e15fd6ab920ebf2d0f602326650", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448132, "uuid": "e45c29b7-7e79-4776-882e-6f1dc1f9c273", "comment": "Malware payload (Stop)", "value": "3940962cfc57b2aefd05cf6963fa66310487469c9034d749e9e46e259d7f9960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448132, "uuid": "fc352e1b-a246-49e8-98aa-d37ac9e8fe99", "comment": "Malware payload (Stop)", "value": "1845b01a738f2847c55b0ca922829d7a2e98b3cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448132, "uuid": "60f092c6-0520-44dd-994f-21d0f12e824f", "comment": "Malware payload (Stop)", "value": "b1a3260ff920c9b758980c4df471c4cf353726c47441f590a72548ac654e940f34c1788c9a60571202545ed2e4ec0866", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448132, "uuid": "0ee90ca6-a2e4-4700-9b84-5520381e4ed7", "value": "T1C9F42361FAB2D136EB7203B330E6C64449EAC4743FE14B06EB1D0B4E5F513E5957A648", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448132, "uuid": "66cec41c-b48c-457d-9c25-c519ef74af7d", "value": "85ab2e60dd2898af34be3c600a19c140", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448132, "uuid": "cc04c339-de30-418a-b634-9ddf0972b16a", "value": "12288:9YZbn6jOweyUHP1ITZy7xmolTsodRn5iv1hoZNiKwvu653RKbDvokfJr:9YBnvwPUNIg1molwKR5uqNgvu65sYkxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448132, "uuid": "a3d33124-e3f6-4673-be49-3ef3dce54084", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448132, "uuid": "10599143-a25b-4d4a-a599-6b549eefbded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448132, "uuid": "ebce5d23-bae7-4073-8a1d-3157a2f163f5", "value": "3940962cfc57b2aefd05cf6963fa66310487469c9034d749e9e46e259d7f9960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8459a998-ae69-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648452875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452875, "uuid": "07f91086-a4f3-4668-a452-655dcc169cdd", "comment": "Malware payload (Formbook)", "value": "2be5b4de1eb967ca625ba152dfbe6d4d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452875, "uuid": "7a65817e-9319-4a3b-bbf4-717164d2cc6b", "comment": "Malware payload (Formbook)", "value": "395b93e8b09c67c4868d7c2daa203b2b28397cce846eabf25958bd81e99e6c3f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452875, "uuid": "e1573137-4b92-45ab-96ac-6cfbcb65146c", "comment": "Malware payload (Formbook)", "value": "f31cdfba1b9ee95e49ea3ce659cfc02c99a4d755", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452875, "uuid": "5841b4d8-06d6-493a-a8e4-b0d356a142c0", "comment": "Malware payload (Formbook)", "value": "37058d20c381bc979cb9170cf50aaac1cc5ebc3295db0e9c69afb97ad196445442e9646e69090915c8ce858843d42860", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452875, "uuid": "9f9d0e04-312c-4c27-aa44-64c8e9df90ac", "value": "T1D9511F8D704B78240132BFF2AC0F08AC9A729787A57841673909CAD6CE75168E79581C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452875, "uuid": "d6e0424c-ad28-4cc9-8e81-5931d391a0df", "value": "48:6+RO62W2pekyHnqViRWOWnSbNJ11rSl0HZReqWVDj98u/50Bd0:XY1UkyHqViR1W8J11rSl9VxjZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452875, "uuid": "843030d5-6f1a-4023-a3f6-b987dedbaeba", "value": 2778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452875, "uuid": "c1681ac9-bbe2-4ccd-903f-c95e22f802b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452875, "uuid": "94112b6b-679d-43d9-b945-4e83698b53bb", "value": "\uc138\uc774\ubd80 \uae30\ucf04 \uacac\uc801.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677d7766-aec3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648491481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491481, "uuid": "e8ad8ba4-ebd5-4b72-b8a3-edf7da5634a2", "comment": "Malware payload", "value": "a0c6b4cb7ba3c1cec049382ea25a1617", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491481, "uuid": "d714e40d-f673-4099-a315-326baf8e2325", "comment": "Malware payload", "value": "3987ea55911d57e4f6e97332a95794f8d38465b521f5b27e0372a4598ed702b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491481, "uuid": "6191fe7f-33ed-4e48-875b-7755cfe81f38", "comment": "Malware payload", "value": "cd2bb3994df63ee4c7cc478c5d9ca04cb01a2d85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491481, "uuid": "c194d939-4c96-42bd-b4a5-5114b572367d", "comment": "Malware payload", "value": "d5bc5e37f5aa63f89b4df9c01dc6c4a7b51e76d8641919a285b71881dd2a0acbbf367d0cd927ec847cccc3d49970a72a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491481, "uuid": "7cdb792f-6a03-4813-b3aa-2b88903b1e85", "value": "T125D49D32E3F86E57D07A43F85420D0253BE69B46A228D645BDF625A7E5F27C24C62F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491481, "uuid": "c5cc4753-3ac0-4aa3-9513-a489a188c6f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491481, "uuid": "72233641-f468-4e47-99c3-fd0a17e57c73", "value": "12288:R+penQbvdc/gjjErzsybEv2nhLlM/rH++vUVGZCjMXZ1FF:gpenQbVc/gjjE8enhJM/rH++7ZqMXZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648491481, "uuid": "cccc327d-bc8c-4998-a25f-fb6182e049c1", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648491481, "uuid": "23b810ed-cda4-434f-b2c0-43356cc99f7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491481, "uuid": "7b5b11dc-c57b-4964-93e4-1b8274c53033", "value": "IN02672Q0473764INBOM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3d253f-ae68-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648452402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452402, "uuid": "465e41b4-3955-4880-a7c0-90ca59594c7c", "comment": "Malware payload (SnakeKeylogger)", "value": "f8f04b0497509b664d8c9b072b9aca80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452402, "uuid": "33dc6bdf-f8db-40c2-abb4-753a1666acdc", "comment": "Malware payload (SnakeKeylogger)", "value": "39b351ef5277e274be877b71e44f126e0c83744c62d4f4163ff7639d0386bdc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452402, "uuid": "6cdac1bd-0938-45f8-b717-78b123e59db3", "comment": "Malware payload (SnakeKeylogger)", "value": "891bff5c8903e8f872e074b49c9066c316442d19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452402, "uuid": "981bfc89-9e7c-42e3-b800-24c09140cdb9", "comment": "Malware payload (SnakeKeylogger)", "value": "11c3696b8521e836b72b0950e8c299ff722d424dc8fe7e631b1680cb43445dd4825cb7e5d28b206f7dc0e7f025b2db88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452402, "uuid": "3b9e0157-c454-4f02-8551-eea6e1872e8d", "value": "T188B23E1196E4D626D9EACA395CF276FC0273BE03DC32666BD4C5FF0E39322400652A79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452402, "uuid": "52e0d451-8bb3-4ed1-9cc8-385254469bed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452402, "uuid": "e5be2eea-ea83-4150-aead-be7707de60b9", "value": "192:Xvbcpr7T3DZygKlu/ZrpbyclDAJvW86mx92in:/bcV1Wu/Npb1lDAJvKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452402, "uuid": "7fcca612-bd3f-4675-9cdd-ae51ec03e3c9", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452402, "uuid": "2bcd3993-2ce7-4c95-b88c-d57a30b43a41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452402, "uuid": "c115e351-192d-422a-8c29-1691eefef92f", "value": "BTL4605781031110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8dbea3d-ae5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447863, "uuid": "bbefb04f-783e-41e6-aa45-d305280fe22a", "comment": "Malware payload (Stop)", "value": "b090a9ab99564d27fe481a55d13fb3cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447863, "uuid": "c7781153-641f-46d8-9ddd-6a8e2707b600", "comment": "Malware payload (Stop)", "value": "3ad17c55ff82d77132b6540e1053baeffc4c47f98a23c52bf5d88f0378b15371", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447863, "uuid": "b66db882-a2be-4ff1-be60-cbbe2e97de06", "comment": "Malware payload (Stop)", "value": "c1f59aa747b739c00cb260a501d556679ab6cb70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447863, "uuid": "9c36a905-9ebf-4703-94ab-6ee92f6623aa", "comment": "Malware payload (Stop)", "value": "25b14c2fe715f36721e6e2da50f0c1bcb0185d80821cc22956ad92c5e021e8bc0aa37a730827a3dbb24f4ec85fb501f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447863, "uuid": "c12c06f0-b3f0-4215-90d3-3af4373b5392", "value": "T10E0523013906D466C85FBA31A414C9A1A97B6E314A0109073F6B57AE3E637F25F78F8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447863, "uuid": "0f3994d5-17cf-4f74-81a3-89d587f13487", "value": "7d2f3e2df9d6e9df3acc14e0869523dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447863, "uuid": "56288e27-9506-4de7-b130-af6151dfaf16", "value": "12288:vnPzyzy4Mfc6huDrJgZrOV/tlT6iqfU9hbT0yOWfZVNdT+do5zh6W03G:/Pzyzy4MZhcruZrOZjWziOmZbdq+wG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447863, "uuid": "1113c1ad-1661-470c-9c33-795ea7aed88b", "value": 798208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447863, "uuid": "31839095-8aa5-4ec2-891e-4da52e0bb177", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447863, "uuid": "36e3f334-32a3-417e-92c9-eaab3ea523e4", "value": "3ad17c55ff82d77132b6540e1053baeffc4c47f98a23c52bf5d88f0378b15371", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0da4625-ae2d-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1648427153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648427153, "uuid": "c2586035-1c6f-4174-8ce9-fa8b162c48d8", "comment": "Malware payload (NetWire)", "value": "6c182cf5941065a1fa5dbf0fa22a5115", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648427153, "uuid": "4c60c660-12c5-4f6c-aa10-e62dad1c92f6", "comment": "Malware payload (NetWire)", "value": "3afe85a9106e5a32aaccdf7047b91824d5a0e405188431f80cdf485e966e99eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648427153, "uuid": "86ce0c55-6679-4d2c-8ff0-45218acc2782", "comment": "Malware payload (NetWire)", "value": "437ee8df51791ffd2399102b5261c0ec096d9892", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648427153, "uuid": "ac2d7d93-f03c-4245-ba33-380ddfdd28ae", "comment": "Malware payload (NetWire)", "value": "456fc49d842938148032dcf0cc728852479307e399948f7e212464ddd51d79619928b5aa54fa4e35c9b5debd9c7f6ff2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648427153, "uuid": "94c383b3-f48a-47e5-8503-4f2b89497af7", "value": "T189E4D5ADB2F075DFC86BC171DAA81C68BA907C67930B4103D02735A99A3D997DF143B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648427153, "uuid": "35632290-58ad-4d02-89e4-e8756473dcd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648427153, "uuid": "65a1a777-63d4-47d1-9157-dd9bc398effa", "value": "12288:YDXtiq6GKtKl3jlaKsERuTLWZihg5OjLgyT0a8+EFyS6vLh1+36g92m45ewugIlk:YDXtitGKAl3cKHZihg5kgAWaJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648427153, "uuid": "d8dca840-b930-4093-93a4-5908c60ef515", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648427153, "uuid": "5a2d39e6-b42b-400f-b065-bd7f57647fb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648427153, "uuid": "bc13ce47-2b3a-42d0-b92f-237c179ea149", "value": "PO-08658690-Quote-Order pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0e24b3-ae88-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648466337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466337, "uuid": "2b3a7bea-262b-4ef1-9bbf-8be5c45aa0b6", "comment": "Malware payload (Formbook)", "value": "b2e8472376c1c1ec2207e8e8da88b2b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466337, "uuid": "c41d3ff9-a987-45f2-8f15-74d94192c015", "comment": "Malware payload (Formbook)", "value": "3b326d59a151e3500563ad4ce6c86228508d9295f54e71c8160aec088752c994", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466337, "uuid": "333412b8-2f69-43f2-80dc-94af7a1491d6", "comment": "Malware payload (Formbook)", "value": "23b602200f90075d81e98bbd921a06f0e8705598", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466337, "uuid": "4677af09-b815-4cbe-879c-180ae31ffa13", "comment": "Malware payload (Formbook)", "value": "2aa98966001a9fca0e5403774b65c5511b37157059c30f5da9926cae901b990ed28030cca7d132bf10cbd67a7bf85260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466337, "uuid": "bf0d59d8-d651-4f8b-af68-bf5cd4f9cdde", "value": "T17A557C98325071DEC467C976CD681CECEA207C665F1BC207A053329E9A7DA9BCF146B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466337, "uuid": "de8883cc-225d-4cb3-8503-8a3b859e35cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466337, "uuid": "28f7aa06-a5bd-4838-b835-0ac8d1943f8f", "value": "24576:WUUYob+WYBTB276VHZ+cwR8tjeCEffEoQhZ/W5XIeqHcRL:R0pg2kwytB8fyhRW5dqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648466337, "uuid": "aef75c23-07d9-4edc-9b14-7c20dcb84f1f", "value": 1400832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648466337, "uuid": "0f31014a-3e23-466d-b8bf-b726a758dc04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466337, "uuid": "189b5fbc-c199-4dd8-bc0c-5f5e67ad4e3e", "value": "zrZYmuDzKucGv6q.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0b128b-ae6c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648454287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454287, "uuid": "983f6d57-159f-442b-b588-cd1ff3a9b906", "comment": "Malware payload (Formbook)", "value": "818109bbfd025ef72c7cb41006ff9e6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454287, "uuid": "1bd38afd-e170-45e6-a730-1c4ec55728bc", "comment": "Malware payload (Formbook)", "value": "3b3339c5adf6214450652108e3cf3122917319dac8516748884b7f27f42a99ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454287, "uuid": "87ae18d8-75b3-4776-838d-a409ceeaf1bd", "comment": "Malware payload (Formbook)", "value": "7d1121f65e9c65b5185131d44a4674fdaf93ee6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454287, "uuid": "29ae59c0-4669-4f23-b6a9-589320183a47", "comment": "Malware payload (Formbook)", "value": "8af61e0eec92627ea778377f99916522303b5de6014136a74efd73f2330b441196ae68a18edc28a3dfb519a7d9ac882a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454287, "uuid": "d803abef-fdef-42f6-b3ca-4d6337a33994", "value": "T18EE4EC2A38BA100DB272AD6C6BBCB175911EF3F226365C7B0DF7054A11129F0DB9D627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454287, "uuid": "a12f7b8e-6125-4aa0-b1cf-772d85243dad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454287, "uuid": "5fd2a882-b2a8-4d79-a296-5f216c85d68f", "value": "12288:anH8Ub56F1HURPr45tNIVgbokwQgGZSmXh50IOSwMD8G9tdJXFZk:wk5o27FZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648454287, "uuid": "4658dc16-2178-43c8-99dc-48cdf52374d3", "value": 698632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648454287, "uuid": "13640745-40b8-4c77-ab6e-8e0c8ffa9157", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454287, "uuid": "6e3d4c1c-0a1c-4493-8a50-193ac5aeb3a2", "value": "818109bbfd025ef72c7cb41006ff9e6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b63c7e-ae51-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648442534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648442534, "uuid": "c3861761-5f3d-4d27-8f38-a92a144324cf", "comment": "Malware payload (Heodo)", "value": "7cf8f30453e13e6c963f8a4d6683f3d3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648442534, "uuid": "868c9bd7-dbd0-46bb-ab7d-a7c52e781f22", "comment": "Malware payload (Heodo)", "value": "3bfdee958af1394b4414838438eb274aaca2bda3583e560d7f2b386311e33099", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648442534, "uuid": "e711397b-4110-4dac-aa22-bbe5aa608216", "comment": "Malware payload (Heodo)", "value": "f1267af64afb21e8b34d5a5f892884c09361f60a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648442534, "uuid": "d3cd574f-84fd-4147-92b9-a6d3deda401d", "comment": "Malware payload (Heodo)", "value": "a30258e977bd600e2eeec971d9aa6cc788d585e70ecd9afc82a3963dc06b598ad73c9a8e8b9ff275625a0e626b0624e5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648442534, "uuid": "653b436b-192a-4ef2-94bd-241cc0469ccd", "value": "T157C47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648442534, "uuid": "a2320cd5-0daf-43d5-9669-c85db43206cf", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648442534, "uuid": "fbea236c-4b01-47d0-ad39-fd76e95d3a33", "value": "12288:S54yM33d3q3Z7BogsreNmF+U/9JckIAGfUeb:SKh3831BouN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648442534, "uuid": "c38be044-75bc-4ab5-bbd1-bb00be34eb23", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648442534, "uuid": "9136b1a0-5622-4676-9098-35d3c43eab8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648442534, "uuid": "c07b01be-e7a1-4cdb-b79a-8b885ac7a4fa", "value": "emotet_exe_e5_3bfdee958af1394b4414838438eb274aaca2bda3583e560d7f2b386311e33099_2022-03-28__044209.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fedd613-ae6f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1648455311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455311, "uuid": "5b80d683-6ad4-4b15-8b19-7a962a726abb", "comment": "Malware payload (Smoke Loader)", "value": "b0595cc48ebbb333d6b55cdf1fdd4bd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455311, "uuid": "424f77f0-d56a-47a5-978a-b81547d19b23", "comment": "Malware payload (Smoke Loader)", "value": "3c16a156ddbe6755ec0e6ba5a2793ebe7734bfde19baaa46213ea8c77a1435b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455311, "uuid": "4a34d717-4871-4f33-9944-ed2cb7e0fe1c", "comment": "Malware payload (Smoke Loader)", "value": "22ee4f86f641ed33c17fe3aa8be493144319c655", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455311, "uuid": "088711bc-a77c-418c-b2b6-08f4f6e06165", "comment": "Malware payload (Smoke Loader)", "value": "4d9980cda029e2f213262257d7564d7ed8a57ac13f3a25b20e22194c1853b6002bb0bc3507c95227c127a48ed4b5e96f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455311, "uuid": "14ad62fb-6841-43e7-af02-b15b1d5ed579", "value": "T12B54BE1239B5C833E56352B56812C6B4BABBB83125615A8B3FD4026D9F303E3DF6570E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455311, "uuid": "e22c5df6-c6c4-402e-b47e-6b327d782839", "value": "cd8ed96dcf990359020da5c59a04eafe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455311, "uuid": "22a2f24f-3866-4cd4-ad34-dd4dd0dae89f", "value": "3072:fIklWolJcU10Ji3F6E2cWyWm+FYRXMaifU2l:godX10tEhWEXMPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648455311, "uuid": "8511beb8-880a-4763-a616-14af69b4e5ae", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648455311, "uuid": "979c1d81-f84e-4f8f-af10-444a7e84fe51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455311, "uuid": "8a4a34a2-9c0b-478c-afa5-c90c5c784085", "value": "b0595cc48ebbb333d6b55cdf1fdd4bd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2abdd0f0-aedf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648503405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503405, "uuid": "62abfc90-3b24-4b48-9292-e9db72585d57", "comment": "Malware payload (Heodo)", "value": "c408f87634e5a9f63d9e4f062b5f0b2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503405, "uuid": "af61615d-6027-4a91-8c51-800861fce232", "comment": "Malware payload (Heodo)", "value": "3d6cf630131277909183cb2e4b65cd23f30c68922b9c50471257a7ff69640e68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503405, "uuid": "37a4fcd0-715a-4313-9d84-7a7e586c5f87", "comment": "Malware payload (Heodo)", "value": "99b07eddb08e68ab106f8f91223781c1d830aa4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503405, "uuid": "43db7151-5c7e-4c92-aa11-172f7ac766a6", "comment": "Malware payload (Heodo)", "value": "8b162229ad80e87d2e04188d166e6d36c04f8d0868365b339b237680a3e81a93eefdb04f46943fc01637b0ce8c626b9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503405, "uuid": "4417dd33-7234-479f-9fda-d7c3895f8a4c", "value": "T133E48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93FBFCD302514D7432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503405, "uuid": "fc473e93-5629-4f8a-b452-ed0c70bb3970", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503405, "uuid": "404bcb05-7d25-4080-ac40-dd3fbacd9450", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7+vK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zQCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648503405, "uuid": "e88df998-9dc7-482f-a90f-85c059920011", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648503405, "uuid": "0f041960-aaa3-4323-92d5-fcfa564f181b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503405, "uuid": "fb945e20-91d5-491d-ae0c-0138cbdebea0", "value": "c408f87634e5a9f63d9e4f062b5f0b2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e012ad4f-aebe-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648489536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489536, "uuid": "139182aa-696f-466f-a047-9b726348d3c6", "comment": "Malware payload (Heodo)", "value": "7e4e60cc363d3a34fab845dd17f6927a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489536, "uuid": "a6374cb3-4254-4ab0-bed6-fafd9fe4362d", "comment": "Malware payload (Heodo)", "value": "3d8549bcdf874f8e8c4a65c8455c5100084fc03cababcd4beb4942ca0d42efad", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489536, "uuid": "2f581a2c-54c0-4a15-a338-cb99be7b5979", "comment": "Malware payload (Heodo)", "value": "4bb73e58274d12ac9838c1ea861668282bc12eb2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489536, "uuid": "3ff4da59-232a-438b-b343-8ab16ad7eb44", "comment": "Malware payload (Heodo)", "value": "d3c86af92729310cc05ec0f33c0b06334b3c7e772c2021de0b5856caac878720d482e5dfd63679d3a15c5b1a75a87b77", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489536, "uuid": "bedd6f06-d555-43b6-b241-7917c5dd29ef", "value": "T175E48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514D7432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489536, "uuid": "07d43d35-fb71-4b52-9741-4cabe01c3816", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489536, "uuid": "e8883e77-2bda-4cbe-858d-6687f3b6e10a", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7/vK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zNCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648489536, "uuid": "63e7a701-d84e-48df-9607-ed516526d2d5", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648489536, "uuid": "a31219f8-e2cd-4804-8689-d2bc8e865f3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489536, "uuid": "64c0c67a-766e-4c6b-a209-1f7bdf01f2c1", "value": "hxt7h9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf79d06e-ae6d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1648454692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454692, "uuid": "91164810-0c11-4acf-bb52-77713d68c35c", "comment": "Malware payload (Quakbot)", "value": "0fa5b84249c076327ebd65002edbd13a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454692, "uuid": "a2a5c086-38db-4731-8e32-5b7350184e82", "comment": "Malware payload (Quakbot)", "value": "3d956caa6f48143b924090c2a027ee392e9ab4340fba92b53f802a6aa93d9fdf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454692, "uuid": "81e3a4a9-da22-4dc4-a8f7-71aca04c0abc", "comment": "Malware payload (Quakbot)", "value": "6e61afc13cf7403e0adc2b069c286730d64188a3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454692, "uuid": "35672a67-5a98-42b3-a111-27cc85f9e677", "comment": "Malware payload (Quakbot)", "value": "ac899999f65e50eb93ba946ccdc208d2579d03b559ab2ecbb452a627f6ebc2c5f6d4f039d63f972cb0e40a34b1dcc4aa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454692, "uuid": "3a5bccdf-8117-44f7-bd35-098bf20b6ed5", "value": "T190059EB8794818F4D7DBD63649ADB8B9137332635AC75C89015DB3C20A7F362AFC1A09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454692, "uuid": "1c05e7d3-d3c9-4fbd-91de-7fcf2126afa3", "value": "3c766a71abc8c67ca3ddf590b543b14f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454692, "uuid": "9159490b-efef-42ba-a672-24e62e6ff829", "value": "12288:6DyAVyvDn5CX/JYLL+wLg+aCsnnzxS/WZ6DFXcdAKhuHe58XP/GQuzL2PltqD4o:6DRMb8vO3xsNxFkRwAKx8XH2X2PltI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648454692, "uuid": "bd508440-121d-4977-b8a0-9dfc0a645432", "value": 864770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648454692, "uuid": "a1ee5b1d-9074-487b-9eeb-79e7743ca315", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454692, "uuid": "648ccac4-6758-473b-bc84-b2060e8af2ca", "value": "dsuh2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c109c166-aecb-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648495068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495068, "uuid": "03acbee4-34e8-4551-a53c-e0359eba4b95", "comment": "Malware payload (AgentTesla)", "value": "9bcc8ebb7a3b4b7ba55f57cfde3b931e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495068, "uuid": "77631ed9-d780-4123-b7b3-c5fc364477b2", "comment": "Malware payload (AgentTesla)", "value": "3da14efa55be0999c99cc4a23dc97c5ae040bc83372849d7148720ff9913b7ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495068, "uuid": "323b4f4f-0ea1-4bce-83af-dafe5dcdfd2a", "comment": "Malware payload (AgentTesla)", "value": "2fe37f302ad8ec69e1759b9252acc3fe09f6615a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495068, "uuid": "8ed7c6c5-1db2-4714-b835-ae5fb388f93c", "comment": "Malware payload (AgentTesla)", "value": "d7b8a996b62ea1bd39541357bf7a96a185827c38951271b8caa11f9b39df3aacfffeb38b456b2415e90d127fc242149b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495068, "uuid": "aa9ab746-3f21-4455-9a4a-eaa21995fab6", "value": "T1C8C4CF32D3F81F5BE47E43795420941537E6EB8BB228C685FDBA21A645727D241B2F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495068, "uuid": "80800b38-9b35-45cf-9600-f61cd465c634", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495068, "uuid": "9c00d2aa-3469-4196-a744-b2293caee9dd", "value": "12288:H+4si3Qy1d9/gjjrjPx7KZL3FkuD5u07p2qvpojqH:eDi3Qyf9/gjj/PdU3Fkus9Ucs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648495068, "uuid": "6d63a431-34fe-44d8-b6c6-e21da853c441", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648495068, "uuid": "2ccf4a64-0dd0-4f9f-8d12-53db4378d192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495068, "uuid": "f44176d2-d718-408e-b977-76c86503d3b4", "value": "PACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e23653-ae5a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648446410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446410, "uuid": "8d2e2e53-763c-4bee-a756-abb1f5a2dec6", "comment": "Malware payload", "value": "ff0375b2425933da7b9755c96da6c80a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446410, "uuid": "6800ba06-fc2f-4642-b5b4-8db7b5a19223", "comment": "Malware payload", "value": "3dcdd836ac9523b9d6afed40333f9ef6a9682fd3faf52c4313a0a1a2593c7cd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446410, "uuid": "ace97904-ed48-43eb-b768-20676a19daf8", "comment": "Malware payload", "value": "5e8654b1bbd11b9deb1c65be6f71fc726d95c067", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446410, "uuid": "032b2012-3c98-40d5-acaa-9f4abbc83226", "comment": "Malware payload", "value": "3ba11f9eb7b74be9709b567daf98ffc2f84bea649485380722c79af7a55bd6af0f49145f7c0c28a6dc80c99c9cfcc21f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446410, "uuid": "8a471fb0-8d81-46f8-82ff-f12eabac2c78", "value": "T1F354E011F5C6E4D6E039B47F987F9720022BAC349A41C1A6239C7FEE69F61A59E13334", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446410, "uuid": "581f99d2-8e77-47ff-b9f8-612becb3c445", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446410, "uuid": "be5a7878-df8b-430d-82a5-46e22b589064", "value": "6144:vsJ7EGZIVCB1PlT0ZWdcfYVBgem7SQcut3wk:vcEGZIw4Zocsa7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648446410, "uuid": "3e8c4203-c741-42a4-b125-bd61d6f7e1ff", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648446410, "uuid": "f958c73f-4e5e-4988-aad3-2f9c73ecc192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446410, "uuid": "2cdec849-f634-4a0d-9732-3fee8c8d0174", "value": "BL # BKK200119300 (821)& PACKING LIST 4030082366BL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db861d94-ae5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447867, "uuid": "aa717781-6521-4847-85d9-570edac871c5", "comment": "Malware payload (Stop)", "value": "af234d904a2fcc1d4da3058121473762", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447867, "uuid": "9e3e1f32-edc9-4ed3-a9af-fe123737a940", "comment": "Malware payload (Stop)", "value": "3dd9722663e0f1a7ee9e7882246efdfceff547413e6a92fba8bffe0ccaf6a0ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447867, "uuid": "f492e719-a958-4928-81e8-f1b5f8ab9d36", "comment": "Malware payload (Stop)", "value": "ed72b2bc7b65eaf2a70e2d0971a4d0551c7e14eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447867, "uuid": "9c06a30c-5611-447b-8c1a-14e6023c9d55", "comment": "Malware payload (Stop)", "value": "0924f0d0777fb02ef68d566283b4c4253133a25fe0cde7e3dfc15e5fe7d0cdcc293ddaaa6f0a175a32085365c8f46852", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447867, "uuid": "202dd32d-0513-4b46-8262-49c5a4c85715", "value": "T1F60522127543E0F0E0EB21B02466D6F0797F75712AB9D24B3BA5073E4EB92E35A71B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447867, "uuid": "f550c6d3-6ede-43f6-8de2-bc7d88f93406", "value": "a0ac95739c763bb58b1023ed75bb0bb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447867, "uuid": "82e0cd4a-6171-41f4-9c97-4e1d8e477754", "value": "12288:z3aiV0g3X7Ar5vGI51ot1kf7yoGMprT3jFo0210mTau3eag4okc:z39F3Xkow1ot67yoVznHKd3NgXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447867, "uuid": "da554742-bc1b-4a7b-98d1-7cabe2d8ae9b", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447867, "uuid": "69942e00-c169-45e0-a778-110701f7b96f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447867, "uuid": "0afccf6e-3e50-4b83-bf80-1bcf06c1552a", "value": "3dd9722663e0f1a7ee9e7882246efdfceff547413e6a92fba8bffe0ccaf6a0ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8add89b2-aec4-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648491970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491970, "uuid": "2f924a8b-e888-43f0-8b9b-9c5060133d15", "comment": "Malware payload (RedLineStealer)", "value": "938c7d3a54ddc88cd4872cb172d59de5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491970, "uuid": "9a5ec62f-0989-4ab1-88de-9d077c98dcd8", "comment": "Malware payload (RedLineStealer)", "value": "3f41c1f89cee913fea8e68e963abaf222e4761d2f9a89e434cde4a28fd9a7e4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491970, "uuid": "b734b2d9-9816-4a90-a5ba-c3bc79e58706", "comment": "Malware payload (RedLineStealer)", "value": "01aa67ac4b5c6384d35079f4e166db4be4c400bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491970, "uuid": "ec460ac5-9a97-42af-8763-755f3da4adac", "comment": "Malware payload (RedLineStealer)", "value": "0724873420909ebe445e507c98875fa521713cb71ea52edfe1edaa44efb41368d74f742d9b7bfd5b9bc2804503751586", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491970, "uuid": "b2e7f941-62c5-4209-8ed4-d41df5ec254c", "value": "T16F84BF10BB90D034E1B716F449B993B8753EBDA19B2495CB22C92BEE5A357E0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491970, "uuid": "1928a0f4-0d7f-461d-be9d-b7bcfa813824", "value": "962dcf4a4b969d5194f73601a217ba6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491970, "uuid": "aa6c4b86-3708-48da-a07c-ce3e14b6ab7a", "value": "6144:S3HKWQA9ug0w5IELMNlYPbgiLldE8Liv5Ch3tdA+B0If+VS/28:S3HK2z0w5IEgNlYj5jivmte+hm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648491970, "uuid": "c6fd8969-4771-4659-b97b-10c7e86a1ded", "value": 377856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648491970, "uuid": "57af7c00-b651-4d77-990b-b0d8120f1275", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491970, "uuid": "7a58a4ca-9972-453f-bfe0-02fdd8a4e008", "value": "938c7d3a54ddc88cd4872cb172d59de5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf218d7-ae5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447872, "uuid": "9406e04c-509e-4c28-9459-700089a43ef7", "comment": "Malware payload (Stop)", "value": "9d7cf5691165ac8aeb5130d2a9ffb2b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447872, "uuid": "b0c954fc-37d2-4ee9-ba73-4b2aee6db165", "comment": "Malware payload (Stop)", "value": "3f47e5ae4e51db104552e401e1627716e84ecf49a18469afa36359eaaa27455a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447872, "uuid": "c17f50bc-9cc3-46ba-99ca-0ded49d83e9f", "comment": "Malware payload (Stop)", "value": "f49af1d8ac9053bea1f86328c6f6fd42928fdd5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447872, "uuid": "2a5fa637-b5ba-4280-8f94-5dcd53f18a32", "comment": "Malware payload (Stop)", "value": "24eb79394811a95a5667e8e0979c4e229ebfb028219325260fc05646c1269e1f5f3575d1fb8f225c34ec2fc9e8bf6eea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447872, "uuid": "5d8c892e-78c4-4634-abbd-bd1eaf7b3378", "value": "T1B1052312B5849071C4ABF87B7490CE242FBE59348385850B7B411FBF2FA62E359B6387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447872, "uuid": "be301864-40cb-4107-9bf4-f13231b5815f", "value": "db9d63801b52e5f18d5dc80c5fed99ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447872, "uuid": "5d0cd77b-e342-42d9-ac2a-8a51f4822adf", "value": "12288:kKb7VZWj4skeQtlLpgrvICIen8pWdcldTEEhPYiJV7AT:bb7VZZsgtlLpgDIC8B9EE1nJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447872, "uuid": "f005b691-a53f-4ce5-9caf-8db53e9457a1", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447872, "uuid": "ee7ae4ed-f4b2-43f2-80e9-4b333f2b1acb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447872, "uuid": "f5a9f6f8-4a67-4191-a053-3e179837027c", "value": "3f47e5ae4e51db104552e401e1627716e84ecf49a18469afa36359eaaa27455a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa9e0d0-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448081, "uuid": "2f979823-d780-4369-8c90-9e20be59031e", "comment": "Malware payload (Stop)", "value": "695312c5f7d3da544f57017af5ed9fce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448081, "uuid": "b92b4292-3cb3-413b-b36a-51e181c22a24", "comment": "Malware payload (Stop)", "value": "4012bc4dd89fbf7eaad5214623cbcfc27a3c014d2bffdcc76ffa5dce704b4c4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448081, "uuid": "a869d5dd-fcc7-4ed9-afc5-fd0eb664119b", "comment": "Malware payload (Stop)", "value": "8b87c1247f551c9acb641341b3e29dbc508bf303", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448081, "uuid": "9c0e3241-72cb-4383-b60f-cbff8098ec76", "comment": "Malware payload (Stop)", "value": "7ab37690291830e6a85dcf48a18830b193f284972199a5a8d6b3e5215b4c43ade0b3d678e9f148ac9cdc650e8e2d028a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448081, "uuid": "66f8e260-e6bb-41ca-aaaa-d81ad3f62f98", "value": "T1BBF401007BA0D039E1B752F4497ED3B8B92E79B05B2490CB65E51AEB5734AE0ED3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448081, "uuid": "ad57dd9a-beac-4695-9716-7462b6c6b239", "value": "927193c1aee812dc8814168f6e0fb41b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448081, "uuid": "a9a39b60-8db5-4c28-9f3a-7c51033458c7", "value": "12288:E87DQVueHm1TyTIxOWl3ckQKj97Fw/0y5LR8VUna5/nyeKmiMV0L4HZnk1tqFaM:zDa900Wwb52hh3i9L4y1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448081, "uuid": "63a7f9ac-fb94-4720-ad72-472bb2c6e200", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448081, "uuid": "a3193c34-a5f7-4715-b4a5-2265a04b7a05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448081, "uuid": "7d0150bc-f22d-455f-b0a6-5dac978d32c3", "value": "4012bc4dd89fbf7eaad5214623cbcfc27a3c014d2bffdcc76ffa5dce704b4c4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea2b00a-aeb4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648485212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648485212, "uuid": "89cd3101-94f9-4fc2-9431-1911072069e0", "comment": "Malware payload", "value": "f06f30d6c6c7a5871b50cd864c43b9c7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648485212, "uuid": "087a5d3c-845e-4e55-8c75-b2d22590fa56", "comment": "Malware payload", "value": "401d3b048b221e269475592f360fc3dae3d8dbecccedb2add0abe36f005b199c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648485212, "uuid": "60ee4b30-8e7e-4500-9620-08916be0a25c", "comment": "Malware payload", "value": "cdbdb46d415bad8222059cbca24d32ec7d85ab8d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648485212, "uuid": "f64499b3-efaf-4d79-947e-6c68fad3c560", "comment": "Malware payload", "value": "27d07bc71ebe65e0547678850bedcfea37f8d4ec9188dfbd2f01c7f4f36a62b34a0867e89704a4fb1b9cf1be4f3a4b07", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648485212, "uuid": "99c3fd6e-0c74-42ce-a5f3-e8f6183cfafc", "value": "T1A984FC7D1FAE00A2CC621770146C0FD991ABCA25BB1255FF24892E2E2EB57D74879F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648485212, "uuid": "291aade2-c038-49d7-b96a-b3bf9bb4e87b", "value": "3072:rA5pcWyfJCALTQMLOuw80g4SY0sjHyKilLGcBZj7BvUBmiO6:iKfJCALkjp1g4SbsLyKilbNUBmB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648485212, "uuid": "eca949f9-051a-4e82-9c35-cf2e236353d7", "value": 392712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648485212, "uuid": "83c0bd68-2997-419c-8035-99598013ae4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648485212, "uuid": "b7c4339a-f847-4fe2-b193-b5fccfb9a661", "value": "emotet_exe_e5_401d3b048b221e269475592f360fc3dae3d8dbecccedb2add0abe36f005b199c_2022-03-28__163326.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db1b98a1-ae75-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648458175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648458175, "uuid": "26eb3b58-ef5c-4166-bff3-6f5603d45a51", "comment": "Malware payload (AveMariaRAT)", "value": "8dbacba9aa809225aa4d5fd24cde3d38", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648458175, "uuid": "4acceb39-2f7e-48f3-8d1a-6524c52d69de", "comment": "Malware payload (AveMariaRAT)", "value": "4032c0306ba495c13714dd52791b34314abe70ef42ba31e26207e08f82a4795a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648458175, "uuid": "eb7bc592-e457-4d89-b414-9fac37ee87f6", "comment": "Malware payload (AveMariaRAT)", "value": "cc227bf9b179d5da344a7f496446c1a4b788d313", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648458175, "uuid": "60114bff-e686-4b8a-b2de-1846680d643f", "comment": "Malware payload (AveMariaRAT)", "value": "5dd8767ac1632b3da8f598be4bf081be8cc1ef3410baeb3d5bcd09f1d6babc06987cb82fb3b023e6bbce59b565f8ed9a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648458175, "uuid": "3ea6c5c7-dcf0-4cdc-b5d4-e1b81e88fb0a", "value": "T10A74235E4612C257F7A20DF01EC336138D3BB31C5D572EF3D3689572618A9A38798AD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648458175, "uuid": "c4ce1745-6ce0-41cf-bf05-6e1f72fa1c1e", "value": "6144:ev+0m0zk1BZN7gMDR+UPkArHethiHeNHxLe5hIDNf8utfHoDVRq0OouxJXV:em0m04REdakrhiGLe5KNf7op5yF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648458175, "uuid": "d4e0fe36-02c4-4e50-9621-fe0d48e81530", "value": 366166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648458175, "uuid": "0d1d0493-046c-42e2-933d-37c1f0e5150d", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648458175, "uuid": "6cee3f72-693c-422e-a80a-c7f12767e09c", "value": "Purchase order PL0028.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0184708-ae87-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648465860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465860, "uuid": "02a223e7-e3d4-4b00-a3e0-61d8ae2c27bd", "comment": "Malware payload (RedLineStealer)", "value": "8ca534c8cb138ed45270343ef75a078e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465860, "uuid": "18f75e65-de83-4a86-ab80-bfdf241b8106", "comment": "Malware payload (RedLineStealer)", "value": "40848ff57e2fb3da6ff114bfb9ea13fb559162d4528136261f4f52296b4e76c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465860, "uuid": "3743c3e9-d7c8-4131-91e7-338ac7f37169", "comment": "Malware payload (RedLineStealer)", "value": "1bb674b03f024e63446a223af5a59cd5c6b899de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465860, "uuid": "24f11796-672c-49d0-a51e-ab94f720ad16", "comment": "Malware payload (RedLineStealer)", "value": "d6a18e9b34112fe311ffb762adbd71d14bc7fac2fe3540c8ebc3100f44f9808d7afc4602f46361fccc4d68356953012a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465860, "uuid": "684ec47f-c67a-438e-9081-4d386e692dbc", "value": "T18B84CF00BB90C039E5B726F4597993B8792ABDE19B2464CB62D53BEE56307E4EC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465860, "uuid": "aa7cd57c-1452-4806-a9fe-0ee2b2febd51", "value": "62cc0f071500a34baf4b74c917ef3797", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465860, "uuid": "76466bdf-3ffd-4c1f-8a8e-3fe71979f5ac", "value": "6144:KFpfer5kqibV21uxDRgZLl98BsX6jEagbi/ddrW2J0LKus0uUcTd:wpC5kqOV21X5yKkAorW2KK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648465860, "uuid": "809e7510-606f-4f97-bd5d-aecccefaba1f", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648465860, "uuid": "d35085ca-8557-42a0-88fb-32e717d72f43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465860, "uuid": "ec1e3990-7e95-4b7c-8160-5d0351648da6", "value": "8ca534c8cb138ed45270343ef75a078e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e56f4fdc-ae68-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648452609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452609, "uuid": "ad08933f-94e8-460f-8ec7-7c09a37c8c54", "comment": "Malware payload (Formbook)", "value": "495f586c4c651c00e86ace62e4e5f4b0", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452609, "uuid": "b882cb5e-a675-40e3-be84-3853dc206cf0", "comment": "Malware payload (Formbook)", "value": "413ea66800b47b7cdd4b5ddcfac3cbb0799631ac60b4f96879f8e34ce827f4ba", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452609, "uuid": "3de9b39c-b8f1-4ea7-8fe5-ce822167d9fe", "comment": "Malware payload (Formbook)", "value": "0bfaf11ad3d55698a6cd76a69b909c4da1e633b6", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452609, "uuid": "3b4c4144-f5d5-45ed-980c-437bd98479a6", "comment": "Malware payload (Formbook)", "value": "719b5e420bff5b1a9a0b11ad1465c1c4b280d0420fffe80d4a8f8cc86f0b0d7e745800735fe87e29cd80be67324f5bc5", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452609, "uuid": "55304fdc-2ef6-4bde-8939-35549be68c2c", "value": "T1C814126F32A83942F264093DB39797ACAD1BFF0A201977703016736BFA716395879708", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452609, "uuid": "305e6abb-f6a1-4345-b601-838421e1fca2", "value": "3072:5TaoTSt+tqApCFqmBPhdTeJVtQlkBnqmSia0to0q43kmhW1kem5gmgTARQk+K7ND:lnTSEUAp8EJ7YkVpSiL043Xh7e4glELR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452609, "uuid": "4461dacb-4d35-48e1-a095-5961b79b1639", "value": 192776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452609, "uuid": "b7c3d4a6-70d8-4c84-a404-bcd5a860d25f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452609, "uuid": "3ce19476-70ba-44f8-a9f7-95ea823c0a62", "value": "Lesvin-Bestellung_457525.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74789cf5-ae56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648444688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444688, "uuid": "f597afc8-5618-4bbe-819e-ad8b076b9e6a", "comment": "Malware payload (Formbook)", "value": "0d2bc38920c4d006db1433f55e3847ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444688, "uuid": "3934c1ab-ea64-4bb0-ac5b-14ce70a17500", "comment": "Malware payload (Formbook)", "value": "41573d104263a727eca5295cd59bf91c93d2a24ddb024d84f97244bc120036e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444688, "uuid": "735cc3be-fe1f-4f10-a6f0-607e5304a638", "comment": "Malware payload (Formbook)", "value": "902fc7c03eb33119d113c1564fd878dbe17bc7cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444688, "uuid": "310eec6f-6813-4b03-8666-5b94e118798f", "comment": "Malware payload (Formbook)", "value": "57993d546a4d2a2ec4dd3bde2b3d8086b56a31b2f3c998424f612cb1c4d380613013b1dbdbc4215e00405471fe0de530", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444688, "uuid": "8209bdbb-73f3-4de8-9284-c745c3bd277c", "value": "T12F351262F34E9741D54E8BBA4462D5A10373BB9A592FC90D7CB5320E89323C35712EAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444688, "uuid": "56ee9146-da0d-44ee-8213-4ef8332e51fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444688, "uuid": "5896df19-528f-464f-bf84-da89077017f5", "value": "24576:GAHwz5sgycg0sOYUHcS5GgTniFYKT2Cb6zh+iT:GVgyYUHPxLKTXb6zh+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648444688, "uuid": "597aee67-dc8e-49a9-b750-e4dcfee07910", "value": 1086976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648444688, "uuid": "dc6ebff8-af49-469c-87a2-a78a9d5f5de7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444688, "uuid": "7260291b-806f-4948-9fd5-00aa7edb3d5d", "value": "PO#CR21-1178321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f06872f-ae72-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648456785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456785, "uuid": "ca3fc94f-4d31-42ff-8ecd-e8d1ac135b28", "comment": "Malware payload (Formbook)", "value": "64234df1b0341a5b88e8a3fad4b10287", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456785, "uuid": "70a2eead-332b-4a7b-a67f-bfd462e03b9a", "comment": "Malware payload (Formbook)", "value": "423c1a28b6e7188cd9c30db327473e6d832e099aa1d73a47642c0e6e537c2751", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456785, "uuid": "bf2a9b62-04c7-4b07-a9f3-413f527f62a8", "comment": "Malware payload (Formbook)", "value": "c34ca9f9544ecd3ef0a8787676e0f630828b6691", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456785, "uuid": "0b250053-80da-450d-96de-ff539b5646cc", "comment": "Malware payload (Formbook)", "value": "ad04e7987c299dfcf63a2b100654228681152a4f2cc8c13e4dc48c104febc4872c725c7dc550a34087b04863e79b0964", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456785, "uuid": "370299b4-4428-4c2b-92e0-40c8300284a6", "value": "T1CD2533ABC07E6D9DA6199C29F5A14BDB046182FC070548D9F0E92A7C1336EDDE3A50CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456785, "uuid": "a74ac6fe-674b-497a-87d0-9c589e4f2278", "value": "24576:lEMkDJlsbCFzjLsB0j7j7Qrs7iWYAjb49bi6nJZpEuEY:6VJ6WVsB0nowONAn4hJFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648456785, "uuid": "b1cf6599-5b9a-44da-9000-b37be9b30ea9", "value": 978690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648456785, "uuid": "4cf0e2ca-d036-48c8-b83a-f7a423c1c67b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456785, "uuid": "a7b142f5-1d43-4a69-86ac-8879266fe56e", "value": "SWIFT MT103 28032022.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92623d0-ae54-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648444052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444052, "uuid": "3c6eb6f6-5567-4ade-8d41-19357b1b25f3", "comment": "Malware payload", "value": "2912e47e0fb7c7c10da0e187c639e167", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444052, "uuid": "12f20351-1f83-480a-8438-f751b6e02371", "comment": "Malware payload", "value": "4309e98783d00d364952ce59de9891c6ba21adbbc2dead7b1a7e328ceb5f08c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444052, "uuid": "c8d62a74-f62d-4588-8219-07d90569539c", "comment": "Malware payload", "value": "b6f723106af7ec72f483c64523393b5acd729e7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444052, "uuid": "6c86bbe9-1f3e-4541-948c-1bd94d7fec54", "comment": "Malware payload", "value": "15b8b05f9c53469ad6b60a65db8e429de3b7cc68df3e1b35766960cc3672ea20d79ed7ba32419332bb838e95ae1b348c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444052, "uuid": "108a7599-c580-451a-825f-96eca0742f14", "value": "T1B703F191390C8889E67A10BA9D6D32075A301259755432F6FFCCB35DDE4CB5C3E245EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444052, "uuid": "39994b46-e5ca-4431-ac98-a3b9a9f33d9c", "value": "768:xwTv2KUk7mCTU3vyCqmxQTXVV4dm8ik85cnbcuyD7UryqL8OAfnBY1KkQ6Z:CTv2bO+Dqodm8lOcnouy8mqLMn4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648444052, "uuid": "41dbffe5-a9e5-4475-b7ea-d041c5f202b1", "value": 38704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648444052, "uuid": "cd3d811f-d277-426f-8d96-9bd0cb0b8506", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444052, "uuid": "4481158d-2328-4dff-abfa-9657ee765a8b", "value": "2912e47e0fb7c7c10da0e187c639e167", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6065783d-aecc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648495335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495335, "uuid": "6bb1b97e-c31f-408f-a9aa-a25c9f79d0de", "comment": "Malware payload", "value": "2a9b4653174973c2e72bb13f6c4d410a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495335, "uuid": "99f5d7fa-9904-4189-9693-585155514d86", "comment": "Malware payload", "value": "43cf99ef6eeef41b54212c4efc1dc64f9a783830ecc22bfd0488321702f59659", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495335, "uuid": "3a88f3f7-ef19-4e35-9e31-ee4010dbbdc0", "comment": "Malware payload", "value": "85c8713b429a7f7515256c5b6656af9f92b12571", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495335, "uuid": "c4bbe3fb-cdcd-465e-9566-406b274823b8", "comment": "Malware payload", "value": "04a8bc6a62e72e71af85d07bb9c9f2630bc903f061783851c9fd40462a605535fd30b91337cfbeba2b2f543b866ced65", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495335, "uuid": "c5a1ca76-41dc-43c5-a485-d4a21cb84b27", "value": "T151C4BF33D3F82F2BD17E53395420501537E6E746B228C689BDBA34A68572BD285B2F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495335, "uuid": "07534820-ed84-4194-8f78-472526d2776f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495335, "uuid": "1d40b2fa-8393-46cb-9a04-7756f30a3234", "value": "12288:G3xb0nQFldI/gjjkWmt4vVn+6Dx1YPi1m9AN3i9qKr9jQhuMWi:exb0nQFPI/gjj6tSyPwm9A5i9qrfWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648495335, "uuid": "316081c3-1744-4933-9614-76806471def4", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648495335, "uuid": "bffe0d64-b9c0-4929-b159-5b054157fa98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495335, "uuid": "89bf8ea1-5eee-4254-8178-d66c65af235c", "value": "Transfer Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5b1fac-aee5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648506309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506309, "uuid": "9063f912-d1bf-402f-9945-69558e72d17c", "comment": "Malware payload", "value": "97ba8c548a838699ea33c10abde92aa2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506309, "uuid": "f7a958df-f914-4975-a9ce-5ebd8de2ed91", "comment": "Malware payload", "value": "43f8e95dc801adaa285b4fbccbebc154a098ab71c83bc5cdb6fab0a2b2614976", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506309, "uuid": "dc4d5c21-cfba-4b10-a41f-4dfb185bc63d", "comment": "Malware payload", "value": "99384fc6379987c42cc2a1e98575a2450b826560", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506309, "uuid": "02c7c464-fe24-437e-8a69-563aaa0d7d9d", "comment": "Malware payload", "value": "08be43b5ac6f1ccbbb1e8fec36919dcfcfd1245558f4c0c06cea79dd756a92ed1f50275b0bda0c5915d8e2a04ff9ac3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648506309, "uuid": "a26081ce-5ff3-49e4-adde-43a4d9e97317", "value": "T147E48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514DB432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648506309, "uuid": "3703ce04-3ea8-49e3-806a-f02f2ed615ae", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648506309, "uuid": "14cb8fb4-d15e-428d-871e-e9bd6a958bab", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7AvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zKCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648506309, "uuid": "dd288241-a0da-4f78-a69f-9eba0cec6790", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648506309, "uuid": "d9ea14c5-fe3b-48ed-9c51-449468827bf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648506309, "uuid": "a42682fd-7dd2-4043-a49c-d17474263865", "value": "97ba8c548a838699ea33c10abde92aa2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e694e27-aebd-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648488916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488916, "uuid": "1cb916df-e94c-43fd-9e08-73d345fd6d99", "comment": "Malware payload (AgentTesla)", "value": "f977a0db907f3ea3c4451f7b207f6a2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488916, "uuid": "c9f54c31-363d-4b44-98d4-45891e8c28e2", "comment": "Malware payload (AgentTesla)", "value": "44ba6754c9414fd80094fce3f9323141d3dc81d80073b102cfdbcaba092d33eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488916, "uuid": "f17a12f4-30b6-4fcd-9530-9799e98e6023", "comment": "Malware payload (AgentTesla)", "value": "1b5d42154f5598862317eede31887eb47b0fdf58", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488916, "uuid": "e928ec01-8df0-445a-8213-3d1e161ac152", "comment": "Malware payload (AgentTesla)", "value": "c8429faf131615c63616aca09bd7e50069832214324a9b6a2fcacf4625c3d0eb66264596269c5d453e9bc1615d73cd19", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488916, "uuid": "2eec556c-7274-4284-9c8b-84b77e42f6e1", "value": "T1A7C4802C7E5D5A72FD1D80308D490B74FB220E0762B2A99677EB35CAA77F0F56C45888", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488916, "uuid": "9e7e07db-46b9-4b5a-b76c-ec63d2db287c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488916, "uuid": "57a79112-32a6-40b1-97fe-2e18b6fa7b21", "value": "12288:VtPoYdCDszx1/Gz4MZWMg0oXS9Y1ZgQFURMjAd6o9sK5iMDk4ftV5RY3AoHgWfwK:zJo42zxY1Zg2URiAd6o9sK5iMDk4ftVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648488916, "uuid": "b0752bfc-ecb6-42ca-b23e-45e013054e72", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648488916, "uuid": "e00cd41f-5211-4b11-853b-149f1fdda478", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488916, "uuid": "d7db5e6e-81f7-4e9f-a40f-d3dc81cb8652", "value": "MV YARA J VOY 01.2022's SHIP PARTICULAR.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6df614f-aecc-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648495534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495534, "uuid": "7d86d427-0470-407e-8d6f-5ec858df676f", "comment": "Malware payload (RedLineStealer)", "value": "82f0417b47a6a993d299cd805af9c400", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495534, "uuid": "ead96ca5-2733-4794-a425-067bb689865d", "comment": "Malware payload (RedLineStealer)", "value": "4504376c4ddef9e7d2cf767917c9718a99bba4998c982eb1354c7cf99e9d5bc3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495534, "uuid": "3d99dc40-55ca-4eee-92c1-ec4bf8fbcbd6", "comment": "Malware payload (RedLineStealer)", "value": "2d4dd0adbf093288f1444b2029107c53b9335de8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495534, "uuid": "90b2e8df-fe6a-498c-ba3c-db85d83d131d", "comment": "Malware payload (RedLineStealer)", "value": "e6dffd570954d40246c456c765c4fb2d0f0017872e120a48dc84fc637e72d10653243c2b5677c4f747b9fc2d64f94379", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495534, "uuid": "40bb27ab-c5c2-4a76-962e-e319a6b10dce", "value": "T11DC4236042C095B7EAC67A35EA769327E87043785189C03B3DC2296C7D36FA063764BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495534, "uuid": "4d2f91d9-90a7-4daf-aa80-d8c380fa3bc6", "value": "b54cfa16255f8851a9641bedce62ba66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495534, "uuid": "d83bfcfe-92f9-47ad-8689-88eaa3dd364a", "value": "12288:d3KDoXQq6r/G255WiFcFJ2O6tkNo1r51/kKGV:YlbWiFcFJ7aN5NkTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648495534, "uuid": "f3b55b44-d069-4e95-949f-46d18893c3bf", "value": 588968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648495534, "uuid": "63f10e4d-0279-494e-aa5a-0fda876657c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495534, "uuid": "bab27c0f-2633-4d89-8b8e-eb94d72209ab", "value": "82f0417b47a6a993d299cd805af9c400", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1983b0e5-ae7b-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648460427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460427, "uuid": "235e05cb-0375-4d0a-8807-c83acad2dcbf", "comment": "Malware payload (RedLineStealer)", "value": "735bfec07b163f014a4700b269b04ebc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460427, "uuid": "697b4ab1-cc07-45a6-b7d8-66001cbf33ed", "comment": "Malware payload (RedLineStealer)", "value": "45b941dec23c85e8cc53bf9f24fac3ab78bb98a30e0a9c69565a5ed566af6d47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460427, "uuid": "c4a69f86-094e-48de-8073-505cafd03ce9", "comment": "Malware payload (RedLineStealer)", "value": "28bcfc00ceb5b9bca72373b6167516b0734862fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460427, "uuid": "3f0b3f80-b5e2-4a4d-b7a1-656e15a5256f", "comment": "Malware payload (RedLineStealer)", "value": "6aadc41080a272c0a82574e5624b90ee7dc659c95c73d4e50d807a3c11b378bedeabc959d9a45c3ff4493032fcbc8738", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460427, "uuid": "7c333d93-15f0-475d-b6b4-0599e7c4a66d", "value": "T12474C000BB90D035E5F752F44A7A97AD792E7AB05B2490CB62D926EE07346F4EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460427, "uuid": "d31840cd-1ae0-413e-8323-0fef7822532a", "value": "112f301b72f7079fdf51b59676b2b142", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460427, "uuid": "77a59f10-6e0f-4a60-96f9-3890351cefc7", "value": "6144:uGx65GU+71S6lAIhNWFQymWywEfIlu90S1kv/qG7BMM8mVCuziC/b43Lo:u+U+7g6lAROymLfIR//7BMM8qL/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648460427, "uuid": "49e0e747-c791-4011-9b7b-ab1c15bafdf1", "value": 363520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648460427, "uuid": "607eac58-1ee1-42b5-ab8e-362164635d43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460427, "uuid": "40aa768b-50a1-4dca-9386-eb5491e00198", "value": "735bfec07b163f014a4700b269b04ebc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73df675d-aeec-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648509112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509112, "uuid": "7e1adfb3-cef9-4265-b733-45cff2910e40", "comment": "Malware payload (SilentBuilder)", "value": "3aee5d3b92b6a7e2c427081f3825ac4e", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509112, "uuid": "3e8d8ba0-93e5-4519-9684-a35fd2bec08e", "comment": "Malware payload (SilentBuilder)", "value": "45bf1402c481b7aafdf86b79417cb1bf9fe5d6c01bb0d39ced4a535708845227", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509112, "uuid": "ffbb1339-a244-4041-b7f7-e1883db00541", "comment": "Malware payload (SilentBuilder)", "value": "c07dad6ddf742057ab333b6582ea92c43faa6947", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509112, "uuid": "17f0fce5-a9f0-47d1-8093-217d80329401", "comment": "Malware payload (SilentBuilder)", "value": "31a619001eb8c21f59197cd55f7f84e7d95be0c6aec9a664a2f15e090cb486d1358fdc81317ad68866759980afb95ea2", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509112, "uuid": "5d74fc00-3393-48c4-851a-33472e2142fb", "value": "T1D0C3AD8BB659486DF921877488DB879A7363FC344FAB47473214F3366EB95A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509112, "uuid": "36035894-a510-42b4-be8c-900ad9918882", "value": "3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlCh:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648509112, "uuid": "eba82039-a4b9-487c-b6d3-00500bbcd0aa", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648509112, "uuid": "d964f124-22f6-45f7-b418-ca45cdc5c979", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509112, "uuid": "faf346f1-9ccd-4368-9309-983a805449e3", "value": "3aee5d3b92b6a7e2c427081f3825ac4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec74420-aedd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648502849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648502849, "uuid": "8228904c-f27b-46bb-8798-1dbaca3cd998", "comment": "Malware payload (Heodo)", "value": "603f29de0fed45e8b63d49dec8f96426", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648502849, "uuid": "f748c179-0ee2-43d3-a78b-dd696c11d27e", "comment": "Malware payload (Heodo)", "value": "45cd1ac0eeab077f4a9cdd3a57333dad3b59cfede1fc5b03a60af451449e6b30", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648502849, "uuid": "569cc3b2-6041-48b2-b72f-b0dcd618cd69", "comment": "Malware payload (Heodo)", "value": "3ebfaf4654d45f4535081033d8a90d96fb7ad551", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648502849, "uuid": "b341d32a-4baa-4962-bd48-665f4aba8441", "comment": "Malware payload (Heodo)", "value": "064a664bc7818bec5c29b37b01fcae3967208431b3eee2634f8b07bcd67357350470297b7fa423b6d3471db4aa0dd1f9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648502849, "uuid": "99e347d0-ba74-4b63-a3e2-9054a1d81a32", "value": "T19AC3AD8BB659486DF921877488DB879A7363FC344FAB47473214F3366EB95A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648502849, "uuid": "8b6ef920-7e54-4dad-8d8e-b902cda2b01c", "value": "3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlCx:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648502849, "uuid": "f041b96d-7346-4b39-9d35-f9b212a036db", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648502849, "uuid": "9d793ccd-05ec-418d-b7cf-777d260193f5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648502849, "uuid": "9eb49f47-f192-4941-91c7-ea0369f8432d", "value": "603f29de0fed45e8b63d49dec8f96426", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b2bb62-ae81-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648463258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463258, "uuid": "41217c63-296a-45b0-8416-3722ae622c4f", "comment": "Malware payload (Heodo)", "value": "b8d90b93c02528d53227bb495b5ac060", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463258, "uuid": "cbed94a4-6d70-452a-91b3-53b153d41a94", "comment": "Malware payload (Heodo)", "value": "47040f810cec06658be71b3576c7f2aa8b3bb26a77ea23cb1ee2055253e700a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463258, "uuid": "7d17f5f6-6f69-4d75-9ddf-a7050f9a7783", "comment": "Malware payload (Heodo)", "value": "6b6403d645280a356fc440367c25256010fec154", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463258, "uuid": "93406eaf-82ac-4434-8d84-3e19469ba43c", "comment": "Malware payload (Heodo)", "value": "792ea89f58efc111ca1afe3714e6b51bf64a540635ca3b3864e2d1f29a1a7c5897f6e807705d3860c59c61f0a7589e65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463258, "uuid": "f4dff8cf-48f8-4fe9-81b9-138da65d0788", "value": "T1A794CF0272D0C47AC6EF23785D239B5AA7F9FC208A75C647A751BF8D5E326C1893035A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463258, "uuid": "c06d227d-4159-483e-a6f4-4d0fc6a41911", "value": "8f8b1cb86c6697dd342b65a36c6ccbb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463258, "uuid": "24dd5511-5f25-4072-8d5a-f5ced33e3c78", "value": "12288:zwn2hR3547jpDMgyS1xpuCMS5AhugWarPU:DRJ47xjy+puCMSqumrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648463258, "uuid": "a696c1cc-745d-4e85-8894-e714fb07ece5", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648463258, "uuid": "456d0214-a9e6-44bb-b244-0b29be99d5e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463258, "uuid": "515c8b3f-193f-4dd6-a82f-8d21b57dfd04", "value": "b8d90b93c02528d53227bb495b5ac060", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19e165e-ae70-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648455984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455984, "uuid": "ab53f620-7d75-4112-bf4e-1302d464ba72", "comment": "Malware payload (AgentTesla)", "value": "3fcdb5090b69189239bb4ad4c65afd46", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455984, "uuid": "cfacf4a7-5e9f-4b21-be7b-99ad960ae03d", "comment": "Malware payload (AgentTesla)", "value": "477b1be65f859f88035ee4d07a827a7033dcf1be2de81354d75dabe5b30da246", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455984, "uuid": "4afa0ad4-22cf-4b5d-9a58-f76af1f51084", "comment": "Malware payload (AgentTesla)", "value": "79df6ec1d84c11d1c84a5e1b03e47b134149ad08", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455984, "uuid": "1580abca-3682-48b7-b992-99e01cb2ac21", "comment": "Malware payload (AgentTesla)", "value": "cd64965480df8af1842f4b5dd667159133bd68d64c93037f8ff3b8fe0723ffc6456265802dbd645aa24e7900f8c5f232", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455984, "uuid": "cb08d446-52f8-4367-8417-6cc6f0c67a63", "value": "T1EC942384364372230FAA2D9E0BC5DB83AE67DF485173D3B7F8B8A8193D52A5D3B95404", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455984, "uuid": "04c0ac66-7bbd-4418-9f5e-283bcdc23d55", "value": "12288:2EwukXEitp77oGDpglwf9zmRpv2DRVIY36a:oHXEc70GdZ9zmbv2DjIwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648455984, "uuid": "0f438b63-cbcc-45bb-ace9-2bf47dcbe018", "value": 426200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648455984, "uuid": "fd033545-8a94-4449-a723-cec37ec19485", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455984, "uuid": "1f19e068-0460-46e8-b02f-3935ce0a44b3", "value": "PURCHASE CONTRACT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b49045-ae54-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648443992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648443992, "uuid": "698dae90-a75b-4864-9444-7d27b07fa5bc", "comment": "Malware payload", "value": "c8ca4ea246ec80e4dfad90e1ad4502c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648443992, "uuid": "4d179cbb-ae31-43ec-9d97-14b11f54acea", "comment": "Malware payload", "value": "47e4112cef69e36b6f42579a0e0d44311578ea92141f113c61c60710f34351b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648443992, "uuid": "8e2037e6-51ed-452f-b430-54d8fc5627cd", "comment": "Malware payload", "value": "98b086e7f3241d90946dae38c4b9b5416702db9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648443992, "uuid": "e90163f7-5432-4556-b6ae-3508a9aec165", "comment": "Malware payload", "value": "25fa46b007c991e318b41a510c19208ff178d9760f6d615f5928bc256f1a8283b4c26bc5706c66ac75b78bc230698ace", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648443992, "uuid": "b0999a54-55b9-46c9-8575-feaebbfb92ba", "value": "T16C03E120721A6F4BD0A840344DEE7E4D2928F60ADA5995B3BB9D397339B7E143F1C9C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648443992, "uuid": "f30f6e35-4b99-4851-85a7-b9bed41b2eb3", "value": "768:SV7kSpIjecOFdZcy375sCmlZNmZBRnbcuyD7UryqHyUqpGbIFm9q:273moF0tCS3mZrnouy8mqHvWGbFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648443992, "uuid": "98280f51-d78a-4d18-9afd-2290e8e3da9a", "value": 38484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648443992, "uuid": "0f0ebd4c-71b0-4a5e-b6b3-cf93e5dc3960", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648443992, "uuid": "3fd9098a-af87-4875-87a1-7c962cb6e327", "value": "c8ca4ea246ec80e4dfad90e1ad4502c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80db6e19-ae86-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648465325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465325, "uuid": "4bedf9b4-fbc0-45f8-ab88-4a9cf00c577b", "comment": "Malware payload (AgentTesla)", "value": "b53fb22ff651bdc32f1cbd764498adb0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465325, "uuid": "7c50083d-d72b-4869-a673-0c9b79e5322b", "comment": "Malware payload (AgentTesla)", "value": "48e4ba1998da827a0836cd270936670170a8e92f7bef7febdba6fc7ab226544d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465325, "uuid": "d5d9db82-2399-4f51-b9c2-10a24ca38016", "comment": "Malware payload (AgentTesla)", "value": "8db682ca119bd1ca41a66b90fec0d52d5499221a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465325, "uuid": "719e7f30-b663-409c-99de-5e2cb9b91dda", "comment": "Malware payload (AgentTesla)", "value": "9fc10450a9dca9c24c81a70b39e721ceb82de7a29bdc7a93e697c0037c6f56aa3443b253da0823ada04656156689e196", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465325, "uuid": "9b7b4051-44bd-4cf2-8898-641d520a067d", "value": "T175E4E5ADB2F075EFC86BC175D9681C68BA907CA7930B4103902731A99A7D997CF143F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465325, "uuid": "bcde3592-f3cf-4fb9-a017-8b786658d07b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465325, "uuid": "2ed5f80f-129b-40bf-9b9f-a21b082149ff", "value": "12288:UQXtV+wK/K8sZwEb2qZ5Y8gVwFHE6YMMpAjdDbewzrimciin0ejYGjIoMvvaB1L1:UQXtu/OZvb2qE8x9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648465325, "uuid": "7abce662-974d-4429-9138-47d847c47b66", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648465325, "uuid": "ecf430ff-f104-4f79-995f-d86dfdc9e545", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465325, "uuid": "f2650cad-988e-4467-af39-2baec60318c6", "value": "#028320221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b588d63f-ae50-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648442220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648442220, "uuid": "6284da92-5d4c-44ad-b5b8-19d1817b2f8d", "comment": "Malware payload (AgentTesla)", "value": "0a73c34124d3cbf396c5fe40591e3ca6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648442220, "uuid": "50705276-d200-4e64-9c67-cd3b13ca379a", "comment": "Malware payload (AgentTesla)", "value": "4977a09ebb1788f7831befadca860114d11ede9a28f65be03de3ad08057e4efc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648442220, "uuid": "1552d27e-6e67-4fbc-bba9-c02cd82b7343", "comment": "Malware payload (AgentTesla)", "value": "3c68777027a7f875a3765982df035ba52b3fe29a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648442220, "uuid": "09df8cd5-9fc1-4c4f-9ddc-63598b0d355b", "comment": "Malware payload (AgentTesla)", "value": "8f9091f36f20f648273acec5104ea093dceb40f4364375a72286e48c67fab5eb4db91434822108893ed93c481fc255fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648442220, "uuid": "57df7054-1d7b-4fd1-98af-f42693865889", "value": "T1F7E4D6ADB2F075EFC86BC176DA981C68BA507C67930B4103902731AD9A7D987DF143B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648442220, "uuid": "11e1a97a-1226-428c-9b11-388c23e48ecb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648442220, "uuid": "9dde73b2-685b-4a71-b654-ffa984ef982e", "value": "12288:afXtfIzuuYzrcVRgI8ObWnJEno77HDo/6zXNzIxwXJOjOqqxLG/arGCZa/EEjLfB:afXtQzWzrccNObWnyo7n0JAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648442220, "uuid": "de81e9f1-b041-4560-9664-83a216a96d06", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648442220, "uuid": "ee3192d7-0bb6-41fb-ab1d-60fe7166038e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648442220, "uuid": "5e5e5ed9-d80d-4f48-a634-9b80aaa7371e", "value": "Transfer Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4157f44-ae54-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648444043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444043, "uuid": "e1157333-b184-4717-8f4a-00c928a98ff1", "comment": "Malware payload", "value": "284249f0cd4c6d6b67b26e0ae8d50701", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444043, "uuid": "26eecdca-ef27-4ee8-86c4-86dffad34c59", "comment": "Malware payload", "value": "49d488bc87fa1a5339eed857aa44df4e862053a43dd357dff28f395973fa360a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444043, "uuid": "c6397705-07b6-49ce-a1ec-fece5a054469", "comment": "Malware payload", "value": "212e3bd1449676313f800a3f0a8cbf111eab5788", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444043, "uuid": "1d99d51b-f42b-43b8-ab49-e44bd5599b4a", "comment": "Malware payload", "value": "f25751c29d62516ebd144a0dd797e26cc49c0a3d18b6d05de4f74421b6656fb4894950aba107d30f99725a8aa4fb4b33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444043, "uuid": "3452a5bd-2a87-4624-b6e9-13be7a8481c0", "value": "T1BAA32996B900EFB6F40EE77604D34B247270FFA55E93163273173966AE362D42826F05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444043, "uuid": "3af5774b-0b21-4074-a72a-25eb9b5baf96", "value": "3072:1bbqH2wklpIALfAvgyditUkmm/Npbxs1n6KNH:1nwspIAVydaUkmm/Npbxs1n6KNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648444043, "uuid": "8d0fdae6-c46c-48a5-b70c-a17fd4032258", "value": 101545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648444043, "uuid": "26c702ce-b728-4daa-a420-9828c4c57a56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444043, "uuid": "c70c1b70-907e-4a7e-a0c0-47bc72c7a275", "value": "284249f0cd4c6d6b67b26e0ae8d50701", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6984698f-ae98-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1648473017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473017, "uuid": "bac3b9ea-7815-419a-8ca3-a14d8db8c3e8", "comment": "Malware payload (Gozi)", "value": "194b342f849f0708e8ed04f9883f877c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473017, "uuid": "11374442-b7be-4d0c-b1cf-c813e68a09c4", "comment": "Malware payload (Gozi)", "value": "4aaafcfe9e950af7737d152eb57bb4e5064303e8ba8a8d80a312c447c1e3366e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473017, "uuid": "ada13cc8-9522-4b1f-a86a-55f1f5a3ba5c", "comment": "Malware payload (Gozi)", "value": "8608f165d682cf66a551f2e11a9fef3f6b8ddfa4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473017, "uuid": "65edfa31-8b4b-4546-9cc2-89c29d579551", "comment": "Malware payload (Gozi)", "value": "7570e6f007a72f5d0af72cc276cc570860a8d1f9a2490839d7ea591b24e1ee203a03a944d3f84b8a26a36e1e40b20d0f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473017, "uuid": "eacb87b4-db70-4f77-8bd6-d6721d586aaa", "value": "T17705AE53F3E640BEC0AB9170CA52671BEBF1B80A0634D74B57D49EE62F13B61662E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473017, "uuid": "4025b609-3034-4923-8879-91cec14be91d", "value": "01495127076c2d65bb18eb4377d8d21e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473017, "uuid": "94d012ae-4584-4d1a-b8f0-41c031965b9c", "value": "24576:jKMVxxeDTQo4HkgQJ7Q5Ew5meTzmMUPfkjCGFGI:jKoHeDTQoyQK59YsmMufr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648473017, "uuid": "d3f8f7ea-6207-4cb5-a1a8-a28d779e2ffb", "value": 820136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648473017, "uuid": "13be20d6-da5a-4238-8c34-18eadabf1241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473017, "uuid": "e24e2507-fce8-426e-a1d3-29f6c0882a2f", "value": "11f38c58.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53af6566-aebd-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648488871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488871, "uuid": "cc27c178-f773-471d-b5ec-9c879ebaf7c8", "comment": "Malware payload (AveMariaRAT)", "value": "66bb0eca9f64b66f6320cc96afa04345", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488871, "uuid": "6a6e60e4-3be5-4a2b-809f-4e0f35f2d4b1", "comment": "Malware payload (AveMariaRAT)", "value": "4abd870d8eb2906d9078054500da763598f720b23d21b97cececb3829a4a06c7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488871, "uuid": "9a5b62ef-8efb-4455-b0b0-5b011d7020dd", "comment": "Malware payload (AveMariaRAT)", "value": "1c1c607679ae85e076aaeccce198b38c44e0f3ee", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488871, "uuid": "f899ddfc-e682-4a5a-9970-c97991c7962f", "comment": "Malware payload (AveMariaRAT)", "value": "d07eb1f50c96c3ae7ecce438a3972e41df733058df03dc584c573169a75f1759d77b2ff159f61ad5ad21c5907e559c5c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488871, "uuid": "a97456bf-92c8-4909-91d8-289b78b04b17", "value": "T11E45029436038230D469B73B8855D5A44676EC48BE32D52C30B43F7D37BA7A2ED1F62A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488871, "uuid": "1e95bbfc-798d-4eda-b61a-0fbfee607333", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488871, "uuid": "2dcf4f05-2c1b-4692-97d9-0eefaf90bf13", "value": "12288:D6Ovm9Z6Jp0+uqJZg5VVyesYq9qeJAovbzIVakIROTYfqG6TCNDZPoHj6Y1m7h0F:jO9Cp9u+Z4VVAqUIcSG6GJZPaeYw9UB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648488871, "uuid": "489dacb5-50d6-4bef-a532-2c7df749ec3f", "value": 1166848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648488871, "uuid": "6fa9dda2-98e8-45ad-8f56-ac08dc5bb31d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488871, "uuid": "73b4065c-ffe5-41bb-9f9d-b2a9edf6e8f6", "value": "Notice of Arrival for MSC BL MEDULJ067077MSC TARA IIIHE211R.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0657e8c-ae5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447876, "uuid": "c51aaaf0-5290-45a1-8d2c-0d8045f4f5dc", "comment": "Malware payload (Stop)", "value": "ddc2951aaf377bbdcccfd1f442381b64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447876, "uuid": "ebc5492a-1832-4059-8269-cb4f413d2daf", "comment": "Malware payload (Stop)", "value": "4ac627edcfe5ca3343698c0d2beba2b8a47f343fff876dd3f15c8b386eae25c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447876, "uuid": "55660c57-f541-4769-b315-7a58c8985833", "comment": "Malware payload (Stop)", "value": "5c31d0f28ff37faa3f2f51317811d7e5358aee52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447876, "uuid": "6f33df07-5f00-4dda-b650-c5da8e4d32c1", "comment": "Malware payload (Stop)", "value": "16a22c3c6458fed4ee6dda6284d72b189094aeb2ca42ce93eb0a9679ae3b37a97023f8118cbf40fca4210caf98ee3661", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447876, "uuid": "07e8de7f-ff65-4253-8216-bdbd3051083a", "value": "T198F42322B1D2D533F805303564AEC9121FFF67BA66A1294B5AD80ABD2F317D136B2347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447876, "uuid": "358d9982-aaa8-4ada-9b19-1d5596a8e50e", "value": "ed1b2792ced7a8e7bb849a84d01e5fcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447876, "uuid": "16b127ea-f4bb-47f5-b079-4ff38ad949f2", "value": "12288:th1mzN8aMM1fC+iC85hrmwjS/7YqRoh0Ud/fjmLmdsMM:th1+8hifC9hm6S/kqRE0QbmLZMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447876, "uuid": "708a20f1-bce5-455d-acab-3f431b13f761", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447876, "uuid": "aa5543dd-0437-45cd-ad83-68461692ad6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447876, "uuid": "cd0606d2-b05a-4337-a78c-3fdfbff4cc80", "value": "4ac627edcfe5ca3343698c0d2beba2b8a47f343fff876dd3f15c8b386eae25c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83d0828-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648448291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448291, "uuid": "23767fb2-0ddd-4dd2-a2b3-1a43abc653d4", "comment": "Malware payload (NanoCore)", "value": "c49fc4ddefbb1e558a5f97c84011878c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448291, "uuid": "49b19595-8c1c-4f5a-bdca-cdc18bb585cf", "comment": "Malware payload (NanoCore)", "value": "4b355893056f9a6bb68141cd7418de6a44db31c182ef73aff6319804c3d3f507", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448291, "uuid": "3d17c880-eb9d-4a85-a728-f8b27f752323", "comment": "Malware payload (NanoCore)", "value": "9721c8c7ec08f71ad3349cf5747e531a4bff4335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448291, "uuid": "428efcc5-71d9-471b-8aaf-f961c2839bdd", "comment": "Malware payload (NanoCore)", "value": "7ed4beeb3d7ccbe8aaae137823fec7b150a8e4461395da87a38ec916fcd3713af8cf8d48b0132cf1b5d0b8acc1a829ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448291, "uuid": "8959f007-d957-44ec-845e-a9d78920b387", "value": "T14BD4E176D3F8BF1BE17D87355420882E3EF1CC86F904D806EEAA31E59972B918651B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448291, "uuid": "103e4adf-f63a-43c2-a830-588bace69f79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448291, "uuid": "f8497c0b-1dcd-48d9-979f-197703e39246", "value": "12288:wkzdQqXtftPQQwpAi9nr/tBCdJ89GqB9yal0SKzPPx:wGRXtfx0Ai9n6r89GqBwSKzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448291, "uuid": "8bf464ef-47aa-44b5-b9c3-6aa1283e4c4a", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448291, "uuid": "a72dd361-1392-488d-bea9-231c5a6950eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448291, "uuid": "c0ba11af-2743-452e-900d-575318b6aa33", "value": "VDEBlrTeZpZQn6v.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ea26e1-aed8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648500446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500446, "uuid": "0c1e7738-47d0-4d79-adaf-98f2fadaeba2", "comment": "Malware payload", "value": "7dce4d254ababc9a52a32e6b0df8de21", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500446, "uuid": "21ddadc8-ee65-41c5-8e56-9633051a4422", "comment": "Malware payload", "value": "4bfbce3ccaf9a03b5c6ef8231076103a5072c7168c895d88b7e960dc0725194a", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500446, "uuid": "e57600d3-0109-41ff-a1e3-a933a2f06f93", "comment": "Malware payload", "value": "39125df980f4f77f618be2e32fd0a9b5ff712b4a", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500446, "uuid": "7f90fbaa-6dc5-466e-a4e8-b736c26636cf", "comment": "Malware payload", "value": "ad3e646144884f5d51d845656f53ae8b0ad4b2ac562981582719399d4b819472914b427f28bf163c65c901da81b224f2", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500446, "uuid": "6974ab93-fb13-42db-9562-7b73bcebe5d6", "value": "T1A101D0F1687941A94B78D267F5377A17A630C1D520C2E3FC50CE464DA7E0068CF607D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500446, "uuid": "b3d31653-d096-4c30-9f84-a343693cbf24", "value": "12:x3voQByxH5QwMO76T/esFskSX7M9DgwgegGSRrF7tdgwA4qkz6gtC:x3QUyt5QwMI6TeKFk7ltbdhtWwF6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648500446, "uuid": "b1e51e5c-7b48-4587-8dd9-c770fdc8ea5c", "value": 770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648500446, "uuid": "eb40619b-a720-45dc-b970-c1c2492c2753", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500446, "uuid": "c45a9964-9295-4ff6-bb01-e4cc9fd40c1e", "value": "18Ggc8EE.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cc7656f-ae7b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648460432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460432, "uuid": "999da105-0f44-4a94-a543-06d7f474599b", "comment": "Malware payload (Heodo)", "value": "d5d22047746866d1562db23749f3b2e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460432, "uuid": "965a2236-bb75-4bb3-a5e0-7b236275ff05", "comment": "Malware payload (Heodo)", "value": "4c08932eb19c35f92b76baded12aee1db94e97a66d9dcb2fbe88adc11b28f728", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460432, "uuid": "38e60f30-279f-4be2-b78b-006c45216ccc", "comment": "Malware payload (Heodo)", "value": "5fcaa1a7caa9e2e0c7f9fe1942404dbb8ffbfbfa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460432, "uuid": "76e5ae5f-0767-46b8-9a33-81ecd3199987", "comment": "Malware payload (Heodo)", "value": "4914cbc734dce667af4ba14cc955feb232ea5c392d3890919835b4524eda288943f039234803a93aa0da31a9dd92cede", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460432, "uuid": "9440e064-9c73-4c73-a542-05d3f1d393da", "value": "T1F994CF0272D0C47AC6EF23785D239B5AA7F9FC208A75C647A751BF8D5E326C1893035A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460432, "uuid": "848e9e67-e352-44f5-ac58-571c19f5b2fd", "value": "8f8b1cb86c6697dd342b65a36c6ccbb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460432, "uuid": "cf4db1e0-5982-4998-b05f-9d7a5ff63171", "value": "12288:zwn2hR3547jpDMgySYxpuCMS5AhugWarPU:DRJ47xjyvpuCMSqumrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648460432, "uuid": "221cb2a0-a843-4ac6-9b2c-ae77198cb9bb", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648460432, "uuid": "9029e6ad-2155-4bec-ae7f-0ffcc840a87f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460432, "uuid": "e2bc74df-80d1-413e-9414-ed86c2649c6b", "value": "d5d22047746866d1562db23749f3b2e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07fcad5c-ae3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648433769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433769, "uuid": "444783a8-9538-4e76-b193-863469da5763", "comment": "Malware payload (RedLineStealer)", "value": "521a826ab419588ed5706c014abe36ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433769, "uuid": "51a695a2-c837-4fe8-b450-e4426463f7bf", "comment": "Malware payload (RedLineStealer)", "value": "4c5d8d4835688b21d071c4b10e341b3224afbd09561ce201d4ce735588afb9ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433769, "uuid": "f366e086-7d97-4271-b8ee-e8040dfc4b79", "comment": "Malware payload (RedLineStealer)", "value": "89ff6b9864c3211a10b73e42a817a62c480950d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433769, "uuid": "82726b5a-d384-4a91-aabb-1676a5ae344f", "comment": "Malware payload (RedLineStealer)", "value": "97fbf327b148d1525e2fa696e57b546e118be5ce26fc5fcb6ac49f499f56ad678cdf02277dd8ddba974fb9b154abff4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433769, "uuid": "d33ef7c9-63b0-46bf-97c0-259691e2de7b", "value": "T18874C000B790D035E5F721F44A7AD3A8B93E7EA06B2494CB22D52BEE16346E4ED31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433769, "uuid": "aba2b690-43f6-43a6-a402-c0601fcd01ec", "value": "de2a87646cc33f42cff0f6e99f12662e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433769, "uuid": "7c967a67-15b8-4452-b9d6-3fa0dfadc544", "value": "6144:Y5g5giE3AEh/OUdMtFkyJVxWQ2F97J7Z70GxhyBZFVeZ3YUgA2NDs2eo:YbiE3r/OfayJVil7l0GxhyBZPuIUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648433769, "uuid": "fe1ea4a8-c214-422a-a187-a6da48a0af48", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648433769, "uuid": "0248058d-3a75-4e76-b164-f30d66d0f802", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433769, "uuid": "63318339-677d-4532-8024-fa1c6d5991e2", "value": "4c5d8d4835688b21d071c4b10e341b3224afbd09561ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb9ee9a-aec0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648490229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490229, "uuid": "94788828-0901-4d83-9479-efdf90658075", "comment": "Malware payload (Formbook)", "value": "c9cef7e3e7bbcbe804973aeb487add31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490229, "uuid": "5538ab99-6253-45ca-aefa-ee049c0b7920", "comment": "Malware payload (Formbook)", "value": "4c5eee39e7f6b838db6cb44b06d0cc88dc1be7323aa2802676f0fc7e1d57b1fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490229, "uuid": "0f3401ea-2988-430a-b10f-fee803b1551b", "comment": "Malware payload (Formbook)", "value": "3c4f889c58115f0a12b15c212a7d058569aed619", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490229, "uuid": "78aa5e65-ec37-4ef2-9a1f-c8a01b8560b8", "comment": "Malware payload (Formbook)", "value": "21c4348fd0449f4e0dc3d2b66f97ea078c13c710c480e3cf5ef2abf8feb3f40f1e042ac78ae65123e383bffd7303dbd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490229, "uuid": "69432e7e-7b7d-4b70-9a57-c72447028a6b", "value": "T11964120BB9911AB3F5D9053406323B6B9BF634EF05912F0B33583DBA5A56A8F843748D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490229, "uuid": "dd75238a-9bcd-477d-8e97-e33f56876c07", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490229, "uuid": "b416b678-b81d-4dd4-964a-af403a53b30d", "value": "6144:jGicjtfjfEwNL04qaBrHOmcZlphk2XU3VWD47C2Sv5h37YtUPPGN55nVUz:gtoxIFu7Vhk2XoMMW2qh37YtZN1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648490229, "uuid": "37a6c22a-cf96-4b24-b07c-c07b6f93eb81", "value": 330160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648490229, "uuid": "57cdbdeb-c59b-4b2f-8806-aef2976ab1cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490229, "uuid": "ae622a7b-304e-430a-aca4-d1655fd36eda", "value": "Enquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7254d0-ae9d-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1648475115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648475115, "uuid": "805de3b0-9f14-438f-8b42-4fb95030c889", "comment": "Malware payload (RemcosRAT)", "value": "c117fc510ec6063462aa104278f9f476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648475115, "uuid": "f89ff3a3-66c0-42dc-9d28-bc6b0df13419", "comment": "Malware payload (RemcosRAT)", "value": "4ce893ef0bd7abeb769c3c3e57863700f41882befbee770733f0da86e015e7cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648475115, "uuid": "ff540abc-472f-4f1f-83e4-6a0e5d6ff39d", "comment": "Malware payload (RemcosRAT)", "value": "049e06c3cc0adb6819cca90d371d00b1d0b8ce74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648475115, "uuid": "a2db1758-850e-4d9c-9f7d-031d509277ea", "comment": "Malware payload (RemcosRAT)", "value": "a2904829b3d432d1d07f1b5bde33823ba353e00fe800fab7e8d93a7e111f57dbf839467b52bd9e41687b983a962545ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648475115, "uuid": "ff4a7379-ac0d-443c-9311-d5b53953dc62", "value": "T103058F2EB3919477C1731A748D5BA379E926BE002E14B94B67FD2C8C9F7A34074252E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648475115, "uuid": "5f80343c-e070-4024-8053-37b252ad723e", "value": "e75c5003acd7e864dc3f6d27d565ffbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648475115, "uuid": "83361546-3b86-4bbe-8154-fd32015d62df", "value": "24576:nQeAdfvmxCKnOwj4XIiKDyyeagCGVPdCLHO/s:nh6WsaUVPdCLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648475115, "uuid": "9f11230c-e25b-4e4f-88c9-026c8b46b555", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648475115, "uuid": "e96a90b2-046c-45d2-a292-dc7378fce88d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648475115, "uuid": "ed1baae9-e5ad-428d-a7bc-4fbfbe8d0121", "value": "Waybill.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087ec555-ae55-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648444077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444077, "uuid": "155b7dd9-1f92-4d0c-9580-23480bf4c243", "comment": "Malware payload", "value": "55b139f8c44e88c18c4dc6435bdbca58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444077, "uuid": "041abebf-d186-4dcc-ac0d-d0823056a909", "comment": "Malware payload", "value": "4d4aee64fb7c5fb84cfde13b687e3605bddfd5a1ccbee92155132bf1966796f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444077, "uuid": "11fb87ad-9f6f-444d-a7dd-b8b540ff2c88", "comment": "Malware payload", "value": "c6115f3813708986f786379fe253af2f931da54d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444077, "uuid": "d8f869b9-81b8-43bb-a0b7-c96bf5c0b5c5", "comment": "Malware payload", "value": "6a06d5f2715a1fcf01fd6f6a6fc49a6c5b817bbb76fbd160b7de8bf031f2f6b6cb9594f332adef5f6afc16b0080423bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444077, "uuid": "95f92925-b1ec-4be5-874f-ab2d5488aba6", "value": "T19223F172F0884862EDF43671EE784642E7E7A4B8995F7693363968206ED13D01FF09C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444077, "uuid": "4bdad7d0-260b-401a-95b0-cd4259d39e24", "value": "768:k5yr+Nx4N6oQ9gW4LdSsgZ1ppi7rZB/GhuvE4c2uq3U7LS6SnR6UL40VEgr:B64c70LdtipSrjsuvLc26e6SnRrk0V7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648444077, "uuid": "6478998e-e1fa-48a1-8568-0376d192d7be", "value": 47024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648444077, "uuid": "4df78ef8-c72c-475a-8981-9c17f020aa8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444077, "uuid": "cfe63e88-8246-4c79-add7-caff284b49d8", "value": "55b139f8c44e88c18c4dc6435bdbca58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16e0499-ae7b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648460682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460682, "uuid": "b7148009-6885-4a57-ae2b-8916efd1b057", "comment": "Malware payload", "value": "8e3e276e650e6ea21bea16c8c2f3e8c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460682, "uuid": "693624b1-8ee4-482b-b895-a60640159493", "comment": "Malware payload", "value": "4dcae1bddfc3e2cb98eae84e86fb58ec14ea6ef00778ac5974c4ec526d3da31f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460682, "uuid": "92fa49a9-2605-4d0c-a742-c23b6e5af2c1", "comment": "Malware payload", "value": "e483074bbe5e41cacbe081f290d7e6b0c3184c7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460682, "uuid": "17024b87-77a7-4caf-a8f1-31e6be38c615", "comment": "Malware payload", "value": "8ad1862e5db2a46c2b84746e7fcce4e37dab14ef2de4774d2f1dabca663d9f65cef092d14aba626199a647f3205ec0bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460682, "uuid": "66d33d9f-4ea2-4578-b609-6c847136abb0", "value": "T188622F0F9361CE3DC89CE2728ECB85316273E174B771031F1E64A6B62D932598A3A955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460682, "uuid": "ea5d499e-5216-40cf-a072-d9e2575cf840", "value": "384:ydtOQtZn0kc0sE8Xvn/3PHfXvn/3PHfXvnr70/i:SI00kc0sE8Xvn/3PHfXvn/3PHfXvnrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648460682, "uuid": "299d2156-0fa4-4b9b-bc80-14a9e176d9ac", "value": 14688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648460682, "uuid": "ff4c6750-6542-448f-9259-64dd61d7e96d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460682, "uuid": "f603c76b-8478-4881-b6ca-6a2411f3c529", "value": "slb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6d5add-ae48-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648438873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648438873, "uuid": "6fb23c73-ffeb-43a1-a43d-e4980018defe", "comment": "Malware payload (RedLineStealer)", "value": "a10990eddd91d6c0b537366b04f5b372", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648438873, "uuid": "adab4726-e9b8-4755-aeff-f825778c5c69", "comment": "Malware payload (RedLineStealer)", "value": "4dcd84003dc7b4d627193ce18034c71a3ee35980495d755d9bcf80a672eb544e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648438873, "uuid": "010dc097-efb5-44d2-8754-b33592a16d2c", "comment": "Malware payload (RedLineStealer)", "value": "7122989cd27ef05eccf90113f1b9b4b1e9c86b1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648438873, "uuid": "9f096ca6-6fdf-431a-9ef9-04386f380887", "comment": "Malware payload (RedLineStealer)", "value": "59df2522f87a5458cee76f4d44bc99bf9023f84693fa450cb2d99404668452f67f214acccaed7254e60662e219bb5c01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648438873, "uuid": "9d1a2503-f2ee-4024-9928-f4a97eb2c60d", "value": "T1999533D4AC428809F8728133DD953D8C23892DE867D3311BCA67A5233F1F8F695F59A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648438873, "uuid": "7dfefdfc-c49e-400a-8b0a-d8dfced30f26", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648438873, "uuid": "a0ab82a1-534a-41dd-9e12-f27d8c8d4cf1", "value": "24576:dUOriZ32DNgIpA9z+6cmXKBsayPsdpHmvcxn6RIMDZUkGno5LoFZiBUGRggKOByZ:QZqX6cRyRvKyD2jnoVKiBhRg1O4l2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648438873, "uuid": "1e1ed400-42bc-430a-9d87-8c91cf9ed619", "value": 1969152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648438873, "uuid": "e5f4d7e5-7f83-4e16-bcf6-84a35ccb984c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648438873, "uuid": "2a8d47c7-ff89-4b52-9385-b9f75aa7bd82", "value": "a10990eddd91d6c0b537366b04f5b372.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3eaa4cc-ae69-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1648452982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452982, "uuid": "4f5563f4-2c8a-49c3-ad31-d201f42f9c79", "comment": "Malware payload (RemcosRAT)", "value": "2f4fe901f2ff20f2c96fd3ae051f9304", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452982, "uuid": "9492cd9a-1c7e-488b-95d4-29b93747f8a6", "comment": "Malware payload (RemcosRAT)", "value": "4de488a1fdffc0fa9e755137bd359a9ad5fc5eb57c518681f00f60881d775e0d", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452982, "uuid": "0d052970-0d4f-4c52-9c74-99677b104d70", "comment": "Malware payload (RemcosRAT)", "value": "02b0a17ab34bea81367dc2277f1cec07314e9c49", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452982, "uuid": "c548d02c-358b-4a12-b8d8-f3295cc891f8", "comment": "Malware payload (RemcosRAT)", "value": "74afbbe1292b679569f1cd63e4b5dccb4b65e22ec683335e8f5ba2133c4966a39a2c45fdd021f975dfb42239f0a7082b", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452982, "uuid": "6373be8c-bcad-4a92-981b-ce5a09e76ef0", "value": "T15651329D748BB468212B6FB3EC2B084DEA728783B2BD56853D09C5C9DD3516CD2C495C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452982, "uuid": "3a850f06-33ec-4abd-94d7-959fc5efd934", "value": "48:pMtIP5Kp4Qp9FyBGGASjeJe1rSq0ePWVHTYe18T0BdK:eUk44FwGGzeJe1rSqjed78Tf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452982, "uuid": "53cfa2d2-6cf4-4c36-95b7-fff3f3b45f67", "value": 2685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452982, "uuid": "9c189cf6-ad03-4b37-bbf2-0795dc94d266", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452982, "uuid": "20129cfa-cb63-4c59-8f37-82cac4b3c110", "value": "Shipping Documents.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d244a6-ae5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447880, "uuid": "003fe557-67e5-4d81-98eb-07182af878f0", "comment": "Malware payload (Stop)", "value": "9dda734cbe591d562dbdef983cf24955", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447880, "uuid": "d0272bd0-24a3-4b2d-b030-39e6494d0d4b", "comment": "Malware payload (Stop)", "value": "4e6e0305aa0332bf6a2e88eb9b260630f7d32f957c49cbc00f8ce3fbbc0343ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447880, "uuid": "85c9f64c-455b-4245-a2ac-b5585a61db8c", "comment": "Malware payload (Stop)", "value": "a762f264caad39a2712914ce509650739dea9157", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447880, "uuid": "7f25bca1-ca5a-45f4-85e6-aa781008c819", "comment": "Malware payload (Stop)", "value": "3bee001f8dc58543b2f23e29df5d4813ed76e60b80c138ebbc19295ab7a2a17a7b6be6c11d63cfd997b73338fd104ba2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447880, "uuid": "654021d8-1ac9-4901-a5c3-36778f2d60f6", "value": "T141F423036FD1BCB8C89093F6B9D587F3217AA6720276ECC3A64907580FB51D6A1E9347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447880, "uuid": "7f2e23ea-0e53-4a8e-9a3e-f5218ee60fcb", "value": "735da9a9481485b877f3f63ad0c0f935", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447880, "uuid": "35b2a2ef-a21c-4731-b9a6-7a917414311d", "value": "12288:UBtynse2tSfK5Oy7/8R2Ni3g1L1tnaoV0tTLUbZL8T97W9wb/QVu:UXynseySGOypNRriEF8T1Nb/QVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447880, "uuid": "88f86276-c714-4462-b1ad-bc8739a6a0f5", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447880, "uuid": "811998c2-4dc6-476d-8f1e-9c56bd7e4f6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447880, "uuid": "83452228-d16c-43f7-aec0-1b4626f206d5", "value": "4e6e0305aa0332bf6a2e88eb9b260630f7d32f957c49cbc00f8ce3fbbc0343ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094f8135-ae7c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648460829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460829, "uuid": "5869c108-04c7-43a7-9fbc-4f4c2dccf906", "comment": "Malware payload (Loki)", "value": "a8cf7da6c7369c144834ab70f7c66ddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460829, "uuid": "33ba1367-fa80-4d65-8d65-5d8e9ba9afe6", "comment": "Malware payload (Loki)", "value": "4e7dbf896967ae2b896187625ec0e112e26a797c6f5a42e44fb55cf633cdfea0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460829, "uuid": "f846ba05-a6b4-4625-8107-d495a3d5148c", "comment": "Malware payload (Loki)", "value": "736e2b7bb1ca202b335eeb9cdd41bac8ad9217bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460829, "uuid": "5428bf11-52ea-4596-a122-36189d08ef5b", "comment": "Malware payload (Loki)", "value": "e65d1e3749f5f2fb31b89508efebe9d97793f7ab1e6791e867b8de995be892acc93fe3eff3b4202dbb6f26043497cf11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460829, "uuid": "8083cf62-c65e-4545-aa2a-0891703d0f52", "value": "T1C9E45A59DE815B52FE355FF0793A58BC69280E238E23D38A616A22F205F363CD5F0D94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460829, "uuid": "c0cc5273-a43b-4628-89b1-ece5e76f7857", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460829, "uuid": "87c9517b-23ed-48b4-b702-5ce416918806", "value": "12288:PfgTWsQg2oF5A5+gGywkptZWmV3wQfVuC5ZLlb5Nu0Q9Z2l+zA330PI:P4Wsx2ozAsN0W83wQfVuCZLlbu0QfPAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648460829, "uuid": "1a88dcb4-8470-4d16-91f6-f6612be8bab3", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648460829, "uuid": "1ce656f4-8b52-42a3-bf32-d579cd77bbff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460829, "uuid": "ca2c1b43-15a1-4008-a9b9-a181bda49cb8", "value": "SOA.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5e7a98-ae98-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648472999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648472999, "uuid": "5550c6d7-749d-4e45-9416-834f21ba1e8a", "comment": "Malware payload", "value": "4bd00be7005bd8649f94c7a0cc7b40c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648472999, "uuid": "a96b4f23-3949-46cf-8265-528f9e372cb7", "comment": "Malware payload", "value": "4f230cfd564bcfc7d9069e0bee61c5f11163f1400fafecb32c65fcf5c38e62c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648472999, "uuid": "a9d381e2-0cec-4842-89e4-422bc345686e", "comment": "Malware payload", "value": "1542546d239f2b3446a8468210d64bda21ef7bf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648472999, "uuid": "1401132a-763c-4d91-b8ab-c612e6c819f3", "comment": "Malware payload", "value": "8ef7ec5504f2db481d10d266ef7a3ca3290bc215e266cae67aee0ebc6c4957f93ff03aa38f7ca3311196dc52226373dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648472999, "uuid": "9794f059-f4d1-4eab-a49c-b6c98e36e6f9", "value": "T13FA48C9BF3A541BDD0AFC575CE52961BEBB1B84A1234D34B42D0CBA62F13B72661E310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648472999, "uuid": "07dd6b92-0494-4251-9494-a033046d276a", "value": "6144:umVtjA9X1u1kjIo71pnAtuETnsMZ+aBekhihU4i0emAkp6ShZopLRW+WE+enxpi:Z+3jN71h4HTDZ+QeiitizcLZopLR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648472999, "uuid": "c6624452-a665-4269-ac88-43cb770d2951", "value": 482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648472999, "uuid": "4f15d03b-9c30-4df1-ac0c-8f3ba48e5ab1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648472999, "uuid": "1c8eafd7-6482-4ca4-8f19-fd06897bf740", "value": "11980000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb7de7f-ae54-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648444029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444029, "uuid": "c4e4af32-6d95-43c6-8d61-947d4658bb8f", "comment": "Malware payload", "value": "3c1bafffdc66f0839a1ae0aa68c17dca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444029, "uuid": "1cc3d606-2ca1-42f8-98b6-2aa15e147cb3", "comment": "Malware payload", "value": "4f67791b0d81dc7be5aa7101b4f5d139d46621ed12fa6e5d56d4171461a7f144", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444029, "uuid": "5c4f4240-bef2-4844-b329-b9e8f75ea720", "comment": "Malware payload", "value": "cc3f8c0a64ff52c273a79b6c30432ac47d46abe2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444029, "uuid": "c683336e-4dda-4b2d-ba2e-035adc3cf2c8", "comment": "Malware payload", "value": "8362fc99015d8cbec69796efbb57c6f4dd00743e2ab7603cfc8539f4a43e5aa418c0fc5f1abc01f479d98401cde6c8ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444029, "uuid": "06bba873-8a10-482d-a02e-7217ab369d6a", "value": "T1000301B15349205383B00D3AEF6A43DDF3060D6A711B7765C1840E72A2BBCA985FC2FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444029, "uuid": "f64d8c55-c428-4602-b983-8afe557e8ec7", "value": "768:WXkEbOpZq8T3rNPFz3duK1caHuAjGwfMHwm3UdIN8Bl+nBKv5bZQ:WXkEbWZq2NPxyQuAiuMuIq+Y5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648444029, "uuid": "27695f21-4e13-4b3f-9a49-3fc793e80f95", "value": 39028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648444029, "uuid": "3557f9f2-3395-4d1d-8290-1d9361efd3a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444029, "uuid": "5a0beb9d-7e35-46ce-826b-1266b43f44c6", "value": "3c1bafffdc66f0839a1ae0aa68c17dca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e561c3cc-ae5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447884, "uuid": "a3a42cf1-bfb3-4bd0-9669-4cbe045f4f9c", "comment": "Malware payload (Stop)", "value": "a3c739cbbc4975c6210322b1edd0d89e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447884, "uuid": "63e37a61-6836-47a4-93d7-63dba21aa97b", "comment": "Malware payload (Stop)", "value": "4f91cc5fef6093b6ccae6c91e02484dc33174df7d0e439fefe5f9b9171e388e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447884, "uuid": "f1865994-86a6-4cdc-a505-8591022e2ab0", "comment": "Malware payload (Stop)", "value": "3fdfbb067fc4f8fb6c2797963c8508aff46e13a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447884, "uuid": "b27b1a84-13f7-49bb-bbb4-1563d105bd99", "comment": "Malware payload (Stop)", "value": "3d14cb457dd22f457c024a70ce2ce4d1f1be172d51fdb271a0ffb07868f385b413b7a1f334f033c27a0f1808fbbbd5f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447884, "uuid": "d75fe4f9-91e0-40b0-968f-7b165d276828", "value": "T181F423343700C071CC879630B6E6CBB0F52B78B58574C68BBBBE5B464E71BC59AA5349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447884, "uuid": "a7b69fa0-aba9-4517-afb8-732183807ebf", "value": "d7711116627162a16abc82040806bb37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447884, "uuid": "07428012-a5a5-4eb6-9bda-f92ce6bb4a69", "value": "12288:hcVkTMRXMDMs/U8DZGizc+obKqdo5Hzb7LsXsdlYtOkDdXb:hXTwXyr/hZ5zc+IKsoBXYXsdlYTDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447884, "uuid": "a118c945-6e5b-4e08-9c2c-8bd26bdca3d3", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447884, "uuid": "d784f4fc-72b4-432e-9e8b-a92f7a8f9437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447884, "uuid": "f9c34a4d-567c-4075-928f-de1db381ed86", "value": "4f91cc5fef6093b6ccae6c91e02484dc33174df7d0e439fefe5f9b9171e388e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd792936-ae70-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1648456085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456085, "uuid": "4c51dfcd-703c-46bc-810b-1df3a3c65382", "comment": "Malware payload (Quakbot)", "value": "c1e97742636918b82d7173ceba73f8cc", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456085, "uuid": "6e18076c-2cb2-4393-8b9f-7db1b5ce445c", "comment": "Malware payload (Quakbot)", "value": "4f9dd9825e0faafaa1a62ca86906bd756fab499225cdccfc92434b50fd1c5841", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456085, "uuid": "d7db8a8d-552a-4dfb-b455-8a100bf26ec1", "comment": "Malware payload (Quakbot)", "value": "7baf0867494fda7af8b6b4032ef51c9903bd1fa6", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456085, "uuid": "c1445cfc-85a5-4a23-8546-8164b18dff76", "comment": "Malware payload (Quakbot)", "value": "350b6a42f1301d262992f0d481d2ca79afca948fa597b404cee864709dca633cf023f54e54ff26091fdd854913d57f18", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456085, "uuid": "12a989ac-9b05-4f6e-9756-eebf2206bc31", "value": "T1D044D04272459439E8EE973414CB4A96923BFC20DA5A5B4B131333FA3F796B05E133AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456085, "uuid": "788e3b63-191c-405c-991b-d830b7a00cbb", "value": "6144:UKpb8rGYrMPe3q7Q0XV5xtuE8vG8UM+AEpBLgoN8uJCLpgV2ZV2VUSpbLjtdk:zpBLgAgtgV2ZQ2ALjtdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648456085, "uuid": "6612fdcf-3e1c-4102-868c-498d5bb5ce92", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648456085, "uuid": "c85d8933-dff4-4098-840d-98e859bd7bda", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456085, "uuid": "ac2f2b28-f0fe-4fac-9061-9a44eaaf9941", "value": "inhmllluia.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f52268-aea4-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648478269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648478269, "uuid": "86a89b36-131f-483c-8e71-0ea61ead7900", "comment": "Malware payload (NanoCore)", "value": "f50ca4a1da727a21879183373bca13d5", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648478269, "uuid": "63581a00-4efb-49d0-83c4-2cf2c588f89a", "comment": "Malware payload (NanoCore)", "value": "4fef40a0863603f21d913fcf636810c0653a99afd9cba82e52bc9649f5472895", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648478269, "uuid": "abdf351b-712f-47a2-8788-d19c25ed61ca", "comment": "Malware payload (NanoCore)", "value": "15f2567ed9ef808e5e97433782ec57726a01ebdf", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648478269, "uuid": "26350b9b-5ab2-411e-9713-5a00b918fe60", "comment": "Malware payload (NanoCore)", "value": "2a006cec192c6dc78e5bf3c71f1f7e2ecc260d713ae9a706c48f3e1737dfa3590b42822719fcc642439b7a1a85c9d57f", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648478269, "uuid": "b6fe10cd-e76d-4e82-94d1-c3bae36d9f92", "value": "T15D243202257CA8C3F69C6C73A8DC975E1EE16C5C4676106DF24BB6E9D63F103E6212E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648478269, "uuid": "43528458-273f-4af8-ab0c-6c4665a32688", "value": "384:c8m4b84z+uQM4ZjMoSSjYlR/1hFVeGJdNETT4k4g6tGocA04sQm6eS2KWVAkaneS:cSb841b/1/Ve9afe3ElGVBB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648478269, "uuid": "a01426bc-f07e-46bd-b415-fbe23111d310", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648478269, "uuid": "9478930e-fcc4-4d62-b973-b86a69d55e29", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648478269, "uuid": "d7d41dad-995f-4ead-8833-581a45917d68", "value": "PURCHASE ORDER NO. DFT-000184.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf8a1a95-aec4-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648492059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492059, "uuid": "ebcea382-b0b2-46ae-b173-e8f75b892863", "comment": "Malware payload (NanoCore)", "value": "5b0a22b7acd7f77244b1bc540f9632dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492059, "uuid": "04109dd3-1baf-4afe-950b-befd23806cbe", "comment": "Malware payload (NanoCore)", "value": "5058533554dc63236f5945969a20574df2e2b44982553681d1f63e924346390f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492059, "uuid": "c5ffc178-9790-4741-bb89-78db6e5027f2", "comment": "Malware payload (NanoCore)", "value": "3637383c6ff78135c01c4b49b05ac384fddb24d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492059, "uuid": "c564c1e6-3b45-482b-b660-882bc6b88dc5", "comment": "Malware payload (NanoCore)", "value": "1f00810cb7b6449e1e1b53299a7e575128d3c3c9e1b70d7e195bc8d286590a562103088626b180ce685776c8011bf628", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492059, "uuid": "b7f78668-7f73-49fd-bc83-7b820d7233a4", "value": "T18126CF0263D1C036FFAF92739B6AB20556BD79250123853F13B81DB9B9701B12E2D66F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492059, "uuid": "69c623c9-588a-4263-9419-04a08b7b30c2", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492059, "uuid": "0ac741b4-234d-46f9-bf67-ebaf4920917b", "value": "98304:o2cPK8w+V2cPK89/onEh3noly2cPK88YnRv:7CKGECKgFOdCKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648492059, "uuid": "8d8e2eb4-c9e6-44d6-8cd5-11003c3ae142", "value": 4689920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648492059, "uuid": "7cbbc796-540e-457c-917c-e8cb56d850b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492059, "uuid": "dcccccd5-db94-4dad-a3fd-ca11e73aea85", "value": "5058533554DC63236F5945969A20574DF2E2B44982553.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cbbf6af-ae65-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648451064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648451064, "uuid": "244bfcc8-9799-4f9f-958e-2ef0cd4e9a75", "comment": "Malware payload (SilentBuilder)", "value": "69002d58691e4d32761d137603770a6f", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648451064, "uuid": "45f05746-b2b0-4ffe-b9a6-c1b70669cd6f", "comment": "Malware payload (SilentBuilder)", "value": "50861a98f2388a86d681ea20f9efed293182e28a1d748d71a15c1ed85991e8d7", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648451064, "uuid": "fce564fe-03d2-4896-9ce2-d8398bf0c4f2", "comment": "Malware payload (SilentBuilder)", "value": "ece689a9d14dce5f034cca1b9bb38989477f30ac", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648451064, "uuid": "06356c24-3b11-402f-b593-ed400854aa63", "comment": "Malware payload (SilentBuilder)", "value": "9262dfdfe274353309ec1e9fdc82e2698b5084c65169d1b13050ae65f42a271ddb7b0880832604f102cb466953d59a8c", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648451064, "uuid": "9c1fca6e-b921-408f-b3e3-2dc76235ecf8", "value": "T17843E95BBA49985DEA14877548E743997323FC304F6B074B3269F3257FF89A05A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648451064, "uuid": "2c19f59a-8d03-4684-8e89-ecfe01bb2e7b", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umv/:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648451064, "uuid": "f85632b0-849e-4099-b0a6-d4b9ce5c926d", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648451064, "uuid": "69f37d26-5c5f-4220-a920-e040a23e0420", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648451064, "uuid": "616f637b-438b-4003-9913-00b7eac14c8c", "value": "Payment with a new address.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491d0001-aeee-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648509899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509899, "uuid": "2d2579ca-80c7-478e-b3fc-157c8603f869", "comment": "Malware payload (SilentBuilder)", "value": "288c68320ecabd2a5f47c38d599f8234", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509899, "uuid": "e06e4568-ef11-4ac0-a5c2-5d7d35e72521", "comment": "Malware payload (SilentBuilder)", "value": "50d94c705783637f2b0aa75b222f8b30559e6d3b32b82889eb78042f8033affe", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509899, "uuid": "8a181e73-95e7-4f42-ad99-035d0b2a852b", "comment": "Malware payload (SilentBuilder)", "value": "afd231a5ca47a427ab0d805e927f4233133096ab", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509899, "uuid": "27a3dc9b-bd57-4709-86b3-516a8999a281", "comment": "Malware payload (SilentBuilder)", "value": "8b89d2795c8f35b0335c8169da7af16286345e3da904da574885a8ef166bb4cebb925e0cdf0469a8dcabcc547199aaff", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509899, "uuid": "fe439efd-6f6b-4785-ba9f-adaf861353b1", "value": "T19FC3AD8BB659486DF921877488DB879A7363FC344FAB47473214F3366EB95A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509899, "uuid": "54fe7c22-6d57-4cf9-88e9-1a63e87e60f9", "value": "3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlCd:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648509899, "uuid": "f3a9a4f7-6033-4f34-8c93-69c4e05f8be2", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648509899, "uuid": "b57d366a-1253-49fa-9d68-add92f39147c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509899, "uuid": "fb4f5c06-27bd-4f8f-89b9-d1484d16ca48", "value": "288c68320ecabd2a5f47c38d599f8234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1e8d64-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448107, "uuid": "a617eec3-6c01-4e71-ad03-30667f62c5fa", "comment": "Malware payload (Stop)", "value": "a756d90a7b6f8c2a870882d2bef092c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448107, "uuid": "503379e2-500b-4185-8f7f-b521406a6645", "comment": "Malware payload (Stop)", "value": "51106f1c6484374e3b273578581ad00711f8606962489b295ac79f64eec956ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448107, "uuid": "90ea829d-53c4-4de1-886f-41470f58707d", "comment": "Malware payload (Stop)", "value": "c07e1394a7a16d07e0ed779e9faf5f5d65690554", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448107, "uuid": "90c3bd3e-572c-45cb-b155-0b5672289248", "comment": "Malware payload (Stop)", "value": "d6dfaeb9deeddc18f1d38c35343b34bd9c393886a64589ab35e87b60adb68165cc2c2048959133fcf9892cc285fa9186", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448107, "uuid": "3a3b0d53-5038-4a54-9f09-c3a7f2499010", "value": "T1E2F40200BB50D034F5F752F40D7AA7A9B52E79A19B3190CB62D06ADE1B34AD4EC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448107, "uuid": "39fd1a57-22e5-4fb2-9a6b-f13b77f098d5", "value": "e22fde80595c4bea0880fd6845018d6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448107, "uuid": "b67f1dfb-a902-4e47-a90f-b23af685e9e9", "value": "24576:qe2X1QscMDBQ3LWQmUvCf5W6Cdma1jJoViU1dv:XscMu36/UvCMmWoJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448107, "uuid": "8652f7fe-90f2-466e-9089-a39c74c8773d", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448107, "uuid": "f36ad224-58a4-4f02-97a4-696f08ab58a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448107, "uuid": "c09e2d85-f20a-4464-9fce-25dda32a08e4", "value": "51106f1c6484374e3b273578581ad00711f8606962489b295ac79f64eec956ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c625879-ae85-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648464861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464861, "uuid": "886d1acf-0666-40c3-a85c-d47c6c5e5d6c", "comment": "Malware payload (Heodo)", "value": "d465de4a238e87ed8886f86f5df854b0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464861, "uuid": "ddcb12dc-f81f-4844-b990-d1bdc81e3963", "comment": "Malware payload (Heodo)", "value": "51ba7c2dbe0d099aba71787c887b7e5b9b066fb693eb0779af83386f5fa20f75", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464861, "uuid": "e71539bd-964f-4b48-acb9-dbc74919a7a9", "comment": "Malware payload (Heodo)", "value": "9980642f89c94b0429f80a57dfcda07f41f31564", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464861, "uuid": "92dc7d52-b28f-46ff-962a-637eac1a37d0", "comment": "Malware payload (Heodo)", "value": "4afab0d5cd5f7f30c5f405e4e7e36a7e437d50d4d4b4443d4d70448694475b246f8727902d36b2fbc5fe25acd3dd654a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464861, "uuid": "e6bb2008-6d4b-4882-85f6-c583fa2dc7c8", "value": "T16003AF30F2D28B99D536943C878CE9F587289B1252417F2C309963AC5F526B57F8E28D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464861, "uuid": "2d63ebfa-3e15-44a7-a04c-39d864c1fbdd", "value": "768:umcXd/GCR8tijOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFs:umqTeSOZZ1ZYpoQ/pMAeVIyTCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648464861, "uuid": "1e15e49e-9230-4ca5-bf36-ba9289a2eae1", "value": 39691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648464861, "uuid": "7fd2a33a-8cff-401e-8247-73fcec2ce6fb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464861, "uuid": "c242d7a2-cb2e-4429-b49e-13a25adbe2fe", "value": "Message_962.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6d391d-ae67-11ec-8e58-42010a9c0032", "comment": "Malware payload (FormBook)", "timestamp": 1648451894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648451894, "uuid": "bfe758d7-9e5c-4df2-bc06-0876ddb3b413", "comment": "Malware payload (FormBook)", "value": "497433fb2845a7d76931eb3af2cc3f48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648451894, "uuid": "3b89b5fb-f751-41a7-bb35-e9991f2bfb9d", "comment": "Malware payload (FormBook)", "value": "52264ce6045d2d1a94798af35b42ae1266647199357108afa0b1fe7aa06ae915", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648451894, "uuid": "ca759b32-7f18-471c-8546-8149b5a79700", "comment": "Malware payload (FormBook)", "value": "63e8216bf07e99d871bda373b399be2961f64f48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648451894, "uuid": "c7db3920-3b82-4cac-a9c2-91a53b3a0695", "comment": "Malware payload (FormBook)", "value": "3c7791f72a0cea6beea5547bf4fb6bab2af72ce0c3daee0eb18f7d70aba5f318209913259d870d484756f429e8be554e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648451894, "uuid": "640d00b2-9a7d-45d0-9f59-cbd370ff7a31", "value": "T1E6E4E6ADB2F075DFC86BC072D9681C68BA907CA7930B4103D02735A99A7D997DF143B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648451894, "uuid": "2fe7f6d1-ca0c-420b-b56a-f514d92714ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648451894, "uuid": "bd41f084-b065-4e11-9319-5ec8f2edfbd2", "value": "12288:6eXtAGACYBHpp3fPqHA1nCphZdcHBRgBNrENX3K31s85kt85iU7SDPbYZr3W6uux:6eXtAOCrvPqHA1SdyoD4N4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648451894, "uuid": "53040acb-31f3-4f71-8a03-c96253957b08", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648451894, "uuid": "f8e8418a-9eae-4ebf-80f5-98f2681d926f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648451894, "uuid": "4af42cab-57ff-4348-a905-28d6b16003ac", "value": "PI TT21014.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa35d499-ae2a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648426015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648426015, "uuid": "c892ef15-ab73-4b27-9acf-7bd146271738", "comment": "Malware payload (Heodo)", "value": "062ead1dc7e92170471c31bc8901cf36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648426015, "uuid": "c01642e3-e4aa-49d4-bc8e-327783a854f3", "comment": "Malware payload (Heodo)", "value": "526a3ff5475fdd8c83c5dca84c0cef5d089351c33bed50153029a815c1f02ac4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648426015, "uuid": "f1cc2da3-a950-4181-b00a-d69890183790", "comment": "Malware payload (Heodo)", "value": "ac3d5b4381353dd7fff8b3012949dba4b0606350", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648426015, "uuid": "bb7aff7f-8808-48e3-8a51-5d311d8770c1", "comment": "Malware payload (Heodo)", "value": "2065641aa2c1efae0c07cba89305c11f4e7d59d6f4aa5532a36ea8c85d5f78d81a109d7609119488aae0937d5679f4d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648426015, "uuid": "5c589810-cc8f-4b88-9ff9-fc7129dd5442", "value": "T1F4E49E1177D0C072C2BF3630551AA3B566EABC708DB9860B6FD42A7E2E745829D3871F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648426015, "uuid": "c5c37c5e-ee5c-422e-83be-3e7860bdfe6a", "value": "923a5ec702466ffd61b422bacc94c6f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648426015, "uuid": "3f69ff7b-02a1-444c-8ebf-a66ba94e1eb0", "value": "12288:JSycC8Tu2EEAeClIHRFa7UdUzrAKLtI8X0oXYl2N17OP:JSDD7RDhH3dUf/tj0oXYl+OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648426015, "uuid": "a530f3f5-0f0a-41c9-949a-084ad83a2732", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648426015, "uuid": "d51922a8-08e2-41b6-915f-f857e4336ff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648426015, "uuid": "14a86ae3-0722-4cac-9cb2-1b4303862bfd", "value": "062ead1dc7e92170471c31bc8901cf36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6acdc4df-aebf-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648489769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489769, "uuid": "965fc639-0496-4036-8876-39e00b113315", "comment": "Malware payload (AveMariaRAT)", "value": "73976d1029220a725a30587f21c35585", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489769, "uuid": "06bf42b9-1d25-4f87-9b03-5cc68edb99c4", "comment": "Malware payload (AveMariaRAT)", "value": "52df16a3934e508e6cfb8b7561e05c95fb5ec934f945e1d5d8f065092e18023f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489769, "uuid": "7c764ef9-952b-4580-a8a6-43585a47b99b", "comment": "Malware payload (AveMariaRAT)", "value": "5ae80350179bdc126c95c84e24cb2d15190511fe", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489769, "uuid": "6e36e2e6-a4bc-484f-86ca-4a7ee42c89e9", "comment": "Malware payload (AveMariaRAT)", "value": "973556c9bd4fc0bd42d786bf62015ec975ca0e333a56aca28470d8b1c571c82cf341015efe2e40ff1fd0f0b8d2a65cfa", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489769, "uuid": "81ab4828-92b9-45e6-bfd4-38a66e5d96ef", "value": "T107651A64A3A11115F9D7A7BF72A08B90C86E3C405D6EA7CF4D460AC6CB2D2F479086F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489769, "uuid": "4b6c8f84-de4c-438a-abb7-3ab50cea0120", "value": "a65ca179fcd714dbe6235e1c3844bdab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489769, "uuid": "13b228c3-328d-4d2b-b570-6ae189ef0319", "value": "12288:fPeskLsXTVOge1TQA2kVi2VCDD4pa7+ol:eG5ATl2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648489769, "uuid": "74943a20-5ad7-40fb-a1b3-4c39eff7d5d4", "value": 1457152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648489769, "uuid": "b6be6fca-e7de-406a-bd11-d24566d0669a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489769, "uuid": "bbbe81d6-1954-43cb-b69d-f176b76f9658", "value": "SHIPMENT_DOCUMENTS76543897PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1c1bc5-aecc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648495517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495517, "uuid": "4822e6e1-ee38-4a8c-877c-0c560a620d07", "comment": "Malware payload", "value": "406ec7b7d1c0a3645203660a646d4a9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495517, "uuid": "ff05c229-002b-4de7-bff9-0953ee6d0d92", "comment": "Malware payload", "value": "536c9b7e2eb6b30bcc29112de7fcd0239ecd7ad2a9d925905bc98b06b781f24f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495517, "uuid": "4efb05cf-ec28-4c67-b95e-f1a124c23ea0", "comment": "Malware payload", "value": "3d9a465ace0883b5eb60525bb24025ae50f91d54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495517, "uuid": "ddcb666b-3a1b-4029-acf2-626db71708d5", "comment": "Malware payload", "value": "74a49e51ad72878d20d95812dd136431c71c92c51c81924ac3fd8b8a12076c2ae3f571d1b861965183619029ba18e72a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495517, "uuid": "d234d4d7-2f2d-40f2-8d0e-69a87cdc6896", "value": "T1AAC3405B6E609F19F658573009FBBC29835A13AB36E5EA4AD18FC2006E7131D5C0FAF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495517, "uuid": "6ee64cbf-a1b2-4b2f-a33a-44308fd31677", "value": "3072:QISPhPh28cVCSudCve0uPgrUiyeVKfj/GPIBWhFb1lqQl:QIyhPh28cVliPgrUnas/GPIBWhFb1ltl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648495517, "uuid": "0a86f515-10e3-4a66-b0a1-df2bca676cd1", "value": 127632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648495517, "uuid": "547af079-9dae-4ded-a611-2f050e5a1a01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495517, "uuid": "c7f18601-f7c8-40f0-8f5e-5b1da59a15ca", "value": "406ec7b7d1c0a3645203660a646d4a9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89949aef-aecc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648495404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495404, "uuid": "c955282e-9e99-4379-a6dd-a5d116c5e517", "comment": "Malware payload", "value": "c2f7ab7aab58900ae4e7827b122f5b66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495404, "uuid": "860848af-3141-49dc-80eb-8d9e9c802a19", "comment": "Malware payload", "value": "53bba81ed40069824457494abf834052687c3aa9df7e92b6f08e489a91cbe9cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495404, "uuid": "0bf144e0-7c0e-46c4-a8ff-62e855ca6145", "comment": "Malware payload", "value": "b7819b6052f04b5a7877f861924a2aa3118d2079", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495404, "uuid": "be4a554e-8690-4085-b85f-1336b7137ebc", "comment": "Malware payload", "value": "07a4835b79e9b27382eeaa43e7fc09d92cf5c24ac7b23eab1de4fcaaf60608a63a4bd4acd2e773dc33db603cc0b97abc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495404, "uuid": "0a4988b2-84d1-4134-9b1d-ed321f40e911", "value": "T12C67331347A48B49C5B835B2D1EAAC3E1375E2EB5B31180ECF01726A4DF6536F98D90E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495404, "uuid": "2b892d03-a765-499a-a996-28c76ee76c08", "value": "393216:v2Js36hK1YkV2FP3sRrMVNh71WPzdCozXTvZAB3ptQ+4RMWedomH0zGeITY5z/Up:SA1di3ArMVNZ1AxDvOZF4NwH0PQYxoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648495404, "uuid": "9f72666e-70d4-4ce4-bdd3-46089deb1b0e", "value": 31808512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648495404, "uuid": "1c073b18-cbf8-48fc-acb0-b78039c60eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495404, "uuid": "a38b80e9-3d5d-43aa-9698-dc9af387c721", "value": "c2f7ab7aab58900ae4e7827b122f5b66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983f9b57-aeb1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648483832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483832, "uuid": "3044eb64-ee64-459b-8c19-3c8b135c27c3", "comment": "Malware payload", "value": "bb8e0509cae2cb6f634cf2e17945edda", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483832, "uuid": "6e4f50ad-eea1-46a7-ac16-4ddda7989905", "comment": "Malware payload", "value": "549c22740c2b1bcd0d1d3844fd374af51ba9a3faa608f95149bcf990c62989bc", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483832, "uuid": "aabd9268-13d4-40e2-bc05-0cf863ce0f94", "comment": "Malware payload", "value": "455f7d1a31e2de7f2c21d478a7393ae1f87623ce", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483832, "uuid": "1b606249-e243-4c8b-b8d4-a767436e914c", "comment": "Malware payload", "value": "662ebc917245ce19372c7d089d653df4b92d0878c5ee207b55a4ac1873e5276b5ebfbd2f08047c733a8024eb1c25c2a0", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483832, "uuid": "f6ea11f5-a582-4518-9a18-85f9cf2d90b9", "value": "T104059EB8794818F4D7DBD63649ADB8B9137332635AC75C89015DB3C20A7F362AFC1A09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483832, "uuid": "8dffb8b2-f7f6-45bc-8c67-9007be3dcb74", "value": "a1ab1e9c8026035b07b53e5dc1bdfa4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483832, "uuid": "425070fd-9180-49b4-b157-7f3f0ec5f77b", "value": "12288:9t9VyvDn5CX/JYLL+wLg+aCsnnzxS/WZ6xyK4zxfDoN+wLvp96GvZvc/ZscKmT:JMb8vO3xsNxFm4zxILRtxvc/ZdKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648483832, "uuid": "90894732-23cf-484f-8f37-90b3feb3bdd8", "value": 839162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648483832, "uuid": "3d7b1d66-e979-4ca8-bf40-8b00e37b82c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483832, "uuid": "8e4838a3-77b5-4a04-9c32-8c229bf5f5a1", "value": "NchonhNh.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1350f5ed-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447961, "uuid": "edd4d7a8-66ca-4b12-b3b8-c983fef4912c", "comment": "Malware payload (Stop)", "value": "9e5b2087a8c52568a9444a83d0bbfa87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447961, "uuid": "2fc407c3-5810-472b-a929-6258af207ce2", "comment": "Malware payload (Stop)", "value": "54f94f7d533214086d2d2400b3b9b4d95e44d785334b5e47bf85ee0db24fd49b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447961, "uuid": "292d868c-41a3-48cd-8e12-ad828da503b7", "comment": "Malware payload (Stop)", "value": "af3bd455eefb0cf105891e7d5db4308aad384a94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447961, "uuid": "3a98322a-a06b-4db6-9863-5f7bf6161afa", "comment": "Malware payload (Stop)", "value": "500af8cd37d845da9d7eb744eb0bdcb4b05fc79f1cd75312be21c9c780ff58f5f9491c6949c17e771a3dfdf429f7388a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447961, "uuid": "ed2f67e1-dbfc-421c-9ad1-dec163bb5753", "value": "T1FFF423023942DD35C0157131B46E95A1667B86343ED73A861BC2A2BF9F342C6E3FD366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447961, "uuid": "ddc4efb3-8098-48be-8b67-143618d5ce3c", "value": "85ab2e60dd2898af34be3c600a19c140", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447961, "uuid": "c738af79-f418-4c57-b155-77e749fd5eab", "value": "12288:f580obgqdYT01d8Muw8FafmAbln9IvdtA/QafOqjiwTNn8CwjTS6Kne:f580oUqdpyMZbotATfhhKjye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447961, "uuid": "b19a1b03-0999-47fc-807b-1975c64cff08", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447961, "uuid": "2ba45fd4-b1b9-4bbf-9132-69dd38c18257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447961, "uuid": "2928916a-6f2c-4b54-a486-0237ba73aab7", "value": "54f94f7d533214086d2d2400b3b9b4d95e44d785334b5e47bf85ee0db24fd49b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168eaecb-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447967, "uuid": "9281dcb7-857e-4574-a5e6-7aac24862e73", "comment": "Malware payload (Stop)", "value": "6d2753ee91779da9987ff57fecc766d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447967, "uuid": "1f75f9f8-bf60-46bd-83c7-e8b27f69abed", "comment": "Malware payload (Stop)", "value": "55d8c8e92a1efdffdb85ec2276d9c4e215c1a43b077360c20f108e425a5fa437", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447967, "uuid": "9e0f2afd-f27c-4fbd-b655-0aee1fe25480", "comment": "Malware payload (Stop)", "value": "2ee830c4f01f58431fc14106e060557df347422f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447967, "uuid": "2bd58be2-ffd7-445f-aee0-85012944e57e", "comment": "Malware payload (Stop)", "value": "ff04f9c1e70783ec8c5ad3613a61a417a14d47bd66a96ecdaeed94af7af196374897d24d52fdf585c7cbc9f31187ad8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447967, "uuid": "6730af45-858e-43cb-b3ba-8c025befe372", "value": "T1080523133A86D531E4A652747C03C2B169B3B835193CA68F6BC657AD3F202D3DEB474A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447967, "uuid": "2518f8d4-2fd3-47c0-a395-10d4c9e6f431", "value": "159dcaa804632f606b007a362cfb6cc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447967, "uuid": "6ad935d3-8872-4425-a934-85011f596488", "value": "24576:4HsmfLOmXypy1Bu+tDHnAqa/lil9qAL4uU:4NOmCpyvu+9HbolcLfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447967, "uuid": "650b5861-909e-45aa-9704-95b1629f67b4", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447967, "uuid": "4ca79738-694e-4fa1-9eb0-409b065ebed2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447967, "uuid": "77357493-2f8a-4a67-94e1-bbe03968d6b1", "value": "55d8c8e92a1efdffdb85ec2276d9c4e215c1a43b077360c20f108e425a5fa437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251de6e2-ae30-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648428234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428234, "uuid": "e332cc7e-20d6-443a-81fb-7b0b7d39cc8c", "comment": "Malware payload (Heodo)", "value": "3bbc96aeb78fb91366e97f55a6bbb03d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428234, "uuid": "83dfd410-3382-4dae-8bf2-3bd5ded50823", "comment": "Malware payload (Heodo)", "value": "5624e3720699084f1a30325830aa36c5025505d15eb6110616956a4ef4fe3242", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428234, "uuid": "379c7c0a-a359-4224-b48d-32adb6a17307", "comment": "Malware payload (Heodo)", "value": "efbd5f57cdf5523c91118db78bf6e6fccba5fbcf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428234, "uuid": "e8754d6d-350a-4036-9018-f2745c2add5d", "comment": "Malware payload (Heodo)", "value": "52f4016b96610b6e0bbe96d16b542993ec39802ebfc03230190a1cdb718e69ba24603c42c7272271b0c88a1bd1db1a1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428234, "uuid": "ed164681-655b-4b23-a96b-efca51364836", "value": "T1FBE49E1177D0C072C2BF3630551AA3B566EABC708DB9860B6FD42A7E2E745829D3871F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428234, "uuid": "e3201c34-44c8-451b-b91d-89c39026539b", "value": "923a5ec702466ffd61b422bacc94c6f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428234, "uuid": "4b8b9fad-e8c5-4286-92fa-eb5b33b1a690", "value": "12288:JSycC8Tu2EEAeClIHRFa7UdUzrAKwtI8X0oXYl2N17OP:JSDD7RDhH3dUfMtj0oXYl+OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648428234, "uuid": "062f6ba5-10fe-4914-a8aa-4237922b480a", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648428234, "uuid": "2a4221b0-c685-455d-9c7c-2649021834a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428234, "uuid": "59573cd1-8a67-4026-bc35-f012b6e88760", "value": "3bbc96aeb78fb91366e97f55a6bbb03d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec6018a-ae85-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648465106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465106, "uuid": "556ec20f-17b7-4cc7-ba63-fd7cca478b58", "comment": "Malware payload (Heodo)", "value": "3ef78e6712770f27b61bdccbabd7f5a6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465106, "uuid": "c949065b-3b59-4b76-815f-3d71215ab83b", "comment": "Malware payload (Heodo)", "value": "566f62bac0fc459685a876eba3e3fed58a5e94cb71d6fee9bb607967739a9d01", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465106, "uuid": "b06ebabf-a2d4-43a8-85c8-3bf74470f08f", "comment": "Malware payload (Heodo)", "value": "23fc1fde92d1e28d4a363b9537674fb984b68007", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465106, "uuid": "e2246917-dff5-4fea-8c7f-a6d6b04025cf", "comment": "Malware payload (Heodo)", "value": "8b0c873aac57b3f988860d3b2b77f4cd92b5a2d54e09007f3992c57914e518a6b2bb412309dc738802feba168a5aaea5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465106, "uuid": "c225a48a-c182-4954-8efc-4bbf3cdb85e8", "value": "T19AC47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465106, "uuid": "e6af211a-9b7e-401f-aad1-7c0fbf76bb9d", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465106, "uuid": "44cc5e18-77ad-4223-b7c5-921b47dae34d", "value": "12288:S54yM33d3q3Z7BogyreNmF+U/9JckIAGfUeb:SKh3831Bo4N6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648465106, "uuid": "212f1f4b-0cac-466f-982a-fd8a568c7bde", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648465106, "uuid": "a9e60503-15b0-4472-87e8-af9be63cc02b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465106, "uuid": "37cd8e04-87ab-466b-b92e-b6135a0cb6e6", "value": "wnru_3.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11bd5730-aeed-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648509376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509376, "uuid": "a1d5b6d2-4643-46e2-a266-4b583b9a6be2", "comment": "Malware payload", "value": "f18e71f71743a57355920ae9de338e64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509376, "uuid": "ef3c1443-ffa9-425c-9425-7f01181a97fd", "comment": "Malware payload", "value": "567cb1d95c5b0701bc9a5b06842f9a675a592749cebcace5e7d62e626b2354d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509376, "uuid": "9bc07f28-d44a-4ebc-9d29-8960bc9b03c3", "comment": "Malware payload", "value": "22c047708a3fdf0eaf161ffb655454a6b3810546", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509376, "uuid": "26514b92-4f89-44ff-a94b-b6a15d2dd4d0", "comment": "Malware payload", "value": "f8a4b86325e601f01e2e89c41769c47c9c630c76606784b95d9717db3aed0da66b5a82be880726cac78a5734d03cbb9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509376, "uuid": "c586206c-c2cf-4e0d-92da-5ea0817d1433", "value": "T173844A43F2A2A0ACD16AC1788757E673FA327C0946217A7B27D0FE312F65B50A72D705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509376, "uuid": "dd678dec-657e-48d9-a621-5cb6b4db3efa", "value": "b3f6dcc1b4af5b5c34940f50a3e17687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509376, "uuid": "9786dac3-5046-4e07-a0b0-bfe72e52af20", "value": "6144:zU/yZ9D1EdQ4Qi9rO3/JwOWGM/gRfDCVIpKUY0MVqD/YG:w/yZLPurSRpD03VI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648509376, "uuid": "addeb8cd-fe89-4dac-9f4e-d7a686c97fa5", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648509376, "uuid": "dd695021-a2ce-451e-8465-7646015e5474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509376, "uuid": "ebe1a09f-6bb8-4070-8734-2f5fbb8d7497", "value": "567cb1d95c5b0701bc9a5b06842f9a675a592749cebcace5e7d62e626b2354d1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8684676c-ae67-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648452020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452020, "uuid": "2eec9a0e-03b8-4550-ac81-cd43817f80ef", "comment": "Malware payload (SilentBuilder)", "value": "b3a150f7704dcec540e768d4d7d08ab4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452020, "uuid": "f8f22384-8cbf-4d07-8fcf-4136690e85f5", "comment": "Malware payload (SilentBuilder)", "value": "56b3a03e7a4eaec6411117cbcf808e77851211366759ffa74fb69c30013c4340", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452020, "uuid": "c501183c-e536-4a16-a3ea-7736ad5d4644", "comment": "Malware payload (SilentBuilder)", "value": "e52782aa4d8c128646d96e6a6686a52064784a1d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452020, "uuid": "f6a1e880-59b1-4327-91f0-b2aea7fdc042", "comment": "Malware payload (SilentBuilder)", "value": "bcf9a51f82d4a8978564fdc857501e4d704a40f754c7e8983ce4a012e6f79837e13e7726160bb134b240830376f113ad", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452020, "uuid": "fe7f8d29-6e19-45fa-8ec2-f85248790581", "value": "T1C12423662F9BD94877BF3629FA3ADE75C313A5540088F786BEBCC005015647929DC8B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452020, "uuid": "427cc08c-1b17-44e3-9b4e-bf67f6dbc178", "value": "6144:Wc0F/lFMafbcFZJLI2FmH3XGq+OmyWS3OnH:DQvMaSZJLYnj1rmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452020, "uuid": "4d51c113-b7ab-45b1-86fa-ed9d55a0f0b8", "value": 219447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452020, "uuid": "1c04cb8c-c817-420e-8ce1-db689cecb046", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452020, "uuid": "e6442ea5-4e5b-4633-b603-ba567d8e35e6", "value": "neevsqiimdeuabtu.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e8cc90-aed8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648500604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500604, "uuid": "74267ab4-f599-42f8-b4b1-51ea03781f6f", "comment": "Malware payload (Mirai)", "value": "1c4037ac0bf7f797ef01eee0ff571555", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500604, "uuid": "fe4df6bc-f07f-43d0-b899-974a80303be1", "comment": "Malware payload (Mirai)", "value": "56ee97302665c448f355448626c0a49666e09b4c7f521ab6410fe7c64ada043b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500604, "uuid": "75698338-1761-45b1-aa9d-a9dc9192c8b2", "comment": "Malware payload (Mirai)", "value": "4d7a3de0d2f41dc830b2a494b83e6c8e5390aec9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500604, "uuid": "32770b7c-0ee7-4c2c-b866-e3216638e313", "comment": "Malware payload (Mirai)", "value": "0a7564084e1b66d3db0e89cdf0d68f757227d093202d05fefb9ecc09cba8b6229e84e1b794eb53a40a7ef49effd9de85", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500604, "uuid": "0690ce36-614c-4ea1-94b3-0c173be14c8e", "value": "T1A273191AF593E8F1EF070834605E9F7EAA32D6775111E896E7A9B923F811203D302B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500604, "uuid": "be863020-dcc0-46dc-8d68-0bbb4464eb09", "value": "768:/ZuCA7uhsK7DNWU5tHGylVFXID2jPZ5QeugkgYKYqUPAAoY8T2eg/QSkrt8ie0RR:/QCN3JWom2XLUmYKcoAAGQSAELsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648500604, "uuid": "99413a09-2116-4049-b0e1-ef89d11fad22", "value": 78512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648500604, "uuid": "4f8f1f2f-5e40-4b1b-a0fc-013950a47fd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500604, "uuid": "aa325666-ab23-42ee-8127-64c9801646dc", "value": "gx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329b35ea-aeba-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648487527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648487527, "uuid": "7ae2e730-8dfd-4595-adf6-c817ea9a95df", "comment": "Malware payload", "value": "1c5febdfd0adfbfd5c0ad52999fc322a", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648487527, "uuid": "8a5fc161-f678-4c9f-8846-d70fb1d9fdd0", "comment": "Malware payload", "value": "56ef59d18dfd33c13face11794752891dfdbdb74491ce86b6bc3dd3308a409d8", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648487527, "uuid": "1796f449-e9e6-4a6c-aa74-76586a403e54", "comment": "Malware payload", "value": "03e2cc0eba60ed83a206e52d35ee011979e397aa", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648487527, "uuid": "ac7e84f6-964b-407e-ac81-2f8e15e3f677", "comment": "Malware payload", "value": "6fbb763478e704faec664c9ee52af2ab11141363f7fa2b407fb8dd69657778573fbdda9a2ca222d0f0f627bdeabaff25", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648487527, "uuid": "725939e9-761e-472e-a250-8da9437f04f0", "value": "T17B059EB8794818F4D7DBD63649ADB8B9137332635AC75C89015DB3C20A7F362AFC1A09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648487527, "uuid": "a1f2fd1a-68d5-4818-89fa-c8250a1af2ae", "value": "a1ab1e9c8026035b07b53e5dc1bdfa4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648487527, "uuid": "3c514719-2080-4b34-b4cd-5560c0a0a5ac", "value": "12288:9t9VyvDn5CX/JYLL+wLg+aCsnnzxS/WZ6xyK4zxfDoN+wLvp96GvZvc/ZscKmT:JMb8vO3xsNxFm4zxILRtxvc/ZdKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648487527, "uuid": "6413a745-2917-4db5-91de-fc130d06a7db", "value": 840179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648487527, "uuid": "40b0620d-1a70-419e-b26b-8a60265f6e58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648487527, "uuid": "82d1c469-1b60-4860-92fc-10edb98fc956", "value": "BvMnhOn.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66978c57-ae9b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648474300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648474300, "uuid": "4cda9df4-4725-4bf5-8a49-3e2490610e2d", "comment": "Malware payload (Heodo)", "value": "8483a087b3f9f647e79614593a163026", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648474300, "uuid": "f093029a-f82e-4a8d-8055-d40e1523ba2a", "comment": "Malware payload (Heodo)", "value": "57675b53fcce262d652c6e6b791d1a73335108a9e2ae24d10dc7c16f1d7bd6f6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648474300, "uuid": "0c2d7f73-22e0-4eeb-bcf7-eb8367b06905", "comment": "Malware payload (Heodo)", "value": "943f4ac793fa2e1c8a5c369eeeb62337557ca1a6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648474300, "uuid": "6472b8d6-f36e-415c-b5b6-116fefece946", "comment": "Malware payload (Heodo)", "value": "82421e923cb96b3083d7b2d54706e7d75490dedef579d6a2e8dd5e4b0a8e608985b3794583714a880abc300948b7ec6c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648474300, "uuid": "4b57eeca-89a4-4bb9-bbde-3254525dbee9", "value": "T18094BF40B1DAC476E5B62A34957243F25A79FD02FE38C28FB354BD8DBD316408A3476A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648474300, "uuid": "ac457fb6-b51a-4840-ba07-20cb525f76ea", "value": "c0eaca862e71892f0b09074d92f8955f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648474300, "uuid": "7eb400f4-06cb-4e7c-855e-1da1d545948a", "value": "6144:3QfYaJlKdMDan9+2VhqOWOLt5ZZnB9iHC4CqhAMQvYqq/9CwU43:3Qw+CM2n9+6qsRlSLhIe9h3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648474300, "uuid": "cc28db47-87fd-49d9-b12e-1e130fa0f050", "value": 411829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648474300, "uuid": "89a89a27-4ac1-4554-b6cd-fbfdf1e9ac09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648474300, "uuid": "b209c220-1671-4a1b-a6a7-465a867ea29e", "value": "emotet_exe_e4_57675b53fcce262d652c6e6b791d1a73335108a9e2ae24d10dc7c16f1d7bd6f6_2022-03-28__133134.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098be18b-ae69-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648452669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452669, "uuid": "0b4848e5-027e-408b-9067-a63b0cdf92bb", "comment": "Malware payload (Formbook)", "value": "351a1c5e9e1ace13a88b2a7ecde031ec", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452669, "uuid": "a2a67888-e18f-489a-9dbc-e62548a597d6", "comment": "Malware payload (Formbook)", "value": "576f08149420589fb8431fde363287591d476044e11e5bc939284ce67aeccda9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452669, "uuid": "9b747ed3-0cc9-42a0-89a3-cececc2a2c78", "comment": "Malware payload (Formbook)", "value": "639015f6e71e79bf96e34355b79bc92bdf772065", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452669, "uuid": "a5153f08-8f30-43e5-a453-5b8bb75769e4", "comment": "Malware payload (Formbook)", "value": "978303ee6e819bbe0e6c52603f01c5e1b06ea8bbf9435319835297850de60e5dbfa78cc8ae560779d903e668b233d214", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452669, "uuid": "d1d2f8e5-3ec8-4dfe-9a47-463110ea207f", "value": "T16E14024ABA7083D8E092437888A62CBD1759FDA582DED4FCAD143308E27C76475F25BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452669, "uuid": "b28785aa-b600-4e4e-9715-9646ac080094", "value": "3072:CDgDGLMKb1c62Og0Mw5FFcYCUQ2ADraleEo5Yf1cjtgcmBVRVae0nVwKi3hpntwl:2g0OC9F1kUXZ1Atgh4nV5izntabVL1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452669, "uuid": "23bf4523-9eaf-4395-8ede-51b9afc6601a", "value": 192280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452669, "uuid": "8cb3ba25-3105-4d87-8f5d-a7873d15ca60", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452669, "uuid": "9d5ec397-84ce-4b3f-baf0-53de944227ec", "value": "Remittance form MT14.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9025a3-ae3b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648432998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648432998, "uuid": "a388faca-3f9c-4fd0-9a4e-057c74e8b429", "comment": "Malware payload (Heodo)", "value": "411cb6375bad369ce16cf5b6da3f8224", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648432998, "uuid": "cf0118eb-903f-4470-b0ec-24f7a514094e", "comment": "Malware payload (Heodo)", "value": "57a26524cddb17d46c72d769aff95594042816d466bb27f26f3ca3751a1f236b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648432998, "uuid": "bd621b63-f5b4-4342-aaf1-06167ae7d333", "comment": "Malware payload (Heodo)", "value": "9c825755ada86f1d3e74093f90502ea6b811bb2a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648432998, "uuid": "2e1bd637-fc5d-4c40-abf1-11c57e6e79d3", "comment": "Malware payload (Heodo)", "value": "2f6e063a9787681232feeb5a36e3ea7c74aba0acc5507020a9c1a76c8a6f8553c8d4021ccb7be6944e23606591cdb1b0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648432998, "uuid": "53883d2d-7712-4a53-8008-89ecb42ddefc", "value": "T1F4E449936AC3C0B7E41F0279861A92287257D5323756E6DF3BC5D71FCA387A2AB38150", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648432998, "uuid": "0698c1c0-02ed-439b-a05b-c1ebc478dfe3", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648432998, "uuid": "d9fb76f9-1d8d-4d7f-9eb1-835e53741529", "value": "12288:wGOAWAyzLzHKwJrCf9dJJjI1rMpUsN+JinUqqOYJIOD7ZjAjKL7mYv:w5aYJIwPHm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648432998, "uuid": "d6890285-4791-4a86-9872-c2d1811551f5", "value": 682552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648432998, "uuid": "084be43b-5855-4c31-a109-d1e91e3010bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648432998, "uuid": "249c3129-2e48-4c05-a461-9c201c3e73ed", "value": "emotet_exe_e4_57a26524cddb17d46c72d769aff95594042816d466bb27f26f3ca3751a1f236b_2022-03-28__020313.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8279f8f7-aeb1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648483796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483796, "uuid": "873f1338-7893-46bd-b1b0-32b4b75b629e", "comment": "Malware payload (Heodo)", "value": "f5de5300d7b2ccd563444aa077ac8a15", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483796, "uuid": "aaf5562f-2c74-4f7e-a142-d09ad923d787", "comment": "Malware payload (Heodo)", "value": "586abe3236efe4acb4d5f5246ab2d2f48f09ba82e647499d11b3fedd55081d5b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483796, "uuid": "ad71457a-434d-45aa-800c-1bd6230fdc4c", "comment": "Malware payload (Heodo)", "value": "416ccd4dfad5ec18c92e08d742acadb34cb4e6b2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483796, "uuid": "fa056a14-4a6d-45a4-a0a1-c7fd674f2264", "comment": "Malware payload (Heodo)", "value": "cb8b35cf1ec881e952ce702744682467a391b7a2a5aa6e64599affc56393a5ea27aabd65377b60cf53e86fc3e7769e31", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483796, "uuid": "feff0ccd-fc8b-43e2-8a4b-b2c0c14cc426", "value": "T1CCF48B22AF5740F5D89F0C3C05513288A999FF46EBA8B77ACA75768D35B20534E3884F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483796, "uuid": "7e3a7701-e27f-462f-92cd-7a7ccff5599d", "value": "b39d2fd2d18c2cfe493a1e089561b46e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483796, "uuid": "8174e36f-a68c-4c0d-bcea-72f40c0554b2", "value": "12288:aX5mvP53RTqtl79FsUnrymfxbm1nB0hoxxUI/XgtdXkX:Ac53RTk5rxi1B0hGxUIfgTXkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648483796, "uuid": "6fc7355f-9347-45d9-bec2-e495dd4096c4", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648483796, "uuid": "9ab6c0a6-6ff5-43e6-b65e-08e9045743c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483796, "uuid": "9f6aa170-a9e6-40e1-9bc1-0e12dbfe10bc", "value": "emotet_exe_e4_a71fd84515f97a519758cb36edacd47e2861fe0c72d3d115c366e2fbddb9d980_2022-03-28__160949.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1a2fd4-ae86-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648465508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465508, "uuid": "4b45598c-8394-4c63-88f9-138569489ec3", "comment": "Malware payload (Loki)", "value": "58b0bd988b59e8b4bd3d2bedc61f29dd", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465508, "uuid": "48547849-db8a-471d-8009-e94dcf27cc42", "comment": "Malware payload (Loki)", "value": "58967949433d710df468103176a83e712da700a8580fc8a4fad1ffc90200e11b", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465508, "uuid": "1ca1cd8f-297c-4554-8a56-a39d154f26d7", "comment": "Malware payload (Loki)", "value": "ad70e3c94d82126de640ed29ddd00953ecb8cd6c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465508, "uuid": "e750d4cb-fe03-46ff-bef9-99f907beba52", "comment": "Malware payload (Loki)", "value": "9ad7e62b9a696673c12a306f09ebd2bdb918930476cd8adf7b2d9060d22701816031e0f801a4d2236731ad900a68c215", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465508, "uuid": "90832873-b518-4ca1-ad0e-261642bde97d", "value": "T1F114125D3A57D312ED6481B029CA5C1B0A1FFCF9201227CEC6AFBB49D6B68253D1075B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465508, "uuid": "1358fd33-068d-4e6c-b261-29ae052b1477", "value": "3072:wyEJybe/y/9T/Ce4f8K0RXC7Xg5sWx8GbUJRWf0cZiJG6EcjNw/pRJ6x:ug/X4f8K0Y7w38xJHcZi59axT6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648465508, "uuid": "05f51a08-a6d1-48c1-8ed5-d65c9df264d5", "value": 192136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648465508, "uuid": "5f268028-29e5-46dd-ac81-328e5ba98274", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465508, "uuid": "4870afdd-b426-48ee-b201-e2cda813bc11", "value": "NGEN204454.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9248250-ae93-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648471029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471029, "uuid": "01f2ff10-71a7-43f0-af0c-06d205c3b939", "comment": "Malware payload (Heodo)", "value": "51d273863abee28a2a36154a6587f2f8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471029, "uuid": "77f14edd-461a-4541-99b8-d525781ff926", "comment": "Malware payload (Heodo)", "value": "58a31e5abf183033e3a2175c0600ff4d2d4b8e85d41fdda259f5f622c6f1bf7d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471029, "uuid": "5dcb36da-ee50-4f36-81c6-916943070127", "comment": "Malware payload (Heodo)", "value": "a827b51e2bab34ca5976b6c32fa115330616215b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471029, "uuid": "7e5bba22-1730-4fa3-b4be-bee0040e37c9", "comment": "Malware payload (Heodo)", "value": "4310d84a53eb4f683f5d0b58d7e4698bc86bdd936efc07e51ace56c032093ee1ceb27629da508af15887f8b8c8df2e1e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471029, "uuid": "39f2a439-b0d1-4831-ac7f-d4e4e356ba2d", "value": "T17643E95BBA49985DEA14877548E743997323FC304F6B074B3269F3257FF89A05A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471029, "uuid": "6b3046ec-d91f-4a02-8666-e9c76b5df5b7", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umvv:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648471029, "uuid": "c3c861f8-951a-4521-8b80-ee52ef105149", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648471029, "uuid": "96d4e1cd-4cad-4abd-9945-97888ce7ffe3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471029, "uuid": "e0375cd8-f588-446c-98f4-9abaf2107b85", "value": "Contact.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6be015-ae6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1648453718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453718, "uuid": "6276e71e-06e1-4910-8ffb-b2019c0b7f0d", "comment": "Malware payload (GuLoader)", "value": "d7ca239e1f58f32dff79c2f44aa51915", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453718, "uuid": "12e90b32-46fb-404c-ba9a-79fb358e0979", "comment": "Malware payload (GuLoader)", "value": "59932d46683e87d9ef4db7a6bcb36d7901afb10ac4f4d32bf208ba746c96eccf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453718, "uuid": "709c434e-2823-4334-a846-121c09c04f80", "comment": "Malware payload (GuLoader)", "value": "f1c8e27f0c24a2d7c778ac65cd13501997166333", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453718, "uuid": "7ecfbef2-b7d5-4d2e-a01a-eb12208a3c4c", "comment": "Malware payload (GuLoader)", "value": "8aea23c6fe7cdda5facea534face8911ae0e57773cf11bd5ace31b82f0dfece56c0398dcb090de9cb42c13eb8f741561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453718, "uuid": "ad2efada-cc3d-4cff-8376-2425d711524a", "value": "T1C3F3E1513664C863E4E162B21F22D6979F74EC251B745B8B37E02F6F3E7A291981F302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453718, "uuid": "b0ef26fd-8041-49db-8873-7aad4df42fd7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453718, "uuid": "8cebf200-1978-448a-a1d1-1f548f4a028d", "value": "3072:jfY/TU9fE9PEtu7ju10q0dRabS9Ju6I2mZ2j:zYa62Cd6LdZ2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648453718, "uuid": "748a9df6-ebe3-47dd-8699-0bedadb4d813", "value": 168488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648453718, "uuid": "62520677-2d0f-45d5-9ed4-e31747a04dbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453718, "uuid": "ec6901e6-3bcd-465b-96df-3845752d471f", "value": "HSBCPA~1.PIF", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5839df-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448085, "uuid": "c8936929-fd02-4785-8b22-7b7376955e6b", "comment": "Malware payload (Stop)", "value": "c7e7243ae9514332fbbfecbaef04df60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448085, "uuid": "5061f202-3129-45d4-9ef5-8402ef3583b0", "comment": "Malware payload (Stop)", "value": "5997cac695f141c41240d248fc991e41122fe77fc345c7bbb73145fef81f429e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448085, "uuid": "68232a66-52d2-4f47-96b6-f8e6fd40cb59", "comment": "Malware payload (Stop)", "value": "72eeefc3d8137dfde8212faebac64f796afe45e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448085, "uuid": "049061c7-27df-420c-a639-f293901a416a", "comment": "Malware payload (Stop)", "value": "0453645954448e86c5c428dec48022376f372842b5e53ce322d0c07816c6f689f92e190e4c0a42726822be814c39bc7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448085, "uuid": "75801092-50df-4fc4-ad26-91c27f40b9f0", "value": "T1EE05230226D1E031C0A7D4B23869E5785E3B8571AFA258CB3B6D167E6F673E11EF1306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448085, "uuid": "9fb6d737-d2b9-4ec0-8127-82d0431a25d1", "value": "a945bbba5e19a9f29aa1458bdc91ed8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448085, "uuid": "96f74239-b8ed-41fd-aa04-4923841a57a6", "value": "24576:vz7jHy1yJxXuMpf3r3qDHiMAlFCfvXwkHY:vzXy6Xu+ODfcCXfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448085, "uuid": "7362841e-7a22-4657-a189-40810c0cba85", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448085, "uuid": "6defc37b-fe4a-467f-85a8-3f7cf90ab485", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448085, "uuid": "9b14fb88-483e-451d-b988-cb930fdab8e4", "value": "5997cac695f141c41240d248fc991e41122fe77fc345c7bbb73145fef81f429e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b403b3-ae83-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648464155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464155, "uuid": "45ea6a5f-ddf6-4fe1-8f0f-22a2bf6785a1", "comment": "Malware payload (AgentTesla)", "value": "4f4df507c22b80bebf9f1803e82e7151", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464155, "uuid": "70fca041-3f7e-40c5-b52b-478c4cd5dd9e", "comment": "Malware payload (AgentTesla)", "value": "59c2b27a29ee67b9cd590c795249519ee155d0889c6c0591bf6f5b672a6c6ac2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464155, "uuid": "45a3b37d-94cc-4842-97c2-e94ddea1087b", "comment": "Malware payload (AgentTesla)", "value": "98decc9f7c9ea26efe60fde2ad84e887b33653ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464155, "uuid": "2392f651-87e9-48b0-bb45-ce18f051e8c6", "comment": "Malware payload (AgentTesla)", "value": "54a5a0e04261a43881a97e6089a34606bd4f401b4c3a2f9a7af9fffe012e61f2a7c03485d56e9a700282d552930b2260", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464155, "uuid": "a52328c0-9075-4f17-a640-77651caaa0bc", "value": "T14654129A2FF1667FD48041336CBB9A01BBFE89CA00AF9E57D7B50F932E665436110364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464155, "uuid": "7c2e63d6-1f9e-4ed0-9b0d-732290bb93e2", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464155, "uuid": "6b1cf76b-d77a-4b7a-afc9-a0d50a03f41e", "value": "6144:rGiEF86UHneaXWzZRYdl2GGHSvaXn4c3beZJ6WWBbdUgRN:oYneasO2RHoaX/er9WNe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648464155, "uuid": "75c5df87-6b96-45a7-b6f3-6e4b808a98df", "value": 298746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648464155, "uuid": "695889bb-5c1a-4e93-becc-74164373aa77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464155, "uuid": "fc305890-d831-4725-9a05-73c196d32ca2", "value": "Tracking number_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e27ef5-aecf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648496582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496582, "uuid": "352d3191-d422-4cdf-bf46-c3c77a0bd9cd", "comment": "Malware payload (Mirai)", "value": "2687b76180f12d904d7712b8c3d30d19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496582, "uuid": "7a062123-53a2-4b00-8b2d-c38e5f72715d", "comment": "Malware payload (Mirai)", "value": "59fa49313f1ea4b09c142152def37562c9db049dc330e6768a801c9545bd18ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496582, "uuid": "0ea3bcd5-7bd2-45e0-9f1c-4e617b4fccd7", "comment": "Malware payload (Mirai)", "value": "216589660587b144eed1d69c965b924254c82c2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496582, "uuid": "376ed2d4-d56a-4aec-96f1-9f7576f2e733", "comment": "Malware payload (Mirai)", "value": "3f1fbaa646a697627e2a1da9eb0af78853d92dbb65087026b246b710a1e048bba0733a5c459385f34315192ed714b8a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496582, "uuid": "706e1915-bbaf-4559-baa9-828bce2bd10a", "value": "T1EFC2E098178929E9C1F9C17D43780B6C1DB40B6AF809DC8678F8F7629D8E4753017EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496582, "uuid": "56216f9b-c729-46af-b746-c4a1dd3fd04c", "value": "768:I2G214DFyosXqgvV9o1ndB08qJgGlzDpbuR1Jv:I2GdDgosaaO1nd4VJuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648496582, "uuid": "e5cc9f44-6015-4f0c-8232-f1ebab03aedd", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648496582, "uuid": "b64fdcc3-7f03-4149-b8df-5c68faf12e1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496582, "uuid": "681029a2-e965-4d1f-9be3-01e7200e8533", "value": "2687b76180f12d904d7712b8c3d30d19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d48de33-aedf-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648503383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503383, "uuid": "b3b77b18-baf6-4062-aed2-54bda69fc62f", "comment": "Malware payload (SilentBuilder)", "value": "04ea0dd9343c084fbcb506c3bf1b1d8d", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503383, "uuid": "b9186bae-ea1c-4f39-8845-53c05d2cd049", "comment": "Malware payload (SilentBuilder)", "value": "5a3f60b3848d0e9d950afc52b6a9261735858762375cc4a0f79ff6065121ad1c", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503383, "uuid": "bceaade1-46dc-4f20-bd20-f03c39260530", "comment": "Malware payload (SilentBuilder)", "value": "2d87159cdf746a1aada4113f750f891b6ad8c267", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503383, "uuid": "ab92267e-1a11-4a4f-963c-ec29357efa79", "comment": "Malware payload (SilentBuilder)", "value": "40a333f09700f1904a0c43a90117753ccda317c0a5f9159dc1b4edc785e6e44d04e6eb9b3bb3640450c39ab01d94c71a", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503383, "uuid": "b5fbd7a5-c682-4c98-8dbd-d39584a9c16a", "value": "T1D3C3AD8BB659486DF921877488DB879A7363FC344FAB47473214F3366EB95A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503383, "uuid": "a8bce5b3-4537-4a41-bb02-e44791efbdbc", "value": "3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlC9:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648503383, "uuid": "e3362067-9907-4898-b21c-f8702f0e6a65", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648503383, "uuid": "abd777cf-d474-4340-9bbf-9c5ff09300b3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503383, "uuid": "d01d168c-d5f4-414a-bca7-e8b1dbe9e536", "value": "04ea0dd9343c084fbcb506c3bf1b1d8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fc881f-ae5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447888, "uuid": "f284a861-44ed-47c9-87e9-4009b1f94eb6", "comment": "Malware payload (Stop)", "value": "d69d1a831522151b32e01fecd10f76bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447888, "uuid": "b8ddbb55-d04e-4c55-b02c-bdcf1a459309", "comment": "Malware payload (Stop)", "value": "5a4d3971664541b367066e6428098fb891e68b3a6fe0b8df52e66085cc764d4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447888, "uuid": "e263f0b4-ae64-4d24-bb21-f9ba3aa63377", "comment": "Malware payload (Stop)", "value": "a814c512635320c168c7eb9aa1ac146c5bcfc8d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447888, "uuid": "5fb799c8-8fc9-4a5d-8acc-8cdf3ad11491", "comment": "Malware payload (Stop)", "value": "879cf093967347474ab60434f512371a7d5f1079ab5cf33a4ccdc49d21f9093236d0de7d287eec6fadd12bd0afe18b56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447888, "uuid": "2252091e-76c3-4be0-8dd8-2ea8b58e5099", "value": "T153F423237A81E8B1E87955729564DB626B7DB63206A204C737FA073C1F305D24FAE70B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447888, "uuid": "292277a3-6ee7-4326-bd2a-c84805cf29f6", "value": "487134aabf70de91adaa596b972e9646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447888, "uuid": "572f940a-e3b4-480f-94fb-a3212a80fa73", "value": "12288:d+QiqDnAXJ5kULT0UayFeL6Qjy8xGA+jO5HuCQNuwsxTKr2+6+gLpt/bjv:0QiqUZyUfFD8L6sy8T+j6BcwKi9v/Xv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447888, "uuid": "2d740b60-13b9-4f46-89f1-f7d03e8d5d7c", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447888, "uuid": "d4a76e92-cf4b-4735-8274-8a45cb868381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447888, "uuid": "521da023-1f52-4da5-a5ec-92b467799c57", "value": "5a4d3971664541b367066e6428098fb891e68b3a6fe0b8df52e66085cc764d4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "080b79e7-aea9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648480154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480154, "uuid": "58ae5548-f46c-4673-8d3d-01f7b9ec9c44", "comment": "Malware payload (Heodo)", "value": "09da46b43d54a2bdb18c0fbbfca9a58d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480154, "uuid": "628529ca-6323-4615-bef9-9077a8569218", "comment": "Malware payload (Heodo)", "value": "5aa3281084a39e9722f599a8a5c4603093e762f191e71ce506d16fbed4778083", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480154, "uuid": "df41ce67-026a-4aa2-8fbc-ce115c016354", "comment": "Malware payload (Heodo)", "value": "0b657e5f7b2470969db892287c1608d2fbc9b621", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480154, "uuid": "5146f836-464f-41c7-88b5-8ced255bd2f7", "comment": "Malware payload (Heodo)", "value": "2b1b65fb4bc51390dc23f8ab5c270842bf29c0aa4eb5626c62ca87a01917ad65fe71a1b2d2b956f17c081dc759ce2cee", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480154, "uuid": "08f2d04d-93ac-4bea-a07c-01a5e14bedf5", "value": "T14CE48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93FBFCD302514D7432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480154, "uuid": "501c1697-862c-4e92-ab16-88b43145a7f9", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480154, "uuid": "e0e57eb6-7767-4444-8dc0-e5c78106e8f3", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7VvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5znCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648480154, "uuid": "95c095f1-d115-40db-832a-0ee58674193c", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648480154, "uuid": "d8359aed-463b-4340-bd89-6fe926b05d47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480154, "uuid": "1f2060c3-2913-4d24-9a04-c5201f3a09cb", "value": "emotet_exe_e4_5aa3281084a39e9722f599a8a5c4603093e762f191e71ce506d16fbed4778083_2022-03-28__150907.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c230b6-aec7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648493406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648493406, "uuid": "53e27268-0707-44b9-b482-c475b80a6d6d", "comment": "Malware payload (Mirai)", "value": "1db0c3c9266deea06c2e153b40d01846", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648493406, "uuid": "8615e2f8-8b80-4fd2-abdf-787d72c714d9", "comment": "Malware payload (Mirai)", "value": "5ac440c21fa5d8263a3b69850568357adcc04faa5440f5bfacffabbf02c297b1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648493406, "uuid": "25ca204e-965b-4385-a585-941816bee097", "comment": "Malware payload (Mirai)", "value": "c0fa711cf53881abb3da6a3a3b19744118e52371", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648493406, "uuid": "56872459-1d06-43c7-bde1-6f20a7cae5b0", "comment": "Malware payload (Mirai)", "value": "3e12bdf3df502e7d045d98a39dba3e82798d3f08262b6cfcf8293933e9a074c375c7980f5a553fc4f72c943af595867e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648493406, "uuid": "643f4778-8c99-42ca-909b-e6fa4282c228", "value": "T126B2D0727014F8A7C7A20177AEEDCB43BB800EF8D0E8B3295465099DEAD5D43AAF1147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648493406, "uuid": "265d56e9-f611-4638-8cfe-00784cb0b9f8", "value": "768:5X9nxn8o9wnBoWzEQf2EjKb3puCws3Uoz7:5tn+o9wjfBAZuClz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648493406, "uuid": "a33821b6-5ce6-4d40-87b1-eb97193f6ffa", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648493406, "uuid": "6d323ed1-c57d-4e21-8415-3f97e494f973", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648493406, "uuid": "fde22cd6-8b31-4afd-bc15-7b5d0a2257bb", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c60e5ee-aebe-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648489208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489208, "uuid": "b131e03c-b111-4783-835e-4970fb7d5b49", "comment": "Malware payload (Heodo)", "value": "8b6b260de89b49b889fbf328f9e0098d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489208, "uuid": "54a2576f-53cc-49b5-b5ee-4826038d6698", "comment": "Malware payload (Heodo)", "value": "5b58a8445c8e7377c21cac82e47d1bdcdc99f7631599ad64e8f2e862511fb941", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489208, "uuid": "0939608a-9ca5-43b2-8023-520feb36ba28", "comment": "Malware payload (Heodo)", "value": "a7c53d096ef53adc957da632d71724f001599208", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489208, "uuid": "47eec81d-3d4f-48d9-9b73-9ee70467d9a3", "comment": "Malware payload (Heodo)", "value": "00bc35cf7bd117b24374e745f7b640ef40b115410114fc9bc08018689857afa46b398fb02c7ebcee686854ed2aabce88", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489208, "uuid": "65aba23e-a4c7-4d3a-9a7f-3f84965ae535", "value": "T181E48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514D7432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489208, "uuid": "e61c7f4e-a72b-403f-bcaa-1d863a62e7ef", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489208, "uuid": "6668b9b0-bb84-4ac3-a61b-9f32bb4f6c2c", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7GvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zoCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648489208, "uuid": "977aaf28-80c9-4f3e-bea4-ba399d3f647f", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648489208, "uuid": "b216e207-55d6-4113-957a-26bc92f1891b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489208, "uuid": "e165fc6d-84d5-41e5-b789-9167d26c9099", "value": "nE1a67dlTVqhv.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9c35ca-aeec-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648509103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509103, "uuid": "3dde8c8d-1905-431c-b34a-8f9e55ebffac", "comment": "Malware payload (Heodo)", "value": "4d81f2843774b5943b444766f58dee87", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509103, "uuid": "33cc2274-9b50-4e1f-aa2e-4663d50c556b", "comment": "Malware payload (Heodo)", "value": "5b930676f1e004567e36e1a52f4e84153457b91d316e3af72a93c8c646d59aa9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509103, "uuid": "7a383b0b-3e98-4736-b06b-f641ba28a3be", "comment": "Malware payload (Heodo)", "value": "67155d7a67a46bdd8cc97ca8de202f0653d88fca", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509103, "uuid": "bec63b95-0cd6-43f0-ab19-028aa47d0a0f", "comment": "Malware payload (Heodo)", "value": "29129d620ff3346ea0d93fe75826744d47ed90ec7ceb4614e19f915f38465b2993ee1856b4780038c0a8f12370eb208c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509103, "uuid": "b9fa9173-3335-44b6-a1f9-fe919d877bcb", "value": "T1C6C3AD8BB659486DF921877488DB879A7363FC344FAB47473214F3366EB95A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509103, "uuid": "4e4b0bb2-2520-4ff9-85e4-cb1863120677", "value": "3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlCd:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648509103, "uuid": "9b9c8857-e011-461b-8c84-814f27d6839c", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648509103, "uuid": "8d2bd10a-d637-4a56-a2d0-fea6524c1c33", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509103, "uuid": "15cca492-5632-438a-8ce7-6855a75e8b13", "value": "4d81f2843774b5943b444766f58dee87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1575d3c4-ae69-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648452689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452689, "uuid": "e106a1fb-283a-4da4-8d0e-7a3342b877ef", "comment": "Malware payload (AgentTesla)", "value": "64dd885d6fb26f4a1aaa4ecc60fcf0d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452689, "uuid": "9d180c9b-734d-466b-b428-99c581366997", "comment": "Malware payload (AgentTesla)", "value": "5bb38f1a14889884fbbcc88e766f6f37bf0efa339144776dd7e46c1983f2895c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452689, "uuid": "2829ff9b-3df1-4878-9fc0-ba54c9fce7c6", "comment": "Malware payload (AgentTesla)", "value": "09963f5a87afb5d6cab80c682e601715e053d41b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452689, "uuid": "dde9d0c2-c849-469e-bb25-c42c8904c612", "comment": "Malware payload (AgentTesla)", "value": "0803dbb2cf4e889cff718b67fd3f03d612d65cb06f84551ff136d56e827ddd19916e783944369a972633df07a3c9cae4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452689, "uuid": "acfb92a4-0512-4f9e-adc2-b58b66998314", "value": "T15714129C390DC0C4D6DB7DB127A3F617686CDCD2426BBC6B2926F1675C741348BA8A32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452689, "uuid": "22502a51-508a-4f8c-a239-4e5f15034f66", "value": "3072:OvJuLy7OmG0V8/6eLNdfUKzG061SPa4BMYkmfrl3aIJAqYves6aNkVu4Hn+hYzK:quLy7O6Je7sKzda4Baw9KHesuL+hz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452689, "uuid": "1371e63b-6e85-4580-b31c-c7e91990c940", "value": 192456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452689, "uuid": "1dcab762-228b-4f89-b2cf-81fa0c23c3b0", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452689, "uuid": "d4c3e5b2-3214-46fe-bcf2-f686b9a68f28", "value": "SB882H-ON.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795f935d-aea0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648476479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648476479, "uuid": "64050f55-a04f-44fa-b6d8-75fdb431c326", "comment": "Malware payload (Formbook)", "value": "c4a4cb21df1314e124d53c7fc25816ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648476479, "uuid": "2dd53afe-0d3b-4856-814c-16b4f521ac90", "comment": "Malware payload (Formbook)", "value": "5c685312f37342da546697e0b78b9cab5a3abb9d3d11a0de4620c97fbc84f7b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648476479, "uuid": "aec934d0-1e47-41cc-99f8-3fe4f047df22", "comment": "Malware payload (Formbook)", "value": "8aa061fd6a337420106bc6bc62dfcf94f713a4ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648476479, "uuid": "61aa2b0e-6360-4e7c-b7c6-cc410d097eac", "comment": "Malware payload (Formbook)", "value": "f0694b9e7e969afb3524c20e3af996a0b8acaa974165d34d69b5d4dee0fdf686361d1e2da702b4e19173f32d61277e5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648476479, "uuid": "a301da4b-7882-4990-910e-976bbdce6165", "value": "T15735F00132B02B05E07A67B6DC6840DC47717E5A6E7DE21F2EC235CF1A71B819A2AF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648476479, "uuid": "1a487167-371b-48c9-bf7f-7f2f21bbf42e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648476479, "uuid": "f769eae5-9584-4999-b94a-0935ac648b42", "value": "24576:pprGY9dxPKKikPraiXGV9jjj0LUvre29W:bCKRPraiXGzjjIOreQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648476479, "uuid": "62a2de77-0f57-45ca-8498-bc1dbfe24179", "value": 1127424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648476479, "uuid": "d20c0ec1-851d-49ee-9d55-837963103516", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648476479, "uuid": "9595432e-848c-4fb2-a750-302931ea05db", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d6cf8f-ae6c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648454279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454279, "uuid": "292c1aaf-61bd-4b78-be1e-2855c5331471", "comment": "Malware payload (Formbook)", "value": "7aa171dcc95a5688afef777bd35c3362", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454279, "uuid": "9691a45f-fad9-424b-bdb1-b532ecf1974a", "comment": "Malware payload (Formbook)", "value": "5ca418966344069c56b13298c8d0f32523dfdde38cd6a252ee0e8eb3f6a40302", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454279, "uuid": "b2738543-2ce0-4c05-b005-32d45b366878", "comment": "Malware payload (Formbook)", "value": "19f4b579002fe44aed9b67f3f0284ca8c9c042f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454279, "uuid": "85d9defb-8033-478d-b134-58e50f5b1815", "comment": "Malware payload (Formbook)", "value": "2d09b6e2a2e56799de842abcc6b7e9032400c0fe1559eff23fd649d00ca33fa88cf4b36b8f2c453f9a5aa7d2c4d577a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454279, "uuid": "3bc99120-1d27-4139-bfcc-d7cc1dea78ef", "value": "T18575B1C2619CBCD7E07C49302B77A7F0A39DEC535819C5396AC5322AD6BC2537DA2788", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454279, "uuid": "5fcd7045-bad9-426a-a9fe-03fed77236d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454279, "uuid": "55128d29-a15c-4c27-937f-d97b83bff5dc", "value": "12288:iXzfGgTpN+28/Z4Bv9lRLrPfg7rClv9zyoeyC6DcoCwS:WKgdN+2YsdfcCrleyCMcoCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648454279, "uuid": "1de29815-1152-4241-86fb-1cb54161b127", "value": 1682432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648454279, "uuid": "6dcf7206-193d-46b4-807e-8b574160265d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454279, "uuid": "12596776-beba-472b-b289-88469e879f4b", "value": "7aa171dcc95a5688afef777bd35c3362.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2027c76f-ae7b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648460438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460438, "uuid": "8c0c58b2-db11-4695-8749-d438d7a01f58", "comment": "Malware payload (Heodo)", "value": "abb81ccd40ff7fbc52f60510ce46c023", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460438, "uuid": "e8c4b673-aa5a-4e81-a68c-0dccd825fafa", "comment": "Malware payload (Heodo)", "value": "5e071bfb6ce813a840a2d6aa532b40f70315b19b5a44724b9707cc8fab87131a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460438, "uuid": "53961aaf-c0d9-4ba4-be71-12d55562c6a4", "comment": "Malware payload (Heodo)", "value": "94eef78e49b97dc24a5a354bdfaecdfb7ee738b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460438, "uuid": "bc93bc4a-903c-4030-a14a-e279e5f41971", "comment": "Malware payload (Heodo)", "value": "013ee3853f485b66a5265c744157f64688a7a2a2592fedb925aec819b76b5d867e9a52c041cdca86776e7c7f47aea469", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460438, "uuid": "07334448-5bd1-463a-8d35-14497e2b71f4", "value": "T15694CF0272D0C47AC6EF23785D239B5AA7F9FC208A75C647A751BF8D5E326C1893034A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460438, "uuid": "14f70385-5efc-4b49-b70b-96305852f770", "value": "8f8b1cb86c6697dd342b65a36c6ccbb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460438, "uuid": "0828eba6-15d0-435d-a0ec-297a59df9809", "value": "12288:zwn2hR3547jpDMgySBxpuCMS5AhugWarPU:DRJ47xjy2puCMSqumrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648460438, "uuid": "e869a110-6dd1-4673-b761-74bf36a27174", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648460438, "uuid": "6c4c86c0-38cb-4986-b744-451b618dc718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460438, "uuid": "d3f72b20-01fe-4aa4-aebb-94a166f0025e", "value": "abb81ccd40ff7fbc52f60510ce46c023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6330396-ae68-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648452637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452637, "uuid": "a5acdae5-9b5e-4491-aaf6-b6353a5b29d3", "comment": "Malware payload (Loki)", "value": "ac258fc02672f71f8190ffa1f3a81773", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452637, "uuid": "a112aa6b-ad7f-4b33-b17f-fe469090ce30", "comment": "Malware payload (Loki)", "value": "5e91c26eba234febe91e009c79672e2313732f33aaf00af605a863d96e7ea6e5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452637, "uuid": "cf8b14b0-a729-4c3e-ac80-7c6be4c3bfde", "comment": "Malware payload (Loki)", "value": "92bb5275e0579169c066e20009c98657fe32e816", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452637, "uuid": "a89b2cd3-2ea3-477a-824f-ba2ae7798d11", "comment": "Malware payload (Loki)", "value": "d718aa420f933828904d264a85ec2805b371a57f0dc2770826f1085e54cb9164da2b6f489bede729e92e7a5ca8967813", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452637, "uuid": "0040bf31-da25-490e-84e1-8b9ac5a99016", "value": "T19214120163A38186FC66F67CE4B3B56DA789EE685EBF0352B6857FDC487884C7700249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452637, "uuid": "33b4bc14-10e1-4499-a6b5-a8ecb38aeb3e", "value": "3072:NAMEIK2UqmMJJShdEu8zUre5kYy/SjymlL9x9KmYV5vSYBUfkbcDRutfA8FzkJaX:U2fmMJJShyA65hDymF9xUpvxUfA08tvp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452637, "uuid": "823beed5-1759-4587-a69b-999ba2cd5a41", "value": 192312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452637, "uuid": "c74a2dd2-edd0-4612-923d-e55b4bce0d6e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452637, "uuid": "4cac02ed-cb84-49b5-bb17-74d2ddb315f3", "value": "Revised overdue invoices.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8b91be-ae5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447893, "uuid": "c63ea0e9-4ef7-40e0-b022-60f5a8ee6529", "comment": "Malware payload (Stop)", "value": "5edd75b25716dcf45956a118565799d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447893, "uuid": "cb05770a-e660-4589-a821-72997bf66b66", "comment": "Malware payload (Stop)", "value": "5ec2a6f1692c51a478c33c800cd12a1237de2c1dfd4e6a1982fdd05b23bd69d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447893, "uuid": "b79786ab-b523-4f5c-9157-378e2534954a", "comment": "Malware payload (Stop)", "value": "6062a4fafeda30cfc78393413bf65ed100759192", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447893, "uuid": "f9542df1-1e45-489d-a5c1-32de0600e5ac", "comment": "Malware payload (Stop)", "value": "55b495ac8fe131985413eddd642655a521aa72d4ac5a331e1257016694e0ead33575b4692583c555a6dbecdbb26b416e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447893, "uuid": "dc382c96-98d1-45e9-a59a-61127589de45", "value": "T161F423227504E031C8886A32F41587B95BF5A832D5A7471B77D921EC5EB03E22EFB786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447893, "uuid": "57c96392-03f3-40eb-8b6c-9a61a17f01e8", "value": "f84c6b8ca58d51fa74cec891420e31aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447893, "uuid": "0f215258-a915-4460-a547-993f0f71921d", "value": "12288:NARAq/zoJSL63emLaToT3bk4VLSgTpACt3QwcHg2ZpN0V0F/aGqWw9juu:NARproJqulLHbkq5TSvwkzoV0KWw9qu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447893, "uuid": "e34de4fe-31aa-47ec-9c78-4ef752a12d86", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447893, "uuid": "3af9724e-9f98-4bd6-b720-8b8de4569ecf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447893, "uuid": "bbc75843-f021-4a51-bc4b-1e505cb530b7", "value": "5ec2a6f1692c51a478c33c800cd12a1237de2c1dfd4e6a1982fdd05b23bd69d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3748e64c-ae5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648446303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446303, "uuid": "a75c311b-74ba-4f51-8564-d1100531d1e5", "comment": "Malware payload (SilentBuilder)", "value": "fb97968b734b1c01c40bd95e5d84eac1", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446303, "uuid": "c41140e6-747b-426c-963e-2ac1d8077993", "comment": "Malware payload (SilentBuilder)", "value": "5eecb36625287f42782d5817667119e77d4f30191701232f0cc131e18dc72447", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446303, "uuid": "d9267716-e3c0-436d-994c-5035d6a0c2df", "comment": "Malware payload (SilentBuilder)", "value": "5e3d7b6de776d954b0071eac1a1a1cb3be48f8a4", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446303, "uuid": "4009c6d3-de22-49c7-a89f-b4461697c905", "comment": "Malware payload (SilentBuilder)", "value": "17f17968091589decd8b9e63560a0ccd0dd4868e77300d4df2833359629128108b1bd639e3264745e769bce0010e6a8a", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446303, "uuid": "4c57478b-aeb0-4d2b-9b3a-0e243fd10ab0", "value": "T18243E95BBA49985DEA14877548E743997323FC304F6B074B3269F3257FF89A05A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446303, "uuid": "cadc10a3-4755-48f4-94c3-f16db751f3fd", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umvz:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648446303, "uuid": "46a11116-7d3d-454b-86c9-f9555eacc406", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648446303, "uuid": "32d35b05-11cb-4f25-a47b-2ad8d758f885", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446303, "uuid": "40ba12ad-1721-40e1-a04f-e6d64148fe0e", "value": "2022-03-28_1149.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21103d6-aebd-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648489056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489056, "uuid": "2d7cbafd-314a-4673-8e9f-bed32ccf7f6c", "comment": "Malware payload (AgentTesla)", "value": "bdf420bd5105aeeedda79c5a1fb1be3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489056, "uuid": "898a1fe3-eb0b-494f-aeb1-4f4654e92332", "comment": "Malware payload (AgentTesla)", "value": "5fa3f14f6ca1b603b38f4208b4a8aca890bb7dd84a628554c86ea6bdbdd95887", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489056, "uuid": "ac76b936-0115-45e1-b615-8213d5ee196a", "comment": "Malware payload (AgentTesla)", "value": "d1f8961d6125977f7a823e81c96a5098f9cfe7f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489056, "uuid": "7c9db4e2-8cc6-43c1-8182-f7513455b543", "comment": "Malware payload (AgentTesla)", "value": "fef20368a5a608a4599dc90d8c0eb8b4e49a3724f071b0d2ba090d417bbe3e379bd095d13e0c8507af2ae4d1186f1616", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489056, "uuid": "24f041e6-c003-45f5-a365-02ae58991138", "value": "T198C4812C7E61A76AEF5D813089410778FF220F032272E9B6739B31DA877F0A55D47896", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489056, "uuid": "247eaa95-1366-4fe4-9364-a23ea34f518f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489056, "uuid": "a4373e04-700e-4693-abd6-4b0f993214e3", "value": "12288:lPcugYUwx2d7TKix5aAsf+6REm+t6LjAd6o9sK5iMDk4ftV5RY3AoHgWfw4zxnnr:tc+xU7lRCCXt6PAd6o9sK5iMDk4ftV5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648489056, "uuid": "9b631c68-1d03-4e99-9f6c-182e4f2307db", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648489056, "uuid": "cdaee6fc-1838-4a0c-8ab8-a1cf51cda9aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489056, "uuid": "42eca2ed-cc4f-462a-bb07-7b1710b44b14", "value": "HN LUXURY_ VSL PARTICUARS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f585c6-ae72-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1648456636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456636, "uuid": "b3bd402c-4e0d-42dd-9a0a-28d3cda420a6", "comment": "Malware payload (Quakbot)", "value": "3354facb1d4949252e18fa47a2cb3183", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456636, "uuid": "c1993fa0-4489-4f74-8a37-512e3e780952", "comment": "Malware payload (Quakbot)", "value": "6060ddd68430dee525731be956ca1b656866a21a51efcd0e5bed1e15d976a664", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456636, "uuid": "e493275b-a63a-493f-b6c9-af387893bb4e", "comment": "Malware payload (Quakbot)", "value": "7d3f8b06c7fcafbd5678111d37e484cd1b148629", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456636, "uuid": "ad5e6d31-0b55-4e94-ab28-d13664d4c59f", "comment": "Malware payload (Quakbot)", "value": "380a65bde2623e1d201502b9017e2c441fb49a6631751ff8150c83a66ad9f42baf5ba8d1373ba913a7cd117b9d5b8a19", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456636, "uuid": "a58314f5-7e73-4192-aec9-e9b4c8c7a776", "value": "T18344D04272459439E8EE973414CB4A96923BFC20DA5A5B4B131333FA3F796B05E133AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456636, "uuid": "bcec3759-3f42-45d7-891a-3fc3973243da", "value": "6144:UKpb8rGYrMPe3q7Q0XV5xtuE8vG8UM+AEpBLgoN8uJCLpgV2ZV2VUSpbLjtdo:zpBLgAgtgV2ZQ2ALjtdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648456636, "uuid": "dca52046-942f-4efa-b580-30dd0ace5a84", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648456636, "uuid": "a169aa7c-dc34-480b-8cd2-e9e99ab98f43", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456636, "uuid": "1f8afb80-ccab-47c3-b090-030e42874445", "value": "llauiquma.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa32a529-ae81-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648463247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463247, "uuid": "5daf9bc4-ad6b-4b35-be55-a942f2442c00", "comment": "Malware payload (Heodo)", "value": "4da0bace5584940a07bff9bbc6870817", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463247, "uuid": "300d8eea-dd57-4593-9a48-171bf59aeb26", "comment": "Malware payload (Heodo)", "value": "60e017b2d8e592d76bd95284f271e19a2a5739f69a6403524dfbfa22010d531f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463247, "uuid": "b75cf60c-8f2e-47f2-a491-b2707dea3e69", "comment": "Malware payload (Heodo)", "value": "a4356cef2a60f1974321320d532b9d690d1bc9f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463247, "uuid": "02e06109-e5e8-42df-bcba-a86c4116d8e9", "comment": "Malware payload (Heodo)", "value": "1d54d4b2cb3326f7c3d2dbaa022680ba0882e29ee2c41155ebd9815f044e07062496aa689b8784869a7f71b8faab3e18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463247, "uuid": "44ac89d0-9954-42af-b74a-3993bf103b8e", "value": "T1D694CF0272D0C47AC6EF23785D239B5AA7F9FC208A75C647A751BF8D5E326C1893034A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463247, "uuid": "51207d5a-a774-447a-b554-1a14d85e3f6f", "value": "8f8b1cb86c6697dd342b65a36c6ccbb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463247, "uuid": "d49b6862-9fb6-421e-a2ef-850041899025", "value": "12288:zwn2hR3547jpDMgyS8xpuCMS5AhugWarPU:DRJ47xjyfpuCMSqumrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648463247, "uuid": "ae2d25df-f8e9-4627-b01e-2a9dc781f57d", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648463247, "uuid": "608dd044-0257-428e-8ac7-d5a500dc0dab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463247, "uuid": "6d4382f1-00e0-4526-9766-fd275d2b73cc", "value": "4da0bace5584940a07bff9bbc6870817", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ca7aaf-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448012, "uuid": "2634af94-d328-4ea0-8c97-27a9b1cccdd0", "comment": "Malware payload (Stop)", "value": "681a077f007bafe3d8f60b6c02b7d354", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448012, "uuid": "82500cda-4449-4cea-897e-3a436aae576f", "comment": "Malware payload (Stop)", "value": "61bf101331e2a50abeade76febfd557a31c09edfe9a2aea0ba7978a061b1a353", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448012, "uuid": "90bc045c-921c-4387-a8fe-76acaf274b97", "comment": "Malware payload (Stop)", "value": "a55bd4921ced327f80954f69431f63edb4a0a56f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448012, "uuid": "4ecc6de6-f1eb-4d41-a6af-06075ad3efe4", "comment": "Malware payload (Stop)", "value": "5bef23c3443c27d32a4803a034db81e24c968709bb86a4e9c827c56ca009be2b1c9880c3281b5ccbef3f54411e84eee7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448012, "uuid": "c97ff334-91a5-4b01-a2dc-6f11a9f72278", "value": "T14905233263C1E877C29A05715626CBB86DBF38301AB9C7077BA0476D4E313D4E67270A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448012, "uuid": "5b8608e5-68e2-4d9c-8e16-4c1d5adb6e9a", "value": "75e06567c553fd5738bcb732c4034310", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448012, "uuid": "59927d0f-0374-4925-a36e-b129a525068b", "value": "12288:ZhdrUalx6nQpWYvhcQ44y2QTWf603mml+hjA3jPsWdcchDTiEOcPG5lB7aKXjqAH:ZvIBnQpWimVBmzlVDgHvFNuC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448012, "uuid": "462c447d-f76a-4514-8170-cbe7d9d3742c", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448012, "uuid": "46aec0ac-f48e-4c8d-aeaf-59d0694e6d40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448012, "uuid": "3cac372d-fa7c-45bf-a31e-f04e7989b126", "value": "61bf101331e2a50abeade76febfd557a31c09edfe9a2aea0ba7978a061b1a353", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c1db5d-ae31-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648428713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428713, "uuid": "e7726654-3648-4d28-9ff6-d7e26c1f9649", "comment": "Malware payload (Heodo)", "value": "33838cc2872b7961e0982e197cc35092", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428713, "uuid": "a4deed61-d669-40b1-9dcf-155dd3f03514", "comment": "Malware payload (Heodo)", "value": "62d9f07e3acadeca6b6a44edb23a5c14082058e0c3896d6e1bacb8b1a1e59847", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428713, "uuid": "c3c52039-fb28-44db-94fa-0d2e631dd5a2", "comment": "Malware payload (Heodo)", "value": "9c76c4bd3497902ac073b9e0eba2613e70b9839f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428713, "uuid": "c0e0ecf8-0e0d-4e2e-a74b-22fcd5ee4495", "comment": "Malware payload (Heodo)", "value": "7a7b0899378b99a8bfdc1c07b20c47b923e22316383daf94b4c236e52851bab486b214bd06e18911cd26ce64cd83fdbe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428713, "uuid": "0386c793-ea33-4627-acc2-68f60ea38517", "value": "T1C8E49E1177D0C072C2BF3630551AA3B566EABC708DB9860B6FD42A7E2E745829D3871F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428713, "uuid": "2c41f2a5-c9a7-4a2d-88e2-2072ba40c6c6", "value": "923a5ec702466ffd61b422bacc94c6f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428713, "uuid": "02d3fa44-4213-4214-a6a4-52ac6d9ec5b8", "value": "12288:JSycC8Tu2EEAeClIHRFa7UdUzrAKXtI8X0oXYl2N17OP:JSDD7RDhH3dUfrtj0oXYl+OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648428713, "uuid": "1d5106cb-1374-40dc-9711-8206cc6969a7", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648428713, "uuid": "b558eed0-c4b9-4d08-9983-1bc520d78aa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428713, "uuid": "5ad07497-df72-4cc2-a142-dcdb54581153", "value": "33838cc2872b7961e0982e197cc35092", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9802e04-ae68-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648452589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452589, "uuid": "742c2e35-a7dc-4e84-9c24-e3f441f695b1", "comment": "Malware payload", "value": "848a3777471bc172c51cbbdb0a4ea65f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452589, "uuid": "88104ad9-7e03-409f-a21f-7790d2fd5028", "comment": "Malware payload", "value": "63367911d4082d43bdc707a024f3ede1e3ca59006bf95efa4de26b0e333129cd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452589, "uuid": "5861e0e0-2831-4f87-b117-9154427c9a4e", "comment": "Malware payload", "value": "502520d8924d9e537ca8bf0210fe455e458a6c4b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452589, "uuid": "9e36388f-1aa4-4487-a594-f8c3a95b4709", "comment": "Malware payload", "value": "5807f3fa194caefb51e31a2be210c642ade20fd100911b0d318b620c5e34d8ae35938fa87b73e5b3583b8c27f7bbce31", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452589, "uuid": "1fb4e9f3-66cc-42d6-82e5-2670dee42372", "value": "T1057568F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E5651EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452589, "uuid": "8570d508-b85c-4b5e-ae7e-5a20a2232858", "value": "12288:BaA7Pyx6sdENjr4B5CITO/WROLgcba/8maJXM8WAb6C7v5t:BaMPSdWnK596WRaS8mmc6bH7Bt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452589, "uuid": "d94dff15-d330-425c-a988-9eac7ba30033", "value": 1608696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452589, "uuid": "59eef990-0765-422f-acc8-602ff55b97f3", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452589, "uuid": "a9eb1fbb-054c-4794-ab93-b478134aab95", "value": "PO-200345.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe28f2e-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448090, "uuid": "cbccbede-c115-4a63-aeca-ca98a0755a49", "comment": "Malware payload (Stop)", "value": "41a49771a4df4b19dab0217bb29218b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448090, "uuid": "9eb4ee44-74fd-4844-8f8d-96dc19ef9c6f", "comment": "Malware payload (Stop)", "value": "6395b1685411162de16f1720520350b2560992fe8158dc29c3d4bfcd35cc3a56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448090, "uuid": "7e01978e-1ab3-4d92-baac-86a84164d9db", "comment": "Malware payload (Stop)", "value": "0f42166916c98ef3a30158e87cb1eb609f600e2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448090, "uuid": "f3db5eef-7347-487a-bbd6-705a66772942", "comment": "Malware payload (Stop)", "value": "58b5a46f439d6732a25976648f7f6748e3b08b22dcbcf3cd3d5de27be41a2d8d3113ebfff437ebe22e16414078893c94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448090, "uuid": "6872b197-7244-4724-a800-870b19029ae5", "value": "T130F42321624264B0D441A77E6066D7E2063CD97312E72C0336DB583A7EF39C1ADB9F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448090, "uuid": "a94f3756-fb60-4431-9034-4dd13968746e", "value": "f3e2f2b52a9345b2bd8582942ee5c776", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448090, "uuid": "ac4a3f40-23b4-4cad-a296-4373b8ea597e", "value": "12288:DWWDZx+RbvzQimoxb1rUexISePF/ZADY+e2B8moklYYqbObvy3NzOuhVSi0InUxv:DWe0brjVp1rUlL/ZAm2B81kVZMNzOjvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448090, "uuid": "5a824d16-cd93-4779-82d9-3cbc841e356c", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448090, "uuid": "03371e5f-adf0-4743-8ffe-0e189dcb5cfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448090, "uuid": "4f808d12-4f3b-4804-871c-f1f16d649d0b", "value": "6395b1685411162de16f1720520350b2560992fe8158dc29c3d4bfcd35cc3a56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345cac2c-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448017, "uuid": "53f344be-9de5-43d5-88ad-d9718402592a", "comment": "Malware payload (Stop)", "value": "3e8d0f5422dfac6e274f96cc8522981b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448017, "uuid": "cfd7aa66-0c56-44c9-9df4-bbdff53335ee", "comment": "Malware payload (Stop)", "value": "63aa078445137e619fd3f1497eac18ee28a64796ae5e22a651bc4c3b48da6b72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448017, "uuid": "a4a5e320-b6dc-49cd-8271-f1c685d04a69", "comment": "Malware payload (Stop)", "value": "4296ed30edb1d65cd501d65288dc102fa794ec2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448017, "uuid": "3f28388a-41f8-4361-af46-3d78ad10bfd1", "comment": "Malware payload (Stop)", "value": "9db73b72235517535722867ce76285db2fab9708e7a2bfbcd866b0d86e85cb96ff8eb620036990ac09d7ad11d66b77d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448017, "uuid": "8a34d128-1311-4d9d-96de-ea082cb337e0", "value": "T16A050110B750C435E0AB11F889BA9369B43F7EB16B25A1CB23D656EF1638AD1EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448017, "uuid": "254d7a54-3208-4ee3-a030-7d32e6086854", "value": "42499a002b9d8635fd26126765c4da68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448017, "uuid": "1b94cf85-250c-4cb0-af70-0b2e13359d0a", "value": "24576:Tk1Fg6Fuy7R7CpxfXYadAGFwcxbfG0Yi:Ig63VCnvxlG0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448017, "uuid": "3f08bae9-8176-469a-ad97-54a3f98dae69", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448017, "uuid": "a976534a-c364-4b9d-adbe-a452f6f22a34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448017, "uuid": "491ab894-fdb8-4654-94ff-3834a3849c89", "value": "63aa078445137e619fd3f1497eac18ee28a64796ae5e22a651bc4c3b48da6b72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae79a3d-aeda-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648501554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648501554, "uuid": "976228b7-bbc2-43f1-93df-cad44de864ff", "comment": "Malware payload (AgentTesla)", "value": "beee18b159bb132feaab3c5c3c17a473", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648501554, "uuid": "f550e098-dc99-4498-83a9-2bde292eaac3", "comment": "Malware payload (AgentTesla)", "value": "63c91fa1eade0720aaaafadc134c2ccaa9e541b444fbd2a8d33f446d2761bc77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648501554, "uuid": "9f7fe6a8-df1c-411c-8b23-f2c3abf12dba", "comment": "Malware payload (AgentTesla)", "value": "ebd9a2575b4c16e317b11719efecdf60a3e8c487", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648501554, "uuid": "0acf789c-486c-44bb-a3ff-adb3c5c43de3", "comment": "Malware payload (AgentTesla)", "value": "bfbbcc9d3125d31d030f5be4d8e9ebfcafadf827690c3d3cfc4c6b78ca05727e58c9846e7e058bbd8f0bbfde606503d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648501554, "uuid": "f2908e44-a678-4538-a316-413a57e922e1", "value": "T132C4CF32D3F92F1BE17E53395420841537E6EB46B62DCA46FDB620AA8572BD24472F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648501554, "uuid": "403eba40-8eec-4ee6-9c2b-f9f367cff992", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648501554, "uuid": "baf83ff4-6611-4d02-bca3-21992dab55aa", "value": "12288:c3xTOvQXOdy/gjjqV3r/MA6V/i5d+FAcBEeqek:sxTOvQXcy/gjjIr/MAgKBcBEzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648501554, "uuid": "cdcf1b72-b089-4ec1-8ec3-e6246e21bf62", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648501554, "uuid": "b498e088-6f16-48aa-b69c-4b38959a89ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648501554, "uuid": "259c9b12-1011-45d8-af29-087384bda5af", "value": "DEBIT NOTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c9a8dd-ae9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648475936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648475936, "uuid": "8bcc6e8c-1582-4819-b055-df56edd36119", "comment": "Malware payload (Formbook)", "value": "5008c7dc12c3366afa36ade61ede05d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648475936, "uuid": "1b6c45a0-0175-423e-a1a3-c72469fb26b0", "comment": "Malware payload (Formbook)", "value": "63fef1355c2426329defba3c5fc037b68085c45196ab8bd7ff2991b5dcfc80c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648475936, "uuid": "08f96399-ceb4-4af3-9293-65b0e90baf71", "comment": "Malware payload (Formbook)", "value": "fadac06e4fa1e5ca209681b42d377eb170d31368", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648475936, "uuid": "fd1978bb-dac1-4ca6-96cc-85b8433cb41e", "comment": "Malware payload (Formbook)", "value": "910adb235163f5d09985d790c7eeb982864d7b521a3a513dd7932a4814e01409eced775af1201282e1a352cb13681dda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648475936, "uuid": "655865d6-9bba-4688-9e46-8dc5c88e9de9", "value": "T123058E2DA29044B6D03327748D57A3B9AD377E002E14E98A67F93D8C5F3B74079292B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648475936, "uuid": "37fbb619-8b1b-42a5-a5c2-2c4257825c24", "value": "050411d35bbff71bc05083b3cfc98bc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648475936, "uuid": "8c953145-639e-4975-8920-5109141fa9c9", "value": "24576:K01V/cee2U63yS26THrITr7Ruy/dpjZOrPdCLHOmS:K01Ve2dyqql7OPdCLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648475936, "uuid": "c5a71c4c-894a-49dc-b5df-4d394c94107e", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648475936, "uuid": "2d66e854-5b11-44a1-a925-52013a807c0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648475936, "uuid": "a354a7bd-b1a5-4ac1-88ff-9110a01df3e5", "value": "TransferCompleteUSD30000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d55ada4-ae81-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648463010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463010, "uuid": "89f57d78-70a3-46bd-b210-2f8caaee96c8", "comment": "Malware payload", "value": "6cf0eb0ca30cd2ad51cf932772b9f33b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463010, "uuid": "8596e6a4-01f7-45b1-981d-514cbc61d7f6", "comment": "Malware payload", "value": "644b42f1122acd4ea81ba65040496aca7eadc318a319716a1533a047dd073777", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463010, "uuid": "a6225e88-3117-4ac4-bf7b-6ca1b11fd9d8", "comment": "Malware payload", "value": "c92ecacc83f1f090f96d64aea47e45aded1d5ab0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463010, "uuid": "8552ab76-87a6-49fb-8f06-2d71f25827df", "comment": "Malware payload", "value": "762960cfab472b6bf8706c0c462a559506470e603821edc31f71241837babba5fad60d2448991e325202ab00a5e98784", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463010, "uuid": "86ba7baf-9324-4504-8c13-8349d97fccda", "value": "T167830297AA590E7BA568AAF3D4D8F48388EBC413B6C4647DF364CC31C66B81361A9047", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463010, "uuid": "7d0be099-837b-4828-9f64-02e8bebdaffe", "value": "1536:6otqPd0GRgxdta7QhHWz0BhbW1XXzIyPlqYzHhaCE+uSrRZ0/sNKtuKum2ac:6oUC79WwBhbW1XXzISdha8e1cmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648463010, "uuid": "9b2d120f-6455-428d-82f9-b00eb7905157", "value": 81137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648463010, "uuid": "4eccda2e-68e8-4c45-905b-740252ab76ed", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463010, "uuid": "e9a39f48-f776-4ccc-8dcc-0fa98ca6919f", "value": "Richiesta preventivi 28\u00b703\u00b72022\u00b7pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629dc9b2-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448094, "uuid": "51b28795-e267-4486-bcab-65096b0ff3e7", "comment": "Malware payload (Stop)", "value": "e69a67db458821fb7c4e87baafad26a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448094, "uuid": "282a9d74-a91c-407b-974b-a051f000647c", "comment": "Malware payload (Stop)", "value": "6465e8cab5f5bff0e50c8a4d36c66fda4317584e166934ba315c51ca5c707618", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448094, "uuid": "7a665253-a9ce-4f61-9ffb-f7bc503de29c", "comment": "Malware payload (Stop)", "value": "163ad4107fd9ab2f7a921c1e643fddabcb7f5b0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448094, "uuid": "3427f8ea-8cb8-4502-92c2-98fce55ddd3c", "comment": "Malware payload (Stop)", "value": "a797ff6bf37d707d736218d18a35967bd74ca8035c9e1c09718ed64c257003e56fc89213eccb9cbd57981e16a155cdba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448094, "uuid": "984e13b1-0eeb-4583-862e-b0596258d20b", "value": "T15DF423727E8190B2E85D847F7816E371197EB43405A6E84B3F2919AD0F503E293E73A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448094, "uuid": "d93d928a-475f-4543-ad95-bacb5cbd9df3", "value": "98af1336ee9a8378f1e2c2d0d9027760", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448094, "uuid": "f10fe598-ba0a-4209-a543-4b12a12d1297", "value": "12288:Oa4DINwpxsKLuKOL7Pz8QRXSfATs23htK+vQRwzBs:OmNwpdLuxvPz8YXSfAt3IRuBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448094, "uuid": "fb2be803-b447-4d58-8467-5881cf3f83d9", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448094, "uuid": "30b1d4a6-923f-4f34-b648-27a8f1cae945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448094, "uuid": "c9abeb87-af1c-44d9-8c45-cbe791a0ebbe", "value": "6465e8cab5f5bff0e50c8a4d36c66fda4317584e166934ba315c51ca5c707618", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba84c29-ae68-11ec-8e58-42010a9c0032", "comment": "Malware payload (SystemBC)", "timestamp": 1648452512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452512, "uuid": "63b1a0cf-054f-4630-bb69-31409652e983", "comment": "Malware payload (SystemBC)", "value": "142939679afaeaf6cf66d3b80ea7d63e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452512, "uuid": "18c14fb4-1494-4914-860b-baa73bb4d6a5", "comment": "Malware payload (SystemBC)", "value": "64efd694a2e536ed7265fb46da5198788d895a9b7b9c2434404209b61c143a5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452512, "uuid": "7bd50e23-fa7d-4a1b-90f7-c851a978ef92", "comment": "Malware payload (SystemBC)", "value": "149465fd8b48f262bcf361047bb8035b5b1f33a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452512, "uuid": "ba5b4f08-ff99-43c1-8123-05b64694d247", "comment": "Malware payload (SystemBC)", "value": "82d2ab2a3262669613e350404921d5376e72eaf617a950e8f50b211bf2c483d1f15e860f69daba4a6a2b1f20d68c1a83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452512, "uuid": "ebf02700-4b3a-4a93-8964-9e8bc43f6e79", "value": "T10B44AE023AA2C833F2260675AC5AC7B0DA7B787159359A872BC6465D5F333D3DF68306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452512, "uuid": "1e777b90-5011-4720-ac0a-bd420ef158d9", "value": "1690f0efc188c620ac36940e114b98ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452512, "uuid": "9c128667-6992-436a-bb17-7e05117bdebe", "value": "3072:tkAEMcDyU3V1mNfgjoBiDHdIQCYe2kZkV867F6lPWg2l:w5Fl1mNfgjoED9II7Geb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452512, "uuid": "77986689-b05f-4c3f-8106-babe2287d6de", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452512, "uuid": "fd3d38ff-def9-4de4-a8e3-6a485d32d669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452512, "uuid": "246926d3-8b59-49d1-8eab-4c8414981cb0", "value": "142939679afaeaf6cf66d3b80ea7d63e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b971e4f-aea1-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648476832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648476832, "uuid": "4af8917b-7f1b-4096-94e1-2011b286c796", "comment": "Malware payload (NanoCore)", "value": "d2a4b5b3235d2cf22b1e6baa8bbe3117", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648476832, "uuid": "bdba5f2f-5394-4dda-92d3-74501d2d352c", "comment": "Malware payload (NanoCore)", "value": "6520e324bcf3cc63672a9501ae6f8a3614a2ef99a48d979b3a0699b184a7532f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648476832, "uuid": "ac13a4a9-51a8-4bfd-8f36-463da728d6e8", "comment": "Malware payload (NanoCore)", "value": "3cf391c4ea060d5e646b0040f955609d1413fe37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648476832, "uuid": "2b8785df-5d04-4ba3-892c-7e2daf606d39", "comment": "Malware payload (NanoCore)", "value": "546d1b36caf6283f3c13fc4b757c7dc9b582eac452ec1f98b1af16e7f7a3362f56f0a5912895c909edabf5c93f2136f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648476832, "uuid": "12cf5985-908f-41ca-8ebd-29fa26966cb3", "value": "T1235412059B40D9E7C94201713AF1BB6AD7B78A5F414B1C57CF682FEB3762B4B9888360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648476832, "uuid": "9680fed6-062d-4e1b-a709-1332c9ac57e8", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648476832, "uuid": "985c2634-2db5-42b9-beb8-34ea253811c5", "value": "6144:rGiwLrMblynQeKb/vQPGQFVFkSJQPtWaCLRCLaVgi49QQkszM:MrMblQKb3+bwkaCL8LXi49y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648476832, "uuid": "0563b364-5e0a-4d6d-897a-3c26e36cc253", "value": 301401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648476832, "uuid": "729ec7e7-4988-41d6-ae2b-23e0481e6835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648476832, "uuid": "8ff1919f-974a-4d36-a739-445cb6b4e57a", "value": "lt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4eecb1d-ae8d-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648468392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468392, "uuid": "76801c79-1ec9-4086-931a-6fed85ae6ddc", "comment": "Malware payload (SnakeKeylogger)", "value": "6f4130f71665f8d5dcf5a28efb5e283c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468392, "uuid": "fdd54ee9-cecc-448b-a9ae-5548b9875a8a", "comment": "Malware payload (SnakeKeylogger)", "value": "65cd9b6bd49b169d23c16444029431e2a2d5013a854c826bdf3a675ab2d1f695", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468392, "uuid": "39548a4a-49de-4eb8-8b69-00c2a6eb8108", "comment": "Malware payload (SnakeKeylogger)", "value": "3644fdb2fe525f21f1b2043e06e55e2adf5a7875", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468392, "uuid": "13ddb2b6-1520-41d9-ab4d-e21172233327", "comment": "Malware payload (SnakeKeylogger)", "value": "a9b5e1a6751922383cb84c111ac9cdb37c1ef1ce2dd278dea3cbb0cf0919fc628bfcb8a46bf81ddd715901e50505c30d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468392, "uuid": "d0eff628-f2fa-4c35-b040-df1a12abea09", "value": "T1DC825C14A395C673D4B64F3258D31B90ABB8F6799A37531FC882163DCF433180A56B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468392, "uuid": "986e3ada-c2aa-47cd-87e2-482eb5cc4734", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468392, "uuid": "fc1e413b-94e7-47b2-9a63-3399fc8ff637", "value": "384:OFaDxSR+3kKBSojvA7XSUaepk0OOyd3zXzYghH:OEdSEfjvATSUaq1LyJDzL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648468392, "uuid": "4eff3d55-002e-4dd5-ac1b-2abf9bedc604", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648468392, "uuid": "37feca65-13f9-4602-b049-49c89df86546", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468392, "uuid": "192c68c3-f71e-4455-907c-1290a008b953", "value": "HOJA DE PEDIDO,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a291ac5c-ae9a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648473971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473971, "uuid": "19c6298a-9a68-419a-9d75-d08a0ca9d6cc", "comment": "Malware payload (Heodo)", "value": "a836008e58b7073adf84ae73c25ac6f5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473971, "uuid": "2bc27d0a-928e-42c8-9e74-bf9642d22fd9", "comment": "Malware payload (Heodo)", "value": "65d1e5ecda0ec2b2ff78521584285460731f7f754a81d930e679c851bc1725c2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473971, "uuid": "e1486289-89c4-442d-a0c6-0630b44cf08e", "comment": "Malware payload (Heodo)", "value": "f6766587e83c1ede10e8dea7a0e7fe995d992ebb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473971, "uuid": "ea2fa740-dbc3-4121-b4cd-a7d467e65a44", "comment": "Malware payload (Heodo)", "value": "70a13fccffc650619ccff2d4cc967f0e10ae5d37a4c05f91cf6f4f04fac3fe57939cece96b8bf1f5e710bc24950cc419", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473971, "uuid": "65f65147-8819-4d63-a598-9a939c3d1066", "value": "T1CB943A0173C390F0C657A574840FD525ACB7B83C6B18857EB24BA26F8BE78D09A346F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473971, "uuid": "082a83dd-9182-48b8-ba21-2b741a754aed", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473971, "uuid": "f8d76cc4-91aa-43cf-b48d-c860783e82e0", "value": "6144:S5uok8qcKhyMlSXVKfKGS4Tp3wb8iZ7B1yarhj7ArkqBoEimFmzUM092:S54yM33d3q3Z7BogIreNmF+U/92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648473971, "uuid": "e8a74876-2827-4e69-b351-f903c94d974b", "value": 426030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648473971, "uuid": "444cc506-8232-404b-a342-9090926a91d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473971, "uuid": "70149974-c0e4-492f-bf4a-96aa3ca4f025", "value": "emotet_exe_e5_65d1e5ecda0ec2b2ff78521584285460731f7f754a81d930e679c851bc1725c2_2022-03-28__132607.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4db955-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448055, "uuid": "43fbc7f5-616a-4ce2-bd72-67ad6ceb6ef2", "comment": "Malware payload (Stop)", "value": "2f970bf35b4346da85b72563e4f69ee6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448055, "uuid": "9ded1997-2bec-4be1-8e5e-f5b16db6342b", "comment": "Malware payload (Stop)", "value": "660a52ecac1016144f8f7f9925a2c023e6c1c103a6c423238962a0d79b44c80b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448055, "uuid": "0a387cb8-3157-4c86-9703-c48f213feef3", "comment": "Malware payload (Stop)", "value": "0dcbe3b3dae097e97f3eb8cd79dc3d71a7c6aee1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448055, "uuid": "6a609b72-6a1b-4e95-8154-354c597ebe2f", "comment": "Malware payload (Stop)", "value": "44c6edb55da1a88af3f78f6b93a19dff433ecd7e5ef9ece959298791105093a4df3aefe5797e095b39db215539589839", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448055, "uuid": "3b38cc28-1a8f-48be-b87c-0a2305bb9f41", "value": "T1C2F423446B02CC33DD955072F47AD9F2396BE23641F39C83218ED18DCF951A2A676ACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448055, "uuid": "74bc43b4-9eb5-41b6-b463-f4d6069380d5", "value": "98af1336ee9a8378f1e2c2d0d9027760", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448055, "uuid": "30acbc87-3d18-44a6-b429-5d2f39e96260", "value": "12288:oWAyYW0qHxT3LSl09O8YQqzsdqZkIJFW37t7nSCePsqOjBzDw:oWAykqHxrLS/XzL037tuTk7Nzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448055, "uuid": "3bfe7668-5872-431f-86b4-4e91241bc1ee", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448055, "uuid": "ad86bb34-1a54-4a96-9d60-3f3807a7717d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448055, "uuid": "c658efa1-4501-44fc-adcd-cc5bc197ae5b", "value": "660a52ecac1016144f8f7f9925a2c023e6c1c103a6c423238962a0d79b44c80b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4dbffaf-aee5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648506322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506322, "uuid": "d371b4be-0435-4c41-8c6d-62f8dfbb92a8", "comment": "Malware payload", "value": "f02cfebdd376417bcc3918cf70a900b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506322, "uuid": "774c601a-eee3-43bc-986c-8fdf773acbe8", "comment": "Malware payload", "value": "6674d57a3851affd53f8f07e0cea0377307cf623d0efe142b787c9382b2c4f95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506322, "uuid": "3023018e-2651-4049-af7e-a2b89ab4d994", "comment": "Malware payload", "value": "fd997b7c55e6b66d68419b46e30085952797c0dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506322, "uuid": "d2cf2ffc-9447-4f0f-a9fd-b3b5cfbe8952", "comment": "Malware payload", "value": "f9f8ba45b88d579e5ccae1f53e7c51149be93332a3ebecfb6d35a477eaecf2cd1bb4d7bdd23a04f89985f508817c2b25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648506322, "uuid": "6e51a62b-e664-4a8b-a687-6dd9e6c0cdf1", "value": "T14CE48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514DB432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648506322, "uuid": "9543ae63-a74a-4da5-9340-6f6075cfebb1", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648506322, "uuid": "1771cf35-715d-4575-af27-ce0c58e198c2", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7IvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zOCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648506322, "uuid": "bf6921e6-f505-471f-a632-50503c916b10", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648506322, "uuid": "707f9227-fb23-4f26-895e-a8c4921d610d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648506322, "uuid": "ae59a818-2c7a-4fc1-8d5c-ef6b17905ca0", "value": "f02cfebdd376417bcc3918cf70a900b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb3d9cc-aec4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648492057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492057, "uuid": "4520fec0-9159-4010-b6da-951a85da1da3", "comment": "Malware payload (Heodo)", "value": "77c26770e3066939e89f3a8987ad24ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492057, "uuid": "590e88e9-e5d8-48dc-9bbc-f6efdf85dadb", "comment": "Malware payload (Heodo)", "value": "66caff444c00cf5ae7750598073e3bd88526e765e44a466c717843a046146f7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492057, "uuid": "1bf86ed5-f087-4e99-ac5b-c2e6ae9982c8", "comment": "Malware payload (Heodo)", "value": "e9406c51eeed51f2ae541a244e40106552c8308e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492057, "uuid": "22ea230a-904b-469a-9bb0-a587dcebc752", "comment": "Malware payload (Heodo)", "value": "d3948b73c3c178abb0612d0526212273beb7bb68397d87d2e52c8c8e749924f427f917e45f46c56000b2c085b8f9af18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492057, "uuid": "935cbad1-643b-4949-a7c8-bc5ad9be1b79", "value": "T1D3E48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514DB432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492057, "uuid": "527abe6b-9884-46d0-a4fd-9d078b7f9fc6", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492057, "uuid": "d4b4fb19-8931-4f06-a093-7544d1eafbf1", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7wvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5z6CMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648492057, "uuid": "191ae2f5-633e-47c6-af18-f4300d916444", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648492057, "uuid": "f2e097fd-6e46-45aa-ad3a-41a0c59be843", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492057, "uuid": "484a1937-d618-4e6c-a995-5be330bef686", "value": "77c26770e3066939e89f3a8987ad24ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c38cb6e-aebd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648488993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488993, "uuid": "1f5bf6bc-0d52-4d66-b16c-decdc3d24971", "comment": "Malware payload (Heodo)", "value": "da42b553c982a9c8f7a03246e3e1dde4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488993, "uuid": "5b59c99e-1dc2-4586-8cc7-4bf582ae49a9", "comment": "Malware payload (Heodo)", "value": "6739391d776dbaef034b76d75d6f096dbfab10a78b5e5f3b89c300fdf935d646", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488993, "uuid": "cd4a38e1-052a-41ab-abe9-1a37970be9b1", "comment": "Malware payload (Heodo)", "value": "f646c83194dcbf3d547bc3b65c39be8f5a471555", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488993, "uuid": "1ffaa323-685e-4408-a830-d9cc3da52020", "comment": "Malware payload (Heodo)", "value": "1cb1978c9c477020c9da9c5f5f1ab805f458ac7334faa5ced60285ea69828373c499e215bae16eaaaf1f8fff08748ba8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488993, "uuid": "5be4326b-e1e0-454c-9b67-9c1d714a7aa2", "value": "T1BFE48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93FBFCD302514D7432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488993, "uuid": "b6466d6d-5d22-4197-a019-32d354f45972", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488993, "uuid": "08a6812d-ecbc-40ce-bd93-874c56ade153", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7avK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5z4CMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648488993, "uuid": "f32f0c7e-0f8f-41dc-859e-5e4f81b9ec37", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648488993, "uuid": "80805a75-9600-41c2-a036-894bbce40956", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488993, "uuid": "c5eadc4a-2ad9-4828-b70f-e09a46d94f3e", "value": "da42b553c982a9c8f7a03246e3e1dde4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fbe2a55-ae2a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648425863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648425863, "uuid": "0c194564-5f6b-4c85-a124-958d94bcc93a", "comment": "Malware payload (Heodo)", "value": "e009a6373254827762f62c057e075674", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648425863, "uuid": "7bbea354-4920-478f-a714-52ca66f8d113", "comment": "Malware payload (Heodo)", "value": "687f0fa64129d8645e8b0e626972cb03e8af2c5710b75d23dec7e8a82637f243", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648425863, "uuid": "791db8aa-d226-4869-8b51-977b6ac51147", "comment": "Malware payload (Heodo)", "value": "3504a89c8e639ed2aaa2d94072cb9236dbad6e94", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648425863, "uuid": "59078c99-178a-49a2-876b-335932b25188", "comment": "Malware payload (Heodo)", "value": "53cd1ae811d78cdfbe562e167cd8f9e39e0d06598234362a63b88927a9c5f59b8f5db12e095b109f465af6ba9896df44", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648425863, "uuid": "7ccfb873-f64c-4cbd-91b5-5655822e57fa", "value": "T19EE49E1177D0C072C2BF3630551AA3B566EABC708DB9860B6FD42A7E2E745829D3871F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648425863, "uuid": "c7b6d608-2e4d-4804-b493-18d54f6d697e", "value": "923a5ec702466ffd61b422bacc94c6f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648425863, "uuid": "9deb2f79-704a-43fe-96e3-d6b359bf1838", "value": "12288:JSycC8Tu2EEAeClIHRFa7UdUzrAK0tI8X0oXYl2N17OP:JSDD7RDhH3dUfgtj0oXYl+OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648425863, "uuid": "2b0e0aa2-e387-4f00-bd09-aeab87af48da", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648425863, "uuid": "36e7c464-c4b5-4fd0-b343-476ac4a10d11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648425863, "uuid": "41eb413b-39a7-4b3e-a2cb-bcd8f169bc7c", "value": "emotet_exe_e4_687f0fa64129d8645e8b0e626972cb03e8af2c5710b75d23dec7e8a82637f243_2022-03-28__000417.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f72c96-aeeb-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648508597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648508597, "uuid": "0b822b65-1ba7-4302-9e58-62fa48dc2b3f", "comment": "Malware payload (SilentBuilder)", "value": "fbce8728c4ce96cd3b399f2c7ecd4250", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648508597, "uuid": "7c900011-f181-43b5-b9c3-2364bb5a1b0a", "comment": "Malware payload (SilentBuilder)", "value": "69cfcb0822207ba5d2438f1936d2522c9eaba929f78897554b0b100c7abac3f8", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648508597, "uuid": "3f9e97b0-aa41-482e-b9f1-96aa5aaa6736", "comment": "Malware payload (SilentBuilder)", "value": "6c6d4bf061735fc3804e01a7256952bd51c29477", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648508597, "uuid": "7c81c47d-6c26-411e-9d48-4b4acb85f59b", "comment": "Malware payload (SilentBuilder)", "value": "ca4cd049aa7cb7b4bb4f608bc0f4f0de56947a64761f81dff94ce15a3ccf20737238e4840b621aa555d6aaa5b94a9f8c", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648508597, "uuid": "92a2276f-123a-4486-a08a-2415e59c6258", "value": "T175C3AD8BB659486DF921877488DB879A7363FC344FAB47473214F3366EB95A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648508597, "uuid": "e23cbf45-f34e-42a1-9e6e-154c9c08a6c8", "value": "3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlCt:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648508597, "uuid": "e05529a2-19dc-40a2-8daf-ccb9d34cb111", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648508597, "uuid": "68e04047-7e7b-43b1-a3ac-6c3d18a926be", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648508597, "uuid": "6d86ce43-4002-47ab-81bc-5f4af43bef7d", "value": "fbce8728c4ce96cd3b399f2c7ecd4250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1dc970-aee1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648504267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648504267, "uuid": "235f333d-6a7d-4339-9358-0a25bd7bcf2f", "comment": "Malware payload", "value": "05eddf246ff3900650373bab2a45f8f1", "object_relation": "md5", "Tag": [ { "name": "1877", "colour": "#10ED2E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648504267, "uuid": "c5ddd5c6-5190-47e0-aab2-b33ab85936a9", "comment": "Malware payload", "value": "69db77173df272098da80c4bdff6147536b851809cfb2116fc0085bfc885a663", "object_relation": "sha256", "Tag": [ { "name": "1877", "colour": "#10ED2E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648504267, "uuid": "33d47546-61f4-409d-b0af-264fd29cb28a", "comment": "Malware payload", "value": "4b1aa434604bacd73857ee1058610ff442ed124f", "object_relation": "sha1", "Tag": [ { "name": "1877", "colour": "#10ED2E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648504267, "uuid": "3d09be36-f00f-435a-a3a9-555b6354177e", "comment": "Malware payload", "value": "c0a88e6f6799655d2a821d2aca16b4515e003e2a049f92a45c1bf5809020f2ecca408e308088e66e131f025519146c20", "object_relation": "sha3-384", "Tag": [ { "name": "1877", "colour": "#10ED2E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648504267, "uuid": "4a8acba3-6666-45a9-89ca-5c365d8a5724", "value": "T1C967331063534DBBD02247FE046BC730DAA26D91CAB849163FE47EA739727B1ED1C689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648504267, "uuid": "e75c045c-46ef-4281-916b-d715180a9fc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648504267, "uuid": "84812e87-9d8f-40d3-8d5c-9baf23af89e6", "value": "786432:GouMWKLObqt+5Sy3frZEZ8GHfBiCn+j7jWhs57Wblx4MXt:Z/WKLTyTU8eBiFDxqj5Xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648504267, "uuid": "8e34e8bc-8fd4-4ae9-bfcc-7d870579d05c", "value": 31235072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648504267, "uuid": "80a314c2-38da-4a20-9f0f-accc54dbc058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648504267, "uuid": "f608d73b-92ea-44a8-8b06-31b67e853a91", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa99ef0-ae69-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648452805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452805, "uuid": "3aae3348-73ce-4e2a-b861-6e8f18ff7dc3", "comment": "Malware payload (AgentTesla)", "value": "8d1cfba74e5c233e1dca0824cbdafc4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452805, "uuid": "2142a51f-7212-467e-b464-5a5e26527d3c", "comment": "Malware payload (AgentTesla)", "value": "6a0155358e6c1cbb75851f979d0d89861318d3d798a0639eb3b635a399d42a16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452805, "uuid": "93d8fc22-2948-41fb-b148-64914f67d218", "comment": "Malware payload (AgentTesla)", "value": "8eaa49ba289689d0d39f2b4cdb39cedacd4ea2a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452805, "uuid": "0fed7b98-4c86-4007-8602-3a8b42e9ea52", "comment": "Malware payload (AgentTesla)", "value": "11dfa90ad8901aec3e1df60c7a84597ecba2d9bd8d40c92867aac5bddb44f1a78499c5141220f006ac8c0137f265d317", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452805, "uuid": "cff1adc0-9ae3-4427-b092-b5db6c6b9ce2", "value": "T13EC0C02BF59CD046C60100C22071088CCF01C8402088DFD0E700F90C3F151FC4805043", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452805, "uuid": "3b15df51-a177-4421-bc71-ba440d586551", "value": "3:cc7on0eNH1OaAJJLNxQNMFNNcrNh74LFDglKc4AK2aMiWD7N+RK8uiNak8oMGbMe:3+lNHHsn2NEcrnULR+CDUNuuiUnoMGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452805, "uuid": "1dfe7a6a-c9ba-4270-89a4-200c249c77cc", "value": 179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452805, "uuid": "7817fe83-e324-45ec-abc1-fd2e0ad139c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452805, "uuid": "efa3bd1f-54c9-4e14-b7f3-a7f888c61930", "value": "RFQ 457525.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dbfc226-ae57-11ec-8e58-42010a9c0032", "comment": "Malware payload (Blackmoon)", "timestamp": 1648445106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648445106, "uuid": "18a046c9-dc14-43af-9045-43637a575381", "comment": "Malware payload (Blackmoon)", "value": "0709462318919624f4d16712cb81a9b8", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648445106, "uuid": "1f85f856-2da5-474c-a1e2-e7cc94d13293", "comment": "Malware payload (Blackmoon)", "value": "6a26f81bcf488e0901db40a8dda68c07efcd81a82de53101a6a68021d1c1d178", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648445106, "uuid": "542e3c01-dd6f-4047-a55f-1e977c6a4b3b", "comment": "Malware payload (Blackmoon)", "value": "893c5e887513509b1791f75db19b492236e6ecff", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648445106, "uuid": "d6264afc-f755-4eed-ba06-d6bef74e2ac8", "comment": "Malware payload (Blackmoon)", "value": "5cfa66600d8837680a9a3eac3c152c0525733e38ab1d4295cf706cc46e4f2c42be360ab754decbfc5847a429eb9a4f6c", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648445106, "uuid": "d1d1df94-568b-4403-93a0-d6aabbfc3b76", "value": "T153267013BA79FC22FA7D34F2EC98D9601D5D7C280AE3347632BAF76D9933511A610252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648445106, "uuid": "69f0ce44-30e7-4345-9a6f-3d717849e9af", "value": "49152:yaTJazsIPGrbP4HKqeuwFkmrsJb6vLc35DMnCIjtA2aTJazsIPGrbP4HKqeuwFk8:fJ4bSP550JFHhpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648445106, "uuid": "5d612b72-b9f9-45c1-b665-028c3375e363", "value": 4467600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648445106, "uuid": "720546ca-891f-41b4-9921-f2f8bb71a994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648445106, "uuid": "e3ac368b-688d-4d9e-ab6b-b4fc2bddc996", "value": "genransom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb723ca-aeec-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648509316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509316, "uuid": "439f0517-51ab-4275-b0e2-a4a72b71eee1", "comment": "Malware payload", "value": "276762ea80c28871d3a6997043c3016c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509316, "uuid": "e973c8fb-7e42-4a7e-afa9-81ca5e044dbf", "comment": "Malware payload", "value": "6a4ebf513f996bd7198c711bef936a989fea148c235817ea56c1e2afafa927f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509316, "uuid": "ae7fe763-5f3b-441e-8bfe-041300dc59bf", "comment": "Malware payload", "value": "8b0bb834b082d7ffc1d730031a964fe50bf6d514", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509316, "uuid": "055ccb1a-a491-4d59-b01f-956b17ff926a", "comment": "Malware payload", "value": "1437b3b2a7d85c52afa470460fd7edae343c4133f98462fe85f0eb221d0810c42b3833f73517f9b2e9d0a01c8dd86db9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509316, "uuid": "731c3f31-293e-433c-99a3-fa2594886fa7", "value": "T13F943A43F6A250ACC06AC0788357A633F9727C0D46357AAB6BE0FE312F65B50A72D715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509316, "uuid": "285be24f-ba43-4433-a442-cdb96b4558be", "value": "a9d048605f07f7f9f42b35afedade3f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509316, "uuid": "3c9e15b8-c573-4b17-bee1-4362db91b1ed", "value": "6144:zuzIkI/bkS1+0EdYi+91xzrM68PS5OWGM/gRDfr33S8SQx6:zuzI5/bX+0EdYfHzmSgC8Sy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648509316, "uuid": "049fd357-66a2-4c02-a291-bc0d7e304544", "value": 433664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648509316, "uuid": "6eef28ba-588a-46a7-82d4-7b5ed71e0a69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509316, "uuid": "fe985ac0-e086-4d8c-a49d-1e8102c36db2", "value": "6a4ebf513f996bd7198c711bef936a989fea148c235817ea56c1e2afafa927f5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdfb432a-ae57-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648445241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648445241, "uuid": "ee9b54ab-b382-4e67-8894-fb979db6eeaf", "comment": "Malware payload (Formbook)", "value": "3dc9158c80ce1c2fce4e790f5c3fc85b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648445241, "uuid": "ce9a0d88-253f-4ed7-bd21-9dd9273b5ed2", "comment": "Malware payload (Formbook)", "value": "6a54522390180a2d94e47013c901b57095e30d2843c11b8f55d7b63ba8e9dc77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648445241, "uuid": "2f387c4d-f29b-48d5-8d1f-fb172974da9f", "comment": "Malware payload (Formbook)", "value": "8b61ed17e4537227ba67ed34f05ba10c125b0a56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648445241, "uuid": "cf3800b0-e733-4aef-848b-54707b04c322", "comment": "Malware payload (Formbook)", "value": "1a6a2e798a14ef98da19b99b5dc03be05c6f1aa62850cb6916cff62a835501502e7a3efcfc8763569379eb647cfff0c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648445241, "uuid": "1e664878-b8de-4a5a-a9cd-8c734072a6ce", "value": "T1893412C397C188A3E6DA153256B79B3DF7B24689115F0D833BA85F7A0C362A70A197D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648445241, "uuid": "28b59c19-9ef9-4cbb-ac6f-03efc94685d4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648445241, "uuid": "5fa53378-5db7-4c65-a8fc-2122b62011f8", "value": "6144:rGiED4c/T0grL5SSZFpPZnsKyniq5yVk/eozzI:LcL0c0SZD2iq//HzzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648445241, "uuid": "7d05439d-a97f-46a7-819b-713c39720356", "value": 248155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648445241, "uuid": "42469e59-d730-44f5-b389-a296f3266b4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648445241, "uuid": "9687efb2-d940-42f0-84be-ffedfdccd217", "value": "DAMAGED CONTAINERS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d2b04f-ae56-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648444774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444774, "uuid": "044a1c31-eb4c-4243-8926-5f0218f8f19d", "comment": "Malware payload (Heodo)", "value": "56f8861f87212d24498b24f96a2735d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444774, "uuid": "9732c2f1-1479-489f-b2cc-9ff8c0161bdd", "comment": "Malware payload (Heodo)", "value": "6a689a24e4719b09a61a86257f14629451d8fc913b818b0dc60e5798c9aed62a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444774, "uuid": "768e88e6-f6fd-4267-a39d-d9dae7b92d91", "comment": "Malware payload (Heodo)", "value": "97919ac3548d60a18e540b9ecdc7013281b62633", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444774, "uuid": "afb33635-339a-437b-a11a-4ded81d367b2", "comment": "Malware payload (Heodo)", "value": "5d0641921b6a6380e519873bac11d0c69c3564384dfba66935175342f5130b5355bd85c6805705256c390ac5a75e0591", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444774, "uuid": "804f5c3f-5809-4cfb-af11-bc34d51fa422", "value": "T1C5E49E1177D0C072C2BF3630551AA3B566EABC708DB9860B6FD42A7E2E745829D3871F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444774, "uuid": "2133e9db-948f-4c7c-8769-a6ee42cffe61", "value": "923a5ec702466ffd61b422bacc94c6f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444774, "uuid": "36765a87-ae34-49b1-85c9-e80068f3586e", "value": "12288:JSycC8Tu2EEAeClIHRFa7UdUzrAKPtI8X0oXYl2N17OP:JSDD7RDhH3dUfLtj0oXYl+OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648444774, "uuid": "388c39e0-d840-432d-88eb-c196f7ee0704", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648444774, "uuid": "98633995-4b73-4510-affc-7fcf3459717a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444774, "uuid": "f19d5401-0de4-4035-a926-7590db2ca8d4", "value": "56f8861f87212d24498b24f96a2735d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed48c6ff-ae5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447897, "uuid": "bae0dda8-65de-4ee7-8daf-cad259ad6619", "comment": "Malware payload (Stop)", "value": "cadf0a64c58300b7010437ba6d63c88d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447897, "uuid": "1f381cd0-5283-46a9-adc7-2d15586315e0", "comment": "Malware payload (Stop)", "value": "6a803d7627d4fe8412c329487c9a95b34f3521ff2504fd077477cec1a9184ff9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447897, "uuid": "81bb42d2-87a6-40d9-9cfd-7821121ad48a", "comment": "Malware payload (Stop)", "value": "97df0c1533e85a66501c347a40036c75826ef23e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447897, "uuid": "563b316b-1f59-4892-9c90-9a14576ae87a", "comment": "Malware payload (Stop)", "value": "ffcf42484d71b9b24255cc18329089ac6aedcfd6f94416db267fb6158ef95e303d7823dda8c27af7633ea2f699ef2b78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447897, "uuid": "46b75013-af8d-4955-a4b1-654d9022ce44", "value": "T175F40110FBA0D034F4B752F9487A83A9A92D39A09B6494CB62D567EB13317E4FC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447897, "uuid": "0b8e3733-3788-448c-9743-e8c93426d99f", "value": "416b3e8b148083e60573677b4c24c307", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447897, "uuid": "d9ea08b1-e287-41ed-afeb-f27782026a2e", "value": "24576:YaIeXzEVRyZJTJ/NADj4woYvzX9CbxCkSQbU:PEVRgJd/csyL8iQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447897, "uuid": "7e5f51e2-300b-4aea-ab85-2290af4169d0", "value": 792064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447897, "uuid": "3f4b129f-0ef1-40c3-94d5-08183df51deb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447897, "uuid": "0ebc5588-d787-4f49-91f7-f19954ed61f0", "value": "6a803d7627d4fe8412c329487c9a95b34f3521ff2504fd077477cec1a9184ff9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519131f4-ae7a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648460091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460091, "uuid": "894af61e-d94d-411f-96cc-afcef309d483", "comment": "Malware payload (AgentTesla)", "value": "8a39cbf46c7efe78106448be310d550e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460091, "uuid": "5aa0ec65-cbd1-4026-854a-1754fc503ae3", "comment": "Malware payload (AgentTesla)", "value": "6b2d335e930cdab4fc2c4db322d11bd5df26d44937cfbe1dc42db0ad277274a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460091, "uuid": "4f775cc0-c768-4b6f-be14-3bfb74472ede", "comment": "Malware payload (AgentTesla)", "value": "6a4b61bfc433636b392878de98726ddeded635f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460091, "uuid": "dfcbd555-574b-40c9-ab41-64ed7609c8fe", "comment": "Malware payload (AgentTesla)", "value": "da7e870a7cb15ca1ff83be30bbcc229ac9d4ad12beb7c07e9a314c82a3f73775606bed03873cf40f2cee0e13d6a1c390", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460091, "uuid": "05c3fd8c-47db-45ab-84bd-8bc87c1dea04", "value": "T154C423CE809AF7EFD241806835FD1829EC50E5A20E463937F28DE03DA7B6FE5B055255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460091, "uuid": "0ee473ed-117b-4abd-ae79-6aeba8278f9e", "value": "12288:MOwheSTAqAsZRFy3rz/fq9SgIXnZbCIl83LsXxpNvItHzOzT:Kh1TAPsIrz69SgEj6bsXVvItw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648460091, "uuid": "2f91ce38-93a7-4276-8b3d-08bec77d0fce", "value": 559529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648460091, "uuid": "8bf23b94-ebf2-4dee-8b5b-4d8366d1d0e5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460091, "uuid": "e8d0d017-bb73-4cd6-beb4-783fd027e6d2", "value": "Purchase Order Number 0062101239.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c1abf81-ae68-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648452432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452432, "uuid": "34833983-e1dd-4d0a-af87-020c5d8e58a3", "comment": "Malware payload (Formbook)", "value": "58c33348b0d378705a1111e2309d62a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452432, "uuid": "d0cab9ef-149b-400a-8f98-6f38cd6158aa", "comment": "Malware payload (Formbook)", "value": "6b7c84e5e5f4957bc74a43c7c53636f4aed4380beacffa1a1ad5d8f242436505", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452432, "uuid": "79aa877b-5006-45f3-a35a-f00f0b235d55", "comment": "Malware payload (Formbook)", "value": "3c473f084e9918396d8c5c570a3d349febb1632f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452432, "uuid": "291aaf6d-efd9-4dac-9611-981398ed1874", "comment": "Malware payload (Formbook)", "value": "5b1cf4f7d0aeff475b13946ef4bbd1e98c38445c03e4fcff26a5b9e17074e1375d987c8bcc8dfc6fda2cb02bd3bf65de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452432, "uuid": "7ccb1ba8-f9fb-40af-b714-05b1150fbd48", "value": "T18C35F10132B05B55E07693B6DC6984DC47703E0A6D7DE15F2EC272CF1AB1B829A2AF47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452432, "uuid": "d0341eb9-fe2d-430c-aa20-ca958402bee7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452432, "uuid": "f732d9d8-f7a8-4cc1-b1a8-c962498f19d1", "value": "24576:Hp6dXQMI1ZWBfB+ov29b1JoQCbWl9+EebYlC8Rbiu3:vR1SB+ov29bXl9+DbYlpRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452432, "uuid": "847930f2-7912-4e9d-9361-52be69d7121c", "value": 1116160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452432, "uuid": "993318a9-261a-4583-b1df-9e40ee49d3ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452432, "uuid": "2b8670bb-7723-4d3a-91b5-dd7cad464357", "value": "WS4NpDZlt4lIGGE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe99a26-ae5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447902, "uuid": "640241c4-3080-44fa-909d-6dbfa1da4474", "comment": "Malware payload (Stop)", "value": "de783b64c6c9b8a7fb19f53bcb56f43e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447902, "uuid": "0eaba5cf-5e1f-49ac-b891-66f17589c339", "comment": "Malware payload (Stop)", "value": "6bee8cdba2850877e705cf6412545e2e321339d39d4b2639864ebc4f4d5a340a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447902, "uuid": "d94c9a1e-433c-41c6-941a-610e33d345c6", "comment": "Malware payload (Stop)", "value": "e4110cebb23378d940fa08721c66b2e7b318e9ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447902, "uuid": "aee9e543-3e2b-4717-b289-9c69e1471719", "comment": "Malware payload (Stop)", "value": "85e9a901a021be9e8a279a24ecbee7a02a2abcc456dfe7ed610374ed703db776adafd3c790315149cec95c683f68fabb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447902, "uuid": "9c8038d3-f35a-4a32-bb97-98bf1a13b97d", "value": "T1DB0512023A86C072E06646B43825C6B48ADBBC710B76958F3F99196D6F343D3CF7934A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447902, "uuid": "4995829b-4538-44dc-953d-3d525848c006", "value": "cd8ed96dcf990359020da5c59a04eafe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447902, "uuid": "482d18b5-0b06-4807-b927-70bc2c463d04", "value": "12288:dEljHSIYfxH+XvRsPU5A4MKux1JzHfJNITcu29+L3FUZU7RaDzsiU/q+vwAfB:2tkJHeRss24MKay0Y3FfOwfFvwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447902, "uuid": "8d816622-44bc-49e7-803b-ee00aa940553", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447902, "uuid": "f2a2ca3a-3605-4bd9-bb17-6a313f17215e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447902, "uuid": "227ee87b-5ed0-4588-94c7-683f0aa89933", "value": "6bee8cdba2850877e705cf6412545e2e321339d39d4b2639864ebc4f4d5a340a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f27f2e25-ae5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447906, "uuid": "3a3d9b19-dbab-4824-b6d0-a27cd25837c3", "comment": "Malware payload (Stop)", "value": "7b6ad46d2e509caf1c2870f2b10f3854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447906, "uuid": "d11e49b0-7606-4efd-ba46-860fc1f847f5", "comment": "Malware payload (Stop)", "value": "6bf8a626df0fcdfc44b1ea3401b1749c3effe848e549eb7e20d7216c23a5f023", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447906, "uuid": "ed1b2aa0-acf2-481f-9863-5509410fbbb3", "comment": "Malware payload (Stop)", "value": "2cfc0c25bde44285e929cc8df7c1f2d8532df0ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447906, "uuid": "828295b2-c408-4268-bdd9-3088eb17ea7c", "comment": "Malware payload (Stop)", "value": "69f46931e7dc1b066886f65b3afc72fbc11b9c6003d9c5819c738f4b7afbae60a4700f1cbb519c9bc9ee55e667f79225", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447906, "uuid": "4ef1f547-472d-4911-8b78-8e07cb141541", "value": "T18BF40210B790D038E4B712F489BB936C742E7EA16B2461CB66D56FEA1231BE4EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447906, "uuid": "407c2508-9b03-4ce6-a9fb-b879969c6375", "value": "f6757a5e56c220f92851eafa3556866a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447906, "uuid": "752abbf3-7276-4644-bcaa-eb6e39adb0ff", "value": "24576:0C90ESCTQYegHk7/tbBhUhz8a5gUlhtnTxRqo3RSfW0:x2R7hQ8IPTbRqo3RyW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447906, "uuid": "bde20eaf-2baf-4167-b12c-a861a65ebbc7", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447906, "uuid": "667ff0d6-438f-4ca2-b1d1-cfafb8c439af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447906, "uuid": "047818c2-361a-4296-b08d-cd26e21b973c", "value": "6bf8a626df0fcdfc44b1ea3401b1749c3effe848e549eb7e20d7216c23a5f023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5136e99-ae52-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648443079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648443079, "uuid": "bd637b83-ce3e-4acd-aa4e-b6de6997ef7a", "comment": "Malware payload (Loki)", "value": "2a923cb232e155c9cc40887c4b13b26a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648443079, "uuid": "4f2e94e0-d704-4e9e-a884-59924b33a096", "comment": "Malware payload (Loki)", "value": "6cec4c93df42401cf0373ba5d551e63daa6eb6158c0a137a0484246b6f5e3bbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648443079, "uuid": "e1b7f0fd-2786-48c8-b6cb-3ee85d7be122", "comment": "Malware payload (Loki)", "value": "134570beec6fa67dcddb825350fe34737dcbbb13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648443079, "uuid": "3ab2c8e0-b5e1-49d3-bd4c-3ddb7fee9da0", "comment": "Malware payload (Loki)", "value": "fed5c0c7d27139c6a971dd8e3bda033e23c0c7e24fd324861712f6eb25d133062d3570051318fd3d3b866ab3eebf730d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648443079, "uuid": "e0d59d6b-e348-4e24-9ab1-953dc49808a1", "value": "T14EE412C3E1C658EBF4B2963064768E30713B246E85E256879A66BC2734D73834636BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648443079, "uuid": "e796c714-2f60-41a6-b1a8-47e008c93ec3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648443079, "uuid": "dca0c6e7-daf8-40eb-9d1e-6034bbe587de", "value": "12288:Q4h+Wm1vLz/kIjWSDHcKOB99Tf4tBsaDX+jg+:Qs+lv8IKOc30seWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648443079, "uuid": "c07c665f-5e58-4905-83fc-6d73ecce053f", "value": 667294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648443079, "uuid": "3b28e18f-a5de-4146-8ffc-16b3cd37a633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648443079, "uuid": "9c372043-b467-4be9-85cb-ff37e39efaba", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da44fbd2-aeef-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648510572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648510572, "uuid": "7f0c5f87-f883-4d22-b509-c428248ac219", "comment": "Malware payload (SilentBuilder)", "value": "740c2fd49ffd35f90ee0b03d1040a28a", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648510572, "uuid": "adc0ee0e-ad5c-4d0e-8e3e-18cbbd7327dd", "comment": "Malware payload (SilentBuilder)", "value": "6cfd86adfe720a6432fb65748f6d9c8607f6c15fe412f73e1efd964268152bba", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648510572, "uuid": "52741700-ba9f-4f31-98a6-e3319d67647c", "comment": "Malware payload (SilentBuilder)", "value": "796e34c55a27ee8807b64a5a8063c378fade6662", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648510572, "uuid": "1a79ade9-59fa-43be-8a0d-406afc57eb0e", "comment": "Malware payload (SilentBuilder)", "value": "65f93f13a786e4357fc38502bb8d7982fa7fb877ec3d2bf0adfd7990e1b6adae7d184cd00c6ff89e58993066606b82e2", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648510572, "uuid": "9db6051c-5e8e-4ec0-9f1e-75f0d479564b", "value": "T16FC3AD8BB659486DF921877488DB879A7363FC344FAB47473214F3366EB95A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648510572, "uuid": "8fd99505-a1f0-45c8-9caf-59e8968927ef", "value": "3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlCN:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648510572, "uuid": "893b9722-344a-43bd-8c67-911f067cc5da", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648510572, "uuid": "2bc5f499-f986-4566-b8c0-d446324a55ad", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648510572, "uuid": "055a80a6-ffcf-430f-9d47-fe09471becc3", "value": "740c2fd49ffd35f90ee0b03d1040a28a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a439ed39-aed8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648500603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500603, "uuid": "a1580b5a-203e-4ff1-8214-2cbf4fb66da8", "comment": "Malware payload (Mirai)", "value": "8cc2c15e3cfb4d06ea8a8bf48a8a5a16", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500603, "uuid": "ea9f3b23-25ef-4972-8e25-e9a1b8e14ece", "comment": "Malware payload (Mirai)", "value": "6d234b2e3525d143e1d280738fca5e35d9cd0f2043fe709427c7b0c34087317d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500603, "uuid": "872bb456-e928-4742-9e50-6bccd1cb4e23", "comment": "Malware payload (Mirai)", "value": "dd2344e334992dc69fa9f572d8b2bf90ff232e97", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500603, "uuid": "3dcae74e-b1c9-43e2-ab26-46fe8fb32f70", "comment": "Malware payload (Mirai)", "value": "21f16c406a3b26771c08650b85561ca49accfb04ba53bb79046dd7bcf383f7466e8b373099dc84a2ec29af6e90477810", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500603, "uuid": "ee003f33-24e3-494e-b411-e6b0bb9e8bfe", "value": "T136B3944CFA64933DC7E2B2FFFB5912CE273907C8B3EA39168A3502253BC97246525564", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500603, "uuid": "da979290-55cb-4efd-a0a2-261abd52fff7", "value": "3072:NuAeN2XW6jTahPkuClj972MfoIpapgOfxGX23LitV:NuAIBkuW2MKp5fn3oV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648500603, "uuid": "4832f06f-5727-4bf7-871d-37f36656ec3d", "value": 116615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648500603, "uuid": "869584e0-18db-4747-a74a-90181bf84f70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500603, "uuid": "e0976977-6180-4739-bbcd-362bacdfb79e", "value": "garm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfadc09e-aeea-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648508407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648508407, "uuid": "555a0a17-1161-4b1c-b926-b13529406e3d", "comment": "Malware payload", "value": "05d0cd5a946b88c55e696e85e1a0bf93", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648508407, "uuid": "4eda8d86-508f-4118-8abc-3435f9bb0949", "comment": "Malware payload", "value": "6d9bbe20455d2d7d59b886e8552ae1d34505307803b43c0363e29a441cd58381", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648508407, "uuid": "fddb62c0-aa3c-4c79-81e2-68dc429f784a", "comment": "Malware payload", "value": "ef5b9fe4d8606c6491a6119655365524f63d2233", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648508407, "uuid": "805d959a-ed42-4a1d-827a-02a91264277c", "comment": "Malware payload", "value": "9d8265c995d63b325e3f96465494c3b8ee2f60e882439e0e4c09208664361e85f0703aa1c4e0ca26b3791dc7208ceb45", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648508407, "uuid": "60989b1d-2b51-45c9-884f-a1fd7386da78", "value": "T11374F9A22493CCB3C7F5B3710A824E68AFA1E79553732253D6900435FA389FAE3B45D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648508407, "uuid": "61eb77db-4495-4c4c-803f-31cb281d2278", "value": "6144:bTSIaQIvz1Q+X4LJMByRR3AplChL4OSrDYAfQ:Wvz1CLJyyvmMLSrBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648508407, "uuid": "e7378155-6d45-411e-bc6c-fbe97b0cc968", "value": 339784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648508407, "uuid": "dbb5e1bd-ad7e-45db-96b6-28ffeb23d485", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648508407, "uuid": "2e431872-0650-4598-a5f7-1cf8a473e966", "value": "emotet_exe_e5_6d9bbe20455d2d7d59b886e8552ae1d34505307803b43c0363e29a441cd58381_2022-03-28__230002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ac914d-aec0-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1648490250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490250, "uuid": "81df9509-c9ad-45f5-9616-aa8220f5697d", "comment": "Malware payload (DCRat)", "value": "05f202267dea18cb6a2fc1474454d1e0", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490250, "uuid": "013d4a89-8f12-4d62-8708-6e8fd2e20f2f", "comment": "Malware payload (DCRat)", "value": "6dd4c331a4c5363db2e03e05c1c2bf1f8caea5dceb726430390c73005f3c3ce4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490250, "uuid": "fb2d8fd7-208c-4cba-9af0-15d4f71bce33", "comment": "Malware payload (DCRat)", "value": "d82f77d4add1c23b31141d596e59d62cce3934a3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490250, "uuid": "8daeb4a0-c707-447b-9989-08565cfbd502", "comment": "Malware payload (DCRat)", "value": "2a0d43fe0b229513c0701f0aadfdbc9767874c9e95a28b40f647e26a0f848ebdbc8fc70f74846389c6faa3e7f0674097", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490250, "uuid": "ceb0b795-8cf9-47fc-8ad9-8bf3382ad9a5", "value": "T11F2539037649CE12D469173BC5EF401C83A8AF536A62DB1A7E5B339D25133A7AD0A1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490250, "uuid": "b6e33730-bec1-40a0-92ef-c57de5df78c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490250, "uuid": "df3484eb-8401-41b6-bf60-8c9bb883b1b6", "value": "24576:sEfrWEhT995uGuaDM6atFW1bYDRD1Dgl:nahtMoRFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648490250, "uuid": "de7047e5-e062-4caa-aada-f597dda4133c", "value": 1053184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648490250, "uuid": "a4be075a-9098-44e5-b20d-8c75bfc526f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490250, "uuid": "c8e2ec4f-36a6-4835-8276-309289ec6e49", "value": "6DD4C331A4C5363DB2E03E05C1C2BF1F8CAEA5DCEB726.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6beaf75-ae7d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648461550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461550, "uuid": "764b9b55-b05f-4e12-92e7-29e59f2a4e62", "comment": "Malware payload", "value": "558a9e5d8dabd4c41320b664b5961964", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461550, "uuid": "b0b0b675-3911-4bf5-9b81-9eb4e09cc538", "comment": "Malware payload", "value": "6dd964eecb89fd3d885853816cea1c913798d0cdb0dd69a2a08ae360869448be", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461550, "uuid": "a83fca70-9c60-48d5-b921-a617ae4e7b95", "comment": "Malware payload", "value": "eb97859e4f37436d97a7340365c86fe447aa37f6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461550, "uuid": "6f5b2f83-b175-4aa1-824b-5c0376ddc5f2", "comment": "Malware payload", "value": "986216d826b169fbe6adb00acb374a85938e1fde3428a2bb096b6e4b3f86c16f0abdc384d107417202da9180c99c3a2d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461550, "uuid": "99836ef1-b8b1-45d3-9889-23e4a09ed014", "value": "T1EA022DA3FE910DE3CE5C03B56AB3853E867CBA104F946502BB96C60D1E29593FC1496A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461550, "uuid": "038de031-c448-426e-9724-98c26e602ebf", "value": "fa8500f84d495dd1fa69f5fa07d5f3bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461550, "uuid": "472f8e15-d5e4-48ff-9c92-836792116042", "value": "96:zy2I1SQb2u1ZQthpkezZmKkU5WJk0cs/n/JjOl1RKAnZQfQ2ljKQMC:z0P2uD0pkeZmKpWJzRjOl1QAn+PljKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648461550, "uuid": "43fdb5d7-a145-4256-8482-38e6d37eaa20", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648461550, "uuid": "012fc940-2ac1-4e1e-9ac2-4a390ef0cf6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461550, "uuid": "fe7909c8-03a9-4192-b6ae-2c0d06e08512", "value": "ZHPyaFhGd4_x32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066a7076-ae3d-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648433766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433766, "uuid": "69268400-1965-4a0e-8f90-6347e03d2aba", "comment": "Malware payload (RedLineStealer)", "value": "693bf3d41da0c334bcaa15c935f5a4ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433766, "uuid": "e636fe1e-0401-4b00-be33-b96cc28e5c9e", "comment": "Malware payload (RedLineStealer)", "value": "6e004cb6c3f1c0338a20692c375de17324c45e5176e80c6602ae2b1bed2bd4c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433766, "uuid": "33d160bc-f5c5-4289-8688-1103d2d28918", "comment": "Malware payload (RedLineStealer)", "value": "9f1146417212b81fea1f3eb0721ce041c29efdcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433766, "uuid": "0dc3da2e-f3cb-4d15-b1a3-94e9605ed5ec", "comment": "Malware payload (RedLineStealer)", "value": "489b73b1e20d3dec4bfde51c95fcbbbe37a976bcb9b1fff34137a8df8d4fb52c489d0ab69319338641d613a0d3a655d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433766, "uuid": "2ea19f80-a709-4d77-b845-c28cd969dce6", "value": "T13CF6330898368476E6F8C5371FEA8982237355A60149BD3917887F6B1F4078AF47F9E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433766, "uuid": "f00f6014-dcb7-412d-818d-07ce44038d87", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433766, "uuid": "9767eec8-4151-4fec-89c7-997c68898568", "value": "393216:JcktPuChdo3vjd4kfk3uX+cWArbLttByE:JcktmC03rd4yFWcLttME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648433766, "uuid": "0eee743d-83aa-4eda-b3df-943caed9af23", "value": 16607274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648433766, "uuid": "dacfe05d-70da-4d5f-a6c0-37953857b9f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433766, "uuid": "36bc4b79-4834-467d-98e1-2dbe932035e0", "value": "6E004CB6C3F1C0338A20692C375DE17324C45E5176E80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9703055-ae6e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1648455192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455192, "uuid": "cfffcc11-dc57-4b96-8468-40224caa698d", "comment": "Malware payload (Smoke Loader)", "value": "9caad4dc63f34f6b5b039a6400ddad6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455192, "uuid": "7a33d8e1-874d-4b2b-8941-084800c1af12", "comment": "Malware payload (Smoke Loader)", "value": "6e9c8c5fc2fe5fc0ec186bc8ae4cdedb6700e91b7c5c5d2d68b70584ac26dc91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455192, "uuid": "d05e6cdb-d816-4271-88b2-b6d4e99ede68", "comment": "Malware payload (Smoke Loader)", "value": "e57fa22af31188c692123fac2629391a4f53aedf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455192, "uuid": "e1d69690-6d24-4ede-8c04-eb93d344aa8b", "comment": "Malware payload (Smoke Loader)", "value": "afeaa49763e3245b2332b98e03aeb6a0879af2728e4aed2390a48b82f302cc13974ab9a0b0684dee109bf4752bc4eef1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455192, "uuid": "8e1db95d-7191-4bf5-8d60-1cc027ab665b", "value": "T1AA54BE123AC1C832E422D2756856CBB55BBBB87019355A8F3B84162D8F353E3DF7934A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455192, "uuid": "cda8c276-2d58-4869-a01b-9e0073926a33", "value": "159dcaa804632f606b007a362cfb6cc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455192, "uuid": "331e0440-d222-43e4-9f23-10bf89bbf13e", "value": "3072:GVYLHIjJiZOvfjvl3ARGnEjMy9BCm6pL1Yafxv7XvDbLu2l:G6T4h7gMEw896zYYv7fLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648455192, "uuid": "ac31f3dd-5d28-45bd-811f-b63434441881", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648455192, "uuid": "24b74f00-2169-4c45-9814-7459a41d72cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455192, "uuid": "8e50d702-1c2f-4d31-a1ed-33a891debdf4", "value": "9caad4dc63f34f6b5b039a6400ddad6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f7d1c3-ae36-11ec-8e58-42010a9c0032", "comment": "Malware payload (DanaBot)", "timestamp": 1648431052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648431052, "uuid": "01b6a083-5f29-4a79-943b-caa4cb9ecf79", "comment": "Malware payload (DanaBot)", "value": "3584538c62ecccdf470b30818758720f", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648431052, "uuid": "a995a725-83c5-4daf-b56c-fd4835c0d2fd", "comment": "Malware payload (DanaBot)", "value": "6ee73d5e4fa4954957aad95443756f9be8fc1423cb7e83aad87048f7d2d970c0", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648431052, "uuid": "610add95-624d-4642-91a3-2b6887502a54", "comment": "Malware payload (DanaBot)", "value": "3f7b56548feca8a3109e2c745c3a96b731f93b35", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648431052, "uuid": "41186bbc-ec93-4f3d-aec4-8cb5e3c79d53", "comment": "Malware payload (DanaBot)", "value": "d70c9bca47afcf0290cba3124cfa231e65cc8c2d01cb26e8d510769a07fd9ea83f3e8a7c21202800861e231f3944b800", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648431052, "uuid": "c90af73e-533c-4f89-9e44-5403fb7ed7d8", "value": "T1D8351200BB90D031E4B722F81D6AD399743E7AF09B6845CB63DA5AEA17356D1ED3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648431052, "uuid": "8812db06-2a6e-44cb-a354-b6a682f7ff66", "value": "de2a87646cc33f42cff0f6e99f12662e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648431052, "uuid": "7f92df2c-3caf-49be-b901-88ffccaf368f", "value": "12288:ZiIMEyxIS4P56ZMxGbs5P+L/QcRliO6jKDzIpWwRRlV0nF5RNg0yyO4g8LdUS00k:0dEL5wZGGg5GzuaI1biF5U0yyO6US06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648431052, "uuid": "9e1391bf-c7d0-4e62-b1e7-4c03f943cf08", "value": 1097216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648431052, "uuid": "2081dd6c-164b-4520-a703-1266dc115bcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648431052, "uuid": "60dae480-2b17-4828-8d8d-5699fad47baf", "value": "3584538c62ecccdf470b30818758720f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd976f60-ae93-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648471037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471037, "uuid": "69cdc6d7-ad48-40c2-8c94-30ce0e4b966d", "comment": "Malware payload (Heodo)", "value": "ddfde9c23eb13af91271b3105454522e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471037, "uuid": "4e551150-5c61-4b09-9f18-3f737940db80", "comment": "Malware payload (Heodo)", "value": "6f6eb14f7a99c91a8cf5ef4c8c9c456454ea3f25655a2e686b9cea829a0e0a74", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471037, "uuid": "efd9bae1-ef0f-403e-831e-cd44db5f1bd5", "comment": "Malware payload (Heodo)", "value": "ad3f02e19d47754b12af37708d86f74598cf8507", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471037, "uuid": "09e86803-68ec-4908-b57e-249ef6985d35", "comment": "Malware payload (Heodo)", "value": "8b0b1ad5994f4d12797cf8b7e1cfd51be72608c505f3763d3c2280ec52955757ee0b7be3fe3cfd69ca78839c17096843", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471037, "uuid": "7900e1cf-5fce-4000-8358-86e6fc29baef", "value": "T1FA43E95BBA49985DEA14877548E743997323FC304F6B074B3269F3257FF89A05A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471037, "uuid": "8e17dea2-eb45-474a-b51f-27eac2009653", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umvz:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648471037, "uuid": "589aa66e-e836-41d8-b591-ba4e2b2c452c", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648471037, "uuid": "9242ab07-087c-48bc-989b-849397965e72", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471037, "uuid": "cc306864-aa04-4b20-98b0-008fa151e9fa", "value": "Form_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e877978-ae6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648453778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453778, "uuid": "fbd967f2-f9b4-4758-8887-9278dc947158", "comment": "Malware payload (SnakeKeylogger)", "value": "10805d3c528ed82a98137ea543bb4ff4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453778, "uuid": "1aa2072f-d463-4417-969c-37ea5ea5750c", "comment": "Malware payload (SnakeKeylogger)", "value": "6fe90dc59e5714ff4c7ab9d9d3cfda6870eb745b6ff9e6ce4b24b36a33d8dd7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453778, "uuid": "3c397b4a-3d3b-4595-8db0-527e00716945", "comment": "Malware payload (SnakeKeylogger)", "value": "03f3d944c28668d5feea51947e1a90a44f7f2b86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453778, "uuid": "0700e9e9-05a3-40a1-8c96-c2ce44e50dec", "comment": "Malware payload (SnakeKeylogger)", "value": "0e257ebcb6b2bd058733a8e32c1a9f4c6d954dee2f5d2222841b9dec883a27163c7d50baf6adba532f2f1e46f935e14f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453778, "uuid": "aa67cf8d-0621-42b8-9e60-fbe876056c73", "value": "T1C2556B98325071DEC467C972CDA81CECEA607C665F1BC207A053329E9A7DA97CF146B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453778, "uuid": "f72eea8d-a471-46f5-8a1d-00f6b859a0b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453778, "uuid": "2a6b6269-56a1-4229-a902-b381c6a0ece3", "value": "24576:jKU9yVORekBHRexUIHNJ17l/tW1J2dA1Cdxhe/c:cVO3ReJNt/tWSdA1Mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648453778, "uuid": "4124d092-9153-431a-bfad-f8a349feaee2", "value": 1329664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648453778, "uuid": "c88dc2fe-604c-41d8-9dac-0374430266ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453778, "uuid": "624ed4a3-3b8f-42a6-bd35-18b6023d95fb", "value": "Halkbank_Ekstre_20220327_073712_983787.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7938015-ae9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648476127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648476127, "uuid": "baf96603-3e1d-4d1e-a5c1-e6b9f4312561", "comment": "Malware payload (SilentBuilder)", "value": "79363a77f14c5b587af9659e85e2a52f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648476127, "uuid": "cb18f581-c857-43bd-a5f0-24b69dc1d401", "comment": "Malware payload (SilentBuilder)", "value": "701cc4e238e425a292222ab190f693fbca11c289c0565919ce6c50c492a0cfde", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648476127, "uuid": "ae8d7d6d-d7ad-4453-af90-d9180085d142", "comment": "Malware payload (SilentBuilder)", "value": "7e2fafd1a62d64df2613f5fcdc583ef6f14a54dc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648476127, "uuid": "8a106dca-09cb-40ee-a660-30694b257677", "comment": "Malware payload (SilentBuilder)", "value": "258a6cabbd62c987ee0ddd980fccea4b0e34cb9b55a05dbf3fa8e0b2c77e737e1aa57803b05ac35c58be453b241e137e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648476127, "uuid": "d501a108-7e9f-4c42-a1ba-a0a77b3dee9d", "value": "T10443E85BBA49989DEA14877548D743997323FC304F6B074B3669F3257FF89A04A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648476127, "uuid": "3d66ffc6-547b-45cf-8111-09e77cd284c9", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgx5G9XSZ4XsvS:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648476127, "uuid": "b107c2e9-fa4a-4826-aa2d-ca70209af7ff", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648476127, "uuid": "bcae2870-dc17-41e7-8de5-794363536a76", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648476127, "uuid": "45d3a083-242f-4756-93bc-bd5127d76e41", "value": "Bill address change.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43876dda-aebd-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648488844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488844, "uuid": "7a53b022-36f9-4b9f-8db6-3bc48f95363c", "comment": "Malware payload (AgentTesla)", "value": "47c9881ee5753db8683c30de4a6dfac9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488844, "uuid": "93cfb1bc-df62-4eb8-8818-a6ccca5d873b", "comment": "Malware payload (AgentTesla)", "value": "7045552a1ff9e07bb5d575bf77af2612a78892c2c7265198df950beaf3f6fe1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488844, "uuid": "104d996f-3a41-42a2-bdb1-d14667cc4035", "comment": "Malware payload (AgentTesla)", "value": "e284f1b5474ecbf27f417df87af3ba6ffb4580e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488844, "uuid": "7443cff6-8a80-44a1-a135-aca9a9f5aa46", "comment": "Malware payload (AgentTesla)", "value": "730867d4a97c237ccd329549ed4f610f83584520ac4706fa38076ccdf5f787ac677fbce709b951b09d421bac94b8fbea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488844, "uuid": "fa92f8bb-4d06-4944-88bf-30d39e23e043", "value": "T1EAB450BC7B514E72FD1D9130A5510AE4BB670E8362409A8627FB2DC8876F0F76E45C8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488844, "uuid": "1c323d34-cad6-4511-8279-787dc1196fc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488844, "uuid": "ca1d2c32-762e-48bb-8b11-dd60dbdf5be9", "value": "12288:T4sq7EAYeLwo+aQyvgM7n7d0/8XNah4d:KXYy+2vnnzN/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648488844, "uuid": "a6652ee4-ce50-4b74-81cf-7ca83b23d5ad", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648488844, "uuid": "e27ea251-6048-4676-b026-745447a386ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488844, "uuid": "6468f7d3-1fca-46ea-89f6-eb45d2a4d1ab", "value": "MV AILEEN EX MV SEA RACER's VSL SPEC.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ef482f-aed9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648500929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500929, "uuid": "bcbaa6dc-56c1-46cd-a72c-6d6e073f9266", "comment": "Malware payload (Heodo)", "value": "aae4a74c529fedf8bd1fbdab4b23cc05", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500929, "uuid": "24c2964d-dcaf-4802-a827-a3dc3d5b255b", "comment": "Malware payload (Heodo)", "value": "715d273bbcaee528fef280696afa12b1db53d556971290bc836408e1c7b1bfea", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500929, "uuid": "cc47519d-bb74-4e4d-8511-cf920dcb8b33", "comment": "Malware payload (Heodo)", "value": "9e88bd79a63652a374e6522c9ee95879454cdee0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500929, "uuid": "bfa85720-a0ae-4ba7-864c-a96141a967c2", "comment": "Malware payload (Heodo)", "value": "ca1ae39f1255ccc61b82460e0b4faa7248ae9130f42825331197c928604f588aef1f05c0052a6d1e53da5c04bdab0118", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500929, "uuid": "74621a83-fd39-4e12-9a10-36707be38bc0", "value": "T1EEC3AD8BB659486DF921877488DB879A7363FC344FAB47473214F3366EB95A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500929, "uuid": "cab41421-ab70-4fbe-b654-b9654358f755", "value": "3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlCd:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648500929, "uuid": "1dc4cc5b-3ac6-4b72-a147-22d35322c330", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648500929, "uuid": "37189876-8578-4b76-87ff-06abb7e39a1a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500929, "uuid": "0b8588da-b739-4bc2-a27a-d0cf7b096aeb", "value": "aae4a74c529fedf8bd1fbdab4b23cc05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b33935-aeb8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648486774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648486774, "uuid": "a70d7600-f07c-498e-9410-07fab5f9db59", "comment": "Malware payload (Loki)", "value": "b760d1089bdbfe69a87381c3203c4489", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648486774, "uuid": "dedf5f2d-d30f-4cee-b8dc-86cf1b17430b", "comment": "Malware payload (Loki)", "value": "726708d27ca0049b2c099dc16da3283443fd3730568b2e229e1f1e96e55e50f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648486774, "uuid": "c2b16ec8-723d-465f-9662-ebcba7c03850", "comment": "Malware payload (Loki)", "value": "71706817986b8229523f46eb5dea7b2e6b3dfbaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648486774, "uuid": "1cf12c93-e086-45f0-996d-1468a6ffe822", "comment": "Malware payload (Loki)", "value": "014df7459fd2da95820823d3cbd36d9ff2f4b801328c5e155bc1e6ad34e6fe3eb77ec0a9ba28a4401c40b9dd6c6ff8ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648486774, "uuid": "0382e5f5-ee1a-4a56-a2ee-362167ef9fba", "value": "T1AC35E01376A99A04C479427BCCAA80CC17B07E89AD67D60F3DC533CF1A727C65A19E4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648486774, "uuid": "c59d0077-1bb7-4ad2-8c53-5e4fa80d6996", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648486774, "uuid": "82ecfbca-db46-4983-9c4a-baa403f295b7", "value": "24576:Q9bUC4exYU/MXVeBf8IY99NvdrnN2v2IyWg3Aj6QLV:i34vSMVeBPKpnN2v23x/QLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648486774, "uuid": "5a87a058-31df-42f8-bc2e-4421afdca475", "value": 1094656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648486774, "uuid": "a0241587-7c66-412e-b9e4-b1e9b2bef656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648486774, "uuid": "4b824717-d373-48c0-a074-8427996d6d44", "value": "YMI_20220724_001SS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec1a3dd-ae74-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648457805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457805, "uuid": "c15d1a31-733e-4571-bacf-2bc643b043ef", "comment": "Malware payload (Heodo)", "value": "74e1412dcefd36af5ef5fb5d230017cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457805, "uuid": "5ab30631-d95b-4b8b-a109-bbeda8018d19", "comment": "Malware payload (Heodo)", "value": "72f1506484fcb312e7622d97b8bacb66e11ab129a86fa444c2df87154a8efddd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457805, "uuid": "d90306fb-f376-4329-8cfe-a8e3754aff4e", "comment": "Malware payload (Heodo)", "value": "9e997988d17471af3dadd289618093843e04966a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457805, "uuid": "1ed55c30-91b8-4593-ae31-ef5e93dc1372", "comment": "Malware payload (Heodo)", "value": "e611f94bf2056a102ff13ffdd71bfd6a69b4c6bff0e097099b0ae5101ec67a7b235488690021c93bc1375425435ccf9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457805, "uuid": "2e271759-21d8-4e45-a656-07936e652d37", "value": "T11194CF0272D0C47AC6EF23785D239B5AA7F9FC208A75C647A751BF8D5E326C1893035A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457805, "uuid": "4e74a805-66ab-4832-9d9e-b62ccb6a4407", "value": "8f8b1cb86c6697dd342b65a36c6ccbb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457805, "uuid": "83db02bb-4a9c-4671-9be9-2656fbf005ab", "value": "12288:zwn2hR3547jpDMgyS/xpuCMS5AhugWarPU:DRJ47xjyEpuCMSqumrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648457805, "uuid": "31a61a5e-beeb-479c-afb5-625a239942b2", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648457805, "uuid": "fed43386-704a-4216-b456-73bf96c61255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457805, "uuid": "d0ce4bae-0b7b-4e46-bbb9-bbbb35ddfe9f", "value": "74e1412dcefd36af5ef5fb5d230017cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9451bfa2-ae6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648453761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453761, "uuid": "c2571d0f-2a24-4476-b8d5-d9e2ca60287f", "comment": "Malware payload (Formbook)", "value": "3cb5a88313d51e8d3c43d4ded0a6d759", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453761, "uuid": "0e7acc90-7557-4413-b79d-52d9313fed4d", "comment": "Malware payload (Formbook)", "value": "736fb3f0900c299f259ba08b2ac7c63b3b5aa08b40935d2a8b9c32e5056b81fa", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453761, "uuid": "945b1b14-3ab8-49eb-8295-21912347f125", "comment": "Malware payload (Formbook)", "value": "37b0dcca5b96f4acb1a7dda154d70e39b2fc8bc5", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453761, "uuid": "cf55970c-ecee-4512-8d70-15e8fb2f8734", "comment": "Malware payload (Formbook)", "value": "053d13b8979594ede8fe2f2baa3618550641d5ade398b155b7539b51392d4b9d8c9a9d241dd0e938d2e68a1898abeb38", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453761, "uuid": "6203f5af-cfcc-4f8c-ae96-df44adb961a1", "value": "T14244F187F585285EF4EF833B36E65E39FAF5519A05021E1243B53FA5BF212814BC0B4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453761, "uuid": "96539d28-afad-4fbb-a027-7a2ece49b416", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453761, "uuid": "475b7ae5-ad56-42f6-a6fe-593c676ff3a3", "value": "6144:LGiyw9Q4D/8GFK++XshNX3l63nRS0s+jkzvfSLd:Owxj8F++sTA3Q2kEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648453761, "uuid": "fd5a70c3-8d8b-44ba-99be-93ffb2576dbc", "value": 266191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648453761, "uuid": "51ddb53d-4947-47e8-8f38-2a06c3ee01d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453761, "uuid": "290e1141-0332-4638-b703-c0993481457c", "value": "from-iso_DHL_119040 RECEIPT DOCUMENT,PDF.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6885de-ae78-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648459277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648459277, "uuid": "511d4265-df95-4057-aa1b-c7638a505bfe", "comment": "Malware payload (Loki)", "value": "3fa42d9afb3f99362a94d3c4760c7e16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648459277, "uuid": "80db4a49-8aca-49ea-93b9-4f9390ed5667", "comment": "Malware payload (Loki)", "value": "73a6cd87d71a6d7c12be944a3004e6aa5571b0261f9ed33771eca9c13b87402e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648459277, "uuid": "5ba6f070-9cb9-4f93-b081-40fb4dcb4e15", "comment": "Malware payload (Loki)", "value": "d40fc0b47305e223875ef89ab4daa8860913056a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648459277, "uuid": "0776d5a0-33e2-4f9e-90cd-99df68453f6b", "comment": "Malware payload (Loki)", "value": "4f060a6e34bc148cfdd568da4b814f6e1e8b7f2f3f6b90383c14ffdb4b7c0a9dab7dba82d54da86c77c948f40890f373", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648459277, "uuid": "06269011-d17c-48ea-a2c4-3694e3d3cb1c", "value": "T165E4078F429FC093C56B39F639167C943412ADD2F9895843BE9C22C8463DF6F2912E6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648459277, "uuid": "fc57e126-e1e6-4398-bd3b-7ce8c32152df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648459277, "uuid": "db73bf9a-9b1f-4bf6-a09f-d894e07f6d8f", "value": "12288:e9bgWslRBLn45m28A6aQIYGxgco3zUfnIld/CePojwLREL8:gbIof6knSlgBL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648459277, "uuid": "0e808b46-d46f-4855-a9d0-b16cb1a0f7cc", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648459277, "uuid": "214819bf-4407-4686-a159-4438d7521124", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648459277, "uuid": "9fe0734d-a11d-441d-b71f-2b34de6b8d71", "value": "PO#7A68D22.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a06344-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448148, "uuid": "247981d1-1868-44eb-a77b-d6a16b63931e", "comment": "Malware payload (Stop)", "value": "39358dd1d9233d5b312a6f21b46523e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448148, "uuid": "ec2a99b1-da12-4912-a763-fa12a72f3952", "comment": "Malware payload (Stop)", "value": "7406089920d8a814908b750d77fd224e3d27e84535ac6cc088d5a8f1dbd16e43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448148, "uuid": "1ebedd3d-ba2b-4a59-81c4-48e216ffc792", "comment": "Malware payload (Stop)", "value": "308774551dbf3f75d876f10ead1683a10de7f7e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448148, "uuid": "68590185-5b4a-4116-b0e5-3a3e99bb3ef7", "comment": "Malware payload (Stop)", "value": "4ad45fff78a1c035c5fb3e40538129aae0f2aa5612ddf84eebd46757136db022fa8b34af3040f8dc3effc05712d2d198", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448148, "uuid": "506f3f28-525d-47dd-96ea-7c8cfe09dbb4", "value": "T10AF40200F6A0D035F1B322F959BA97ECB92E7AB15B3094CB22D55AEE16346D4EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448148, "uuid": "3aedeb66-eb82-4f5b-878c-55b037f8dad3", "value": "de2a87646cc33f42cff0f6e99f12662e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448148, "uuid": "6ae0ea2a-e3a7-42a4-8f0e-60969afc7679", "value": "12288:MIK9Sgr4ea64HO54Z6VovScVbs6YvWSDYIeceyp1/3APNyNs23WPs:l6SfJ5Z6VovbszfEvcXMj2mP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448148, "uuid": "8bd4f951-de6e-4cbe-9f9a-72029c7139e8", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448148, "uuid": "b797242a-4446-41fd-b4e5-72e51ebeb6ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448148, "uuid": "5b11d749-9f8b-4791-bb6f-55c9b9a9e061", "value": "7406089920d8a814908b750d77fd224e3d27e84535ac6cc088d5a8f1dbd16e43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380d6768-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448023, "uuid": "d371f979-c421-4382-a894-cb8edd8eff4f", "comment": "Malware payload (Stop)", "value": "725224821da08bffd02f14fda89efeda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448023, "uuid": "be86781e-6576-423a-82c6-e7e103acb903", "comment": "Malware payload (Stop)", "value": "75f80da9276c13fc3d52974382c19f2d75dd40756b9cb6186ac08e056f2ce6b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448023, "uuid": "2a21028d-a5ec-45a7-b6ac-79b719946f3b", "comment": "Malware payload (Stop)", "value": "f1a8eb593325f0240cdaa182103b68480692cef7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448023, "uuid": "6aca892f-e2b0-4651-8dd2-80eaeead66aa", "comment": "Malware payload (Stop)", "value": "697799349614b5b1ed172cb60c4158d4ba5fe8ac4be86ace63bee1ecc83c9ba0ca2db672e251d7a68d121ef3c24e8e09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448023, "uuid": "309f8dfb-4fda-4a89-bcf4-62bdabaf55df", "value": "T19C052311B850D0F6C486957424B9CE69DF5D693202A499473FCB073C3F60BE2A7BA61F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448023, "uuid": "8c247b76-757a-43aa-8bb7-59c98ea0f25b", "value": "db9d63801b52e5f18d5dc80c5fed99ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448023, "uuid": "ba4de4c1-e224-4c21-80b6-70b790822376", "value": "24576:ef7St5hMe8iPFpUO4jMgiSYeiYpPUkoo:efOt5GqFpN6ziSjzpMkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448023, "uuid": "75e2deeb-dadb-4993-b1b5-0340306cb266", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448023, "uuid": "ca5f1c9b-a771-4be4-aa46-88a2aeee2fb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448023, "uuid": "80e22bd0-db93-43a7-b604-873133800ad9", "value": "75f80da9276c13fc3d52974382c19f2d75dd40756b9cb6186ac08e056f2ce6b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e5f459-aee2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648504635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648504635, "uuid": "c61cbfbc-7639-4e94-87ef-0c84cee308d1", "comment": "Malware payload", "value": "fe708274911de3fd34d3fc9286034d42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648504635, "uuid": "17ecd40a-cdec-4413-a53b-d7fc18bf5936", "comment": "Malware payload", "value": "76a799425ee2b903adcd8c916d878093fcaf11dd3f8f77e8c0e251121aa994b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648504635, "uuid": "291c9922-64c8-4daf-abf6-2568d31ac7cc", "comment": "Malware payload", "value": "09950fb02111e75cdeaa736a0448b398cc698c61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648504635, "uuid": "95c0a749-2983-4578-bc21-e94acd31cb8c", "comment": "Malware payload", "value": "537bcf5a5d90c00ca088b10f2d835e102feffc1aa3c484c9371c4630800665b73779e51c06fcd480222c5c7ffaa6a839", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648504635, "uuid": "515a7507-9322-4e2d-9a75-651b6f48fe07", "value": "T10EE48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514DB432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648504635, "uuid": "b64acfb4-9e52-4212-93dc-a6603d60cf45", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648504635, "uuid": "ca4f92e5-ea25-412d-bce9-6f1e2f4c1b09", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7RvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zvCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648504635, "uuid": "dc680c29-62e6-44df-b40f-fec2b6b57c18", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648504635, "uuid": "5b0f0224-b687-4a6f-8e43-c6b9b8fdb4fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648504635, "uuid": "1b6bda4a-da26-4b18-8d39-4696710a2ad9", "value": "fe708274911de3fd34d3fc9286034d42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8d60d6-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448027, "uuid": "50ba87fe-d9f1-4a59-b2c5-de8b091e8441", "comment": "Malware payload (Stop)", "value": "f1d4fffc8ffc5f26ead0942147d6df91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448027, "uuid": "dd288222-d971-4517-9e9a-ba19b69a9b0a", "comment": "Malware payload (Stop)", "value": "76a97061aed8ee39ca3235b5f127df44cf9345cf5d95af10c9dbf11564b6549e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448027, "uuid": "a2e28e2f-fb1a-4caa-a83e-b39277ee40a0", "comment": "Malware payload (Stop)", "value": "ea83c353150948a3fe313c4639a58fcb3cfa48bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448027, "uuid": "49970f7a-aec2-434c-b8a6-99c8a4e62344", "comment": "Malware payload (Stop)", "value": "9856ca1f8bee51b4a9b31f925dc2453e2c8f1097fb0431d709ed5611e7646f7d5349655ff9051f6e870aaab7cfe03514", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448027, "uuid": "1560899b-b29f-46ec-884b-d3eb43d80bec", "value": "T1AF0523017542D036C8AB6F727262C65D1EAE903A17B1264B773522BEAF102D34DFF60E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448027, "uuid": "f1c4e3d0-4ee9-4f1c-af56-fc8d4fdc23ec", "value": "a945bbba5e19a9f29aa1458bdc91ed8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448027, "uuid": "0b37c5ee-5d88-4365-87e1-71242c822b0d", "value": "12288:T9T7rx3vElBQwAKVqMiv5aMoncnkWpquHYxC3UdmXvz2vCyM56amTpmo:hT7e5ANaMacnkWpqXC3JKE5qmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448027, "uuid": "1de040b4-3565-4ace-bb35-9ebd507397ec", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448027, "uuid": "a1b33f1d-fdc2-4c17-b56b-ffb0c9a506db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448027, "uuid": "c4268010-20e7-42f5-8ef4-62ae4772c61f", "value": "76a97061aed8ee39ca3235b5f127df44cf9345cf5d95af10c9dbf11564b6549e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e11e3b3-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448060, "uuid": "751f7376-e16c-4fc1-bbe5-1d65243bb977", "comment": "Malware payload (Stop)", "value": "e593942d238448a4bf2eb671be746dcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448060, "uuid": "c6f716fc-f16f-4dbb-9492-4fd3642a5c50", "comment": "Malware payload (Stop)", "value": "770b67915d30a2c9e175eaea694af2a34c9f4a4c55d9f7ec5a28d042c8bf7762", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448060, "uuid": "46d1df89-0ea5-4d73-9b44-f3ea1cdc6371", "comment": "Malware payload (Stop)", "value": "725449b644cac3d552bf8d289840b7114d55a156", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448060, "uuid": "3f59cfd9-398b-47ce-aa6c-bbb838e2c409", "comment": "Malware payload (Stop)", "value": "0ba9dc434ebbb1f3ca00695bc6a5e23f6aabc8c27da8afd9f6971984609406ce248f4df9e8a09a1ca618b3fb6f7147c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448060, "uuid": "caa10568-a11e-40f3-b2a0-3d4c2b654591", "value": "T14AF40210B7A0D034F4B741F4997A8378B92E7AB15B74A5CF12E66ADA5334AE0ED30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448060, "uuid": "9e274dab-9c17-4edc-9141-8745209e41ae", "value": "8b43e1344b27321e8381c60a4a19bca2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448060, "uuid": "a70193c8-9bba-4821-aec2-5e2bcdeb2541", "value": "24576:HYJCPF2i5TqxBTOi3wMF3dLcNMZVm6Qt:hPMihqxBVZdLAEQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448060, "uuid": "3249cb4e-83a6-4d7c-a0a7-ec4cb5fef189", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448060, "uuid": "a76edc36-6861-402e-90c4-a1590dd56d19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448060, "uuid": "18a0dcc5-10a7-4cbc-ae21-fde224ea6ae2", "value": "770b67915d30a2c9e175eaea694af2a34c9f4a4c55d9f7ec5a28d042c8bf7762", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f898dc1f-ae3c-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648433743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433743, "uuid": "9e288f60-1f85-4f6a-9bed-263ba14fc5e8", "comment": "Malware payload (NanoCore)", "value": "76adf3b6dbbeff723b82e26c5c75985b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433743, "uuid": "dfd0e2ee-e421-441c-bba7-03a62b1fe0ec", "comment": "Malware payload (NanoCore)", "value": "7710c5dd03c6a4c1e75e492e4fab9fb0ddc928497c1442d52417a41745d9c097", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433743, "uuid": "28328493-f408-467b-bbae-bef1fc42782c", "comment": "Malware payload (NanoCore)", "value": "537a9e16c4e5e8374ecace6030e9e9d466698e0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433743, "uuid": "41126334-fa9d-48f1-acc1-29b66451cc44", "comment": "Malware payload (NanoCore)", "value": "39eeecef74fef19886a4dead443fea4c40a491974c72e7f0be1000dd27383eef36bfd04b027e77e7aaae0b26c5abc369", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433743, "uuid": "0590a9f0-f3e5-4244-a0a2-b75a5668b6f9", "value": "T15605BE1028AB66CAF0768BFE9DC4A4B18FBAF5363619F5B91C851F874751B00CD42A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433743, "uuid": "db78bc06-18bb-4636-97b4-c4493d57272e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433743, "uuid": "123b6c41-94a5-446b-a5b4-ab289e19e8f4", "value": "12288:OiEJgYYz0sNbz+5APD7vUSeQAYgpebSL95he0Ifle6XFQ3jtVUai7KqQ1:J9HNaqnWQbT0mlF4RmlC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648433743, "uuid": "cb7e9c34-1479-47ca-8b0c-fbc5b24e49a3", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648433743, "uuid": "d0684aaf-293b-4eaa-affd-c77ec198d6d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433743, "uuid": "8b14f54f-3a5a-4328-a8a1-879ddbd3aff4", "value": "76adf3b6dbbeff723b82e26c5c75985b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233d99e8-aee1-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648504252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648504252, "uuid": "01ceaf05-ceff-4680-9c95-91523dcd71d8", "comment": "Malware payload (RedLineStealer)", "value": "c0cdfc6d1d123d0f5490a596d8480230", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648504252, "uuid": "a5863dd0-8280-4a43-8167-69d1c065d38b", "comment": "Malware payload (RedLineStealer)", "value": "7747839e392ad8592ef9acd85fce4dd64e1edafbf09900e7546ea11f5e924dad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648504252, "uuid": "3db542e5-17cc-47db-a842-0e8d4548f6e7", "comment": "Malware payload (RedLineStealer)", "value": "556c47bb4cff45aa43b757e4cc3d431523d67c51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648504252, "uuid": "ab030700-e38c-4534-afd7-dc217214624f", "comment": "Malware payload (RedLineStealer)", "value": "f36fedbff8621b4b8c70de3302c2d7ca1f5503e55a04d09edf615058576470f46e50adcfccc7f75eb29aade8ac1dfa2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648504252, "uuid": "21193e65-6038-4bd2-af62-c6687d047857", "value": "T16D84CF00F790C038F5B725F05DB993A8793EBDA19B2495CB62D42AEE5630AE0ED30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648504252, "uuid": "88774b32-51f2-4e6b-84a7-deb6288610d6", "value": "c5abd0d249bf5319619ab44b6b97960d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648504252, "uuid": "ea6543b1-55ea-4140-afbb-85c8baa12f1d", "value": "6144:zMhVj50CU2wLIDghkPVbwzGf6UGryMqrOSweAQLfSZPq2cHkqE0QA:zMh5rU2wLIDgGdx6UYSwNyqZP1cHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648504252, "uuid": "ab3fb0fd-8049-4e86-8982-a63c25d340e5", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648504252, "uuid": "0a8005b4-04ef-4395-80a9-704def334373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648504252, "uuid": "ed14f363-42df-42f0-8d60-1d1bb5c9b39b", "value": "c0cdfc6d1d123d0f5490a596d8480230.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96dc6962-ae6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648453765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453765, "uuid": "d9ee73e2-f6d3-49c5-bfc9-c94581a47361", "comment": "Malware payload (SnakeKeylogger)", "value": "c8b97e9cb06f449c0051185f3f868208", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453765, "uuid": "2e83b1e1-d542-403d-af28-3f81a18b8d7b", "comment": "Malware payload (SnakeKeylogger)", "value": "777e458ddbb6e71db46b08b1f3eaad28b0326345800c76ca9377e080f9bfbeb9", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453765, "uuid": "e5d95781-af01-4b8c-bdf6-2b5818dfdc2f", "comment": "Malware payload (SnakeKeylogger)", "value": "1e117a205f6cc59de4860958b042590149c003ab", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453765, "uuid": "dba4e651-c8c7-4d1e-a3f4-92afde6a6712", "comment": "Malware payload (SnakeKeylogger)", "value": "461c37f673929acf6aafac1df24738927f230063bb0a4daa8f332cb4b8fb825a39449982aba2b21530ca912d18afc438", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453765, "uuid": "f7ed8956-bf83-4b66-806d-c50576b9bb7b", "value": "T10C251260F5C8A746D90A07FA5421C4B813BBBB2FA52CC80CAD76B15E49367C39726F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453765, "uuid": "ad3b13e7-fe96-42f1-875c-352be52ec8fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453765, "uuid": "35cd1bf4-1fa5-4a39-a7ad-75ceb824fab1", "value": "24576:Rn4HoL0EUKRHRCI3x9l9nZZUJ9wo2LcCZPLbG6Yyk/2jr:gMbRj3xRZSJ9LGVbG6fk+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648453765, "uuid": "784a07ac-1435-405e-aaf9-f59941e19e7e", "value": 1005056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648453765, "uuid": "da7a69b3-51ad-48f1-a291-572627f000a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453765, "uuid": "3b706e27-9ae4-4cb1-bd92-20be29263f95", "value": "DHL EXPRESS DELIVERY DETAIL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da93c7ee-aebd-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648489098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489098, "uuid": "a6c7a6a5-0b83-4fa3-a24f-ad1ccc666d80", "comment": "Malware payload (AgentTesla)", "value": "0d823153ca44b3cf39070342094392be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489098, "uuid": "8cc0ee26-08ce-431c-9e0b-955aa3ac82c7", "comment": "Malware payload (AgentTesla)", "value": "77ee7ec719b6fbe8cf9d3c30399e9659b3d4bdd6e34a2c2a764e3124c38d62b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489098, "uuid": "c62bfcb6-90fb-45ff-ad65-3c39e3ca1e92", "comment": "Malware payload (AgentTesla)", "value": "418422f1726553d4a94443c03ae037bf515fc9ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489098, "uuid": "e13bcff0-fffd-4dae-a26b-75b68ecd062f", "comment": "Malware payload (AgentTesla)", "value": "337b0bbeb403c5893b10e00a9767ad5f6ccd7f4cdf54742586b15beec68a3e43c1f4c5ce009f16ae6c3cad8823a6c007", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489098, "uuid": "3d34991c-6f6a-4379-9239-a6a26b7844fa", "value": "T1D0049D95B5409940EFAD5931BCEA064883F3BE873A5CB40FB94EFD1A76733069600BD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489098, "uuid": "ab1de0fe-0946-43cc-a0a5-1be470db8374", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489098, "uuid": "9993a723-1e9c-4dd7-9084-7e0db1e9043c", "value": "1536:TDtDJkAG9PFkQTvPWeE62F+NeCD+2n8AxdlWUJ3L4UAwNenKrCh88eXvUyO:wAkd5vPZ2F+N578ixkYfUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648489098, "uuid": "4aafc717-5923-4fbe-a6a3-0cd14ed4ced8", "value": 177360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648489098, "uuid": "f431fa6c-0e93-47c7-b7eb-e903e6c61a65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489098, "uuid": "79f5a414-1ed4-48e5-ba68-7215d3c3bb4a", "value": "MV ANNA MARRA(Q88)_SHIP DETAILS.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d43f0ba-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448031, "uuid": "b9817267-7ddd-4f55-9747-0876598b538d", "comment": "Malware payload (Stop)", "value": "061feb5d55f9025ab7d460f1917f0dd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448031, "uuid": "c34d3105-ffbe-4dc2-88f0-2edc8a9030fb", "comment": "Malware payload (Stop)", "value": "77f6b1419532a47164e324e6f2a68b57a35838c305a59415aac6c4452f9f8abe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448031, "uuid": "1e18b44f-5da4-453d-9b82-8499e0b7add2", "comment": "Malware payload (Stop)", "value": "657ba821182058fd50435dd39c6999f3e976fb4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448031, "uuid": "d9a1827a-d797-4295-84de-533122026664", "comment": "Malware payload (Stop)", "value": "f855be2973913dae3d0dfff05d80450b4765a5ac346c5e4b4f75d9feb60a119a55f61a046fae275712651699b6afeddc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448031, "uuid": "b20d6a7d-75c2-4183-adf3-b05585f6249d", "value": "T1A6F4012077A0D038E5B762F48936C3B9A92E79F19B6450CF62D45AEE57342E4EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448031, "uuid": "a53ec97f-10f3-4e47-9704-c7d97bb50073", "value": "3944abc45db6fde5aef61e579409b3ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448031, "uuid": "8a27024b-0551-4f6f-8085-cd435ca99916", "value": "12288:fZDNe0j9dQHOvWx8pBocbDQp8zLynmnh6ftDK2dFFAHsWMCVZZXOsze:R5ee+uWQ7bDamnoftK2dPAhMCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448031, "uuid": "c23cb773-ace8-481c-9c7e-5c0d336b6504", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448031, "uuid": "10874023-cf23-42b0-9584-da34c8367a6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448031, "uuid": "eee76805-9e38-488d-b73e-38a92f50f312", "value": "77f6b1419532a47164e324e6f2a68b57a35838c305a59415aac6c4452f9f8abe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1ef0fa-ae68-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648452643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452643, "uuid": "49381ce1-d73a-4a78-9e26-5bc8c9930714", "comment": "Malware payload", "value": "25dd24186938e1c9d86ff9c0afb06409", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452643, "uuid": "7e4fc22a-a35f-4cf0-aec8-98604d5f2c6f", "comment": "Malware payload", "value": "789f3d3b2f143d070979d6f3ae5a2b0888a359d63181413283d90bf08428d640", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452643, "uuid": "700149eb-0e75-48d3-b8d3-2e87b6bc6fea", "comment": "Malware payload", "value": "36e227d83afe825e8344885fd6947e0751124119", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452643, "uuid": "523ab293-cd6e-48f2-8d45-b2a4f249e611", "comment": "Malware payload", "value": "d57dbd89b0f6eb371d6f9a43943d2f4557565195b9a0c343689e0bd4bd2903c11b35d257e38345d58d3ff003c92a5888", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452643, "uuid": "1c028ea1-3b76-49a3-a703-754e2cefd3c7", "value": "T19C14127836B7C908EAA89F3A2950055E0B1DFD6DDA73CD4A602EB13753B90854E2CF35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452643, "uuid": "c6b72a06-c06d-4578-991b-417ffefb0fe9", "value": "3072:Efg3HDY0Vq3ylKMxHVF33TQRxA9XQVJuSDCJRCEENCaNtdy/TId13wKWcv2mGPWs:nkclKCbn0MZQDzbESC60TM1AAkPIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452643, "uuid": "f8f2e024-f060-4cc1-98ba-85e25d67d10c", "value": 192952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452643, "uuid": "a4ca92bd-1442-4bc2-b12a-6f1eb5a660ec", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452643, "uuid": "a8bbb449-777d-41f8-bfd3-a5048f747532", "value": "SOHO PRINCIPAL0000987.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed845c8-ae73-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648457054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457054, "uuid": "ad1ed47f-9a40-4824-be13-6281d9668017", "comment": "Malware payload (Formbook)", "value": "00c8e44f7c11cd69109cec2928bd470e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457054, "uuid": "da7bdb08-7d03-438f-906a-273fee336fe8", "comment": "Malware payload (Formbook)", "value": "78eea8568cd4745d81f3f5db26624e84bd2ee0cd56514f30a4557c479e4482d8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457054, "uuid": "e435ee2b-6f7e-40ce-b01a-6e57cc074325", "comment": "Malware payload (Formbook)", "value": "96cbe1eb5dd4de79050d033a4b5e6e2efa720aba", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457054, "uuid": "619145ef-9bc7-4781-8291-6b6d57eebfc4", "comment": "Malware payload (Formbook)", "value": "760537ae88edfedb00f317764b3e6b511e95b89ca15c570a0b881b43622125db91e390c7579fbc59bc29885156042a49", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457054, "uuid": "33e65992-50d9-4acb-9217-b7aa288137b7", "value": "T165A4231D8656C6A2EB39F7D2242D1E97CA81E042C712D1FD520D8273E62073D9E19EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457054, "uuid": "d9bf590c-20ef-45b6-8160-ed7e118cce44", "value": "6144:o6b0Ps+ZLQ29GjO34sZ9p77N5cvZUmyp8H4QZ7TNbwTRh5iS5kdb0pP4Bk3895fe:o6v8T9JLATy8YQ9iTWEABkMzm2sNWE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648457054, "uuid": "c190c248-36d5-4f0c-bc79-ae0499035c99", "value": 456202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648457054, "uuid": "6a40227c-0f07-4c25-8edd-8d865240662f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457054, "uuid": "ed7eb54f-21ac-4128-9696-63a1d597471c", "value": "SOA PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a966f8-ae62-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1648449688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648449688, "uuid": "8d163dd6-f172-4bdb-9214-901cafc44b25", "comment": "Malware payload (GuLoader)", "value": "2f1489e4b8523628f67bf53b68be86fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VACUUMIZES", "colour": "#EEBD7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648449688, "uuid": "12290014-17f0-4e50-aed3-ec9c10dee1fe", "comment": "Malware payload (GuLoader)", "value": "78f8221d10ca5af256eefa0376f55e4688e00005317ab0bfb59f5406f9ed16ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VACUUMIZES", "colour": "#EEBD7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648449688, "uuid": "4530e14b-e47f-4881-8504-1ac0b1cdedd1", "comment": "Malware payload (GuLoader)", "value": "4a0c9b300f8feb00c6014a821a2232ddc2b84654", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VACUUMIZES", "colour": "#EEBD7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648449688, "uuid": "83025010-2a62-4ffc-a51e-fc3bd29a13f2", "comment": "Malware payload (GuLoader)", "value": "8dee226dcd78580934f86f2ac37205386b20e00ef2200900544658c0a39ba820a9002187a48f6e8024b10e08ceca1706", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VACUUMIZES", "colour": "#EEBD7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648449688, "uuid": "23ca5a9b-1408-4774-9c1d-81ca0448f95a", "value": "T19BA3E1516BA4D877E9724B7018BAEA479EFAE61124F0920F33309758BE37653E50F702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648449688, "uuid": "93700df9-d128-4a91-bb0b-4376032d7226", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648449688, "uuid": "1e1deb9a-4ef0-4a75-9865-1521e836674d", "value": "1536:ymsAYBdTU9fEAIS2PEtu7YOOAPbn0tcatGXXzIyPlqYzHhaCE+uSrRZ0/sNKtuK3:BfY/TU9fE9PEtu7YOOAPb0uaEXXzISdG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648449688, "uuid": "d2be16df-e049-4de4-961c-0aa20d1fb55f", "value": 98024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648449688, "uuid": "1ea3762a-28b1-46dc-b3cc-7478fded98eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648449688, "uuid": "0079e6cd-34ae-4ce4-aa6b-780e07a1f644", "value": "Richiesta preventivi 28\u00b703\u00b72022\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf56a82-ae93-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648471036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471036, "uuid": "05725013-4e5a-41c4-af4a-d8feed8f60e8", "comment": "Malware payload (SilentBuilder)", "value": "e77284dcc04b9f2574330993e444421c", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471036, "uuid": "0e1a5de1-6d7f-4f9f-add8-694038c19ae9", "comment": "Malware payload (SilentBuilder)", "value": "7a2aeaca2afa1cb85b2c59bc6ee7618904ee2dd75fc213a63c305e23a9a43deb", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471036, "uuid": "35735579-af5d-40bd-ba8f-35c09fa27c41", "comment": "Malware payload (SilentBuilder)", "value": "3a0a75562c1841caa2d4e92cddf6ffe3fd3c90ed", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471036, "uuid": "a3af125d-2980-469d-b185-0c26f0214ecd", "comment": "Malware payload (SilentBuilder)", "value": "2a935606412cabfba0aa616d80e67e7b6671ea3772fd652bda310b0710e8798a008b7ad9ea53f2794154029a27e8ee7a", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471036, "uuid": "4bd93a99-9e70-4317-a777-928fc0687ab9", "value": "T17543E95BBA49985DEA14877548E743997323FC304F6B074B3269F3257FF89A05A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471036, "uuid": "4f972915-ae58-4bf6-9d76-1617028eb442", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umvT:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648471036, "uuid": "0460fa99-17c1-4819-b503-69caba86d885", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648471036, "uuid": "0bc8c559-5c2f-4353-a990-cb9e7145d19e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471036, "uuid": "d373c331-d5ff-4910-8767-bac63d0a213b", "value": "File_SRQ9P87C75OCDLO.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17de5b30-aea9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648480181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480181, "uuid": "3b490ba0-7afb-474b-899b-2403a6495339", "comment": "Malware payload", "value": "29aa6b7b27ee58fb40d449d79edf0d50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480181, "uuid": "f0dc4daa-cd00-4dde-b9df-1b0c4cc8fba7", "comment": "Malware payload", "value": "7a60845ff883135e84e220f152e6aa40916ac64f1d59cbbe0954688dddc96d6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480181, "uuid": "a8f94434-d33c-4a85-8dba-b51cc29e5430", "comment": "Malware payload", "value": "ac175f0f0407b06d382b58233c919752d5b88c75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480181, "uuid": "f88b5104-0360-4ef3-8cb5-f4fe93c78a57", "comment": "Malware payload", "value": "a58186921584d416d96c734f62c43542ac77d065b692d8c434a4f34bf7e80464d4d17885ecf1dd59b3d6b14be833aef1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480181, "uuid": "9680a45b-487c-4156-82a6-7b9ccd2dced4", "value": "T1D743A6593A318FEDF66CC3354BB34B21A79C63D622E1D6C4E29CD8051E6034E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480181, "uuid": "883f93eb-a843-4d80-8922-0caa116bf72b", "value": "768:jYzVG7/A9Pr0SCG4iQ72kgFG4bZOKkBiVe4MxMP+h8f1CEckr1I/y42RevVy/tRw:jcV6+rAG4iQ72vb0KfMxY24evVyVRrDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648480181, "uuid": "51e5b9fc-cd8b-4d8b-a81c-6bf1412db25c", "value": 59896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648480181, "uuid": "7d334c0d-9f43-4557-8a72-5beb584ea938", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480181, "uuid": "989c6340-1d07-44de-bd99-236ad318c10d", "value": "29aa6b7b27ee58fb40d449d79edf0d50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77243a5-ae5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447914, "uuid": "0463bd36-7c6a-4dc7-abf6-525702e4da2a", "comment": "Malware payload (Stop)", "value": "15d042aff46d76db7fb7fb275dab5759", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447914, "uuid": "84a65e29-693f-4e1e-8c78-2dec6fa8eba9", "comment": "Malware payload (Stop)", "value": "7a8036c61f22b8f9a4ace433b65d393b271dede1a2be1a688c70c3838fbca5ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447914, "uuid": "746adaa4-b771-4797-a2ce-21e92032899b", "comment": "Malware payload (Stop)", "value": "08a2c1171e903f1e42beac8b3c8c52c86244ea61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447914, "uuid": "79a3dbd0-951c-4b57-8691-f62ea6602f1e", "comment": "Malware payload (Stop)", "value": "708c2fde411b370c864c09203bfe12b7cd7dda3c755495160cb983dc3278fb445995a8e6d70a428b64d2d570a2fc5f57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447914, "uuid": "53fcd456-586a-417d-aa17-ac5e392025c8", "value": "T1A6050214BB80D035E5B306F49979A3A9F92F79A16B2160CF22D41ADB5635BE0FC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447914, "uuid": "73bc1573-a935-44f4-a3b0-375c41652d55", "value": "bed14e41bdd24b7cea4b53883d7b3cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447914, "uuid": "64a34807-f6eb-4041-8357-6cbca48a68e7", "value": "12288:GFnsM9vuRrluIjDI1sNb+3DSpRMYHV56Dz3vWvzJ2CusGlMBy7V3JzaOsrk7YX:on9mRXIEaBC/ju/lMBy7V5uP4UX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447914, "uuid": "75c31f55-6188-435d-8b1d-b53033e59aff", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447914, "uuid": "ebaf2b75-ea60-4f53-978c-aa84227b3d0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447914, "uuid": "09e4fb04-acff-42f2-9c38-a415b0736e72", "value": "7a8036c61f22b8f9a4ace433b65d393b271dede1a2be1a688c70c3838fbca5ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615dabc4-ae9a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648473862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473862, "uuid": "ffbab669-dde8-4ddc-a9b2-fd231370322f", "comment": "Malware payload (Heodo)", "value": "9a7536edd282ef6a68147e4166af1f75", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473862, "uuid": "0d2634b0-4b66-405d-b1c8-c014fe26a37f", "comment": "Malware payload (Heodo)", "value": "7a91a207525080f38dee8108ef0f92d3689c670c5727957faec1b656b9a5721d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473862, "uuid": "ab756cf0-4d2e-4c8f-ab59-253c0a38ae7e", "comment": "Malware payload (Heodo)", "value": "6ec47a825beee9848634b0557b7cda360e11108b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473862, "uuid": "db0d1a6d-12bd-4848-8e06-76fc08306840", "comment": "Malware payload (Heodo)", "value": "0f24a68cc921f313c2d9d264395586ed90a99e15644ec82eba1a7a8fc74e3655b1d248e550e8bc191b6338975b9533a9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473862, "uuid": "736a8c75-6ac5-46af-99c5-692b75d1f73f", "value": "T11864F71233C391F0CA53B574800FD525ACB6B43C6B15897DA247A56F87EB8D0DA34AFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473862, "uuid": "b2d8aedf-adeb-477a-94cb-23f110faf1a7", "value": "6144:S5uok8qcKhyMlSXVKfKGS4Tp3wb8iZ7B1yan:S54yM33d3q3Z7BoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648473862, "uuid": "53052ad3-f228-4566-ab86-c300a6d0c970", "value": 320904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648473862, "uuid": "d0a5fd3a-89d2-4f3b-95fd-1c0cac47a8e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473862, "uuid": "0a406dd6-9328-4ca3-907b-3b676bc3a4e0", "value": "emotet_exe_e5_7a91a207525080f38dee8108ef0f92d3689c670c5727957faec1b656b9a5721d_2022-03-28__132418.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492219c6-ae96-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648472103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648472103, "uuid": "20cb59cc-4399-4562-be5e-5250c31dce2a", "comment": "Malware payload (Formbook)", "value": "e7ed517edb255b2b0b90165552d7f12d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648472103, "uuid": "059c333b-f165-483f-91c4-9126f8299098", "comment": "Malware payload (Formbook)", "value": "7a975e0983903a474303dfbab00a6ccd3a5f9f3339fb1d756aa36f5172361e7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648472103, "uuid": "80f0e2a4-3e03-45a8-878a-f18ebce9b474", "comment": "Malware payload (Formbook)", "value": "8fefb192e7b649e7851bc6dfc9bb98cf080e939d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648472103, "uuid": "083b39cd-e6f3-4af3-b332-790645bcdc79", "comment": "Malware payload (Formbook)", "value": "2d8ea9e1459c114bc98da83e9cbed579c01d2bb65c3afa8d9765908b9d19dbcee00ba7d6cca9c642c20778b7da559c5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648472103, "uuid": "f9bd379f-bee2-45fb-bd77-4d355a069384", "value": "T136454B71F7F62ED6F1AA06B7A731744C83373D6A56B991CE0484374824703A66EB0B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648472103, "uuid": "0bda9461-20c9-412f-a4f5-01798f587149", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648472103, "uuid": "fb2e43c2-1014-493d-84f0-fe3773e1148c", "value": "24576:hEEr9BJwWUsBM5vepem8Jqi+5HPqYhwMfLBis:59BG/sB/aqpTwMfLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648472103, "uuid": "25a353f6-b9f1-40c8-8059-9e42e5f322a6", "value": 1241600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648472103, "uuid": "86de4b25-19c2-4d64-b41a-5324520d7fe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648472103, "uuid": "23ec87a6-881f-472c-a84e-1f61142f2564", "value": "280322028656,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d027e466-ae6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648453861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453861, "uuid": "9a7ccbd3-0427-4c08-8e26-ea997b1bedee", "comment": "Malware payload (Heodo)", "value": "d53f70392fad5eaaf74b2c3248b5b4ff", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453861, "uuid": "74991157-2fc5-4af6-a815-fc2c9d491a23", "comment": "Malware payload (Heodo)", "value": "7ab4dd297eded2b1d095f6a578c50e9cc518ac1eeadbe28cb10aa7df4a2f084e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453861, "uuid": "83b9ac6c-3717-44fb-a41d-25167bff9c87", "comment": "Malware payload (Heodo)", "value": "21afe00c8fd06eaac75c695162a8a0313c72ed55", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453861, "uuid": "b0419a4a-8623-48b6-b9c8-3e679a5a50d1", "comment": "Malware payload (Heodo)", "value": "84ca3a197adc10331177638490c826e01353a56bb1a81f280dc995b1429070971a5e01106c0dcd281874e8f72d7b16a3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453861, "uuid": "162a86da-c3c6-42e9-9cd2-cfcaee9b2115", "value": "T1E594CF0272D0C47AC6EF23785D239B5AA7F9FC208A75C647A751BF8D5E326C1893035A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453861, "uuid": "976838c0-602d-4b8d-a5ba-715379074b3c", "value": "8f8b1cb86c6697dd342b65a36c6ccbb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453861, "uuid": "09112bb9-8f0c-4fd1-b75b-897050537758", "value": "12288:zwn2hR3547jpDMgySFxpuCMS5AhugWarPU:DRJ47xjy6puCMSqumrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648453861, "uuid": "a5811652-04fc-40b2-ba10-da42c520f2e2", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648453861, "uuid": "b9a66f71-e4a9-478e-8115-e617e1d2cde3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453861, "uuid": "0db08042-e650-49b7-b91f-e57a0f6b6482", "value": "emotet_exe_e4_7ab4dd297eded2b1d095f6a578c50e9cc518ac1eeadbe28cb10aa7df4a2f084e_2022-03-28__075057.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89514e4-ae83-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648464210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464210, "uuid": "5a4f59ef-fc47-4ff3-bead-3d0f9919564b", "comment": "Malware payload", "value": "f1abd006f74ed9a863588e331ea18f6d", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464210, "uuid": "0c5a082e-5579-46f2-91eb-646c301078c5", "comment": "Malware payload", "value": "7b4cab32e99bd70b86b128f7379dd6214fa0021dbc2f8e308d30536837308889", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464210, "uuid": "5de96886-a432-441c-b334-cd42246f954e", "comment": "Malware payload", "value": "4ab6acd3badb9837513c821978e0be582ad6b649", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464210, "uuid": "5ef3782a-acb0-4cea-825a-43fe70aa5b95", "comment": "Malware payload", "value": "9bced518c9fee118561416683d6f96cb9e37d8fa46c78a09548790fe3fa4f4cd10690d5b51b962d151e01dd0e2593984", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464210, "uuid": "d73f65fc-8abe-4d0c-aff1-838e5aeae42b", "value": "T1581633A0709560F3E2B61B35943F2604ED3D2891D7A7A94E63E4883799B6581EF31F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464210, "uuid": "5a9ce830-64f4-4ef2-83f2-3a89addc17d3", "value": "027ea80e8125c6dda271246922d4c3b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464210, "uuid": "f1308a18-14fa-49e5-9a8b-2b2613f1789e", "value": "98304:JNFGO9J9BhGzXrff0v4rOFBlE9fBMtyTdFZ:JaqLhGDQv4rOFBlcfBnB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648464210, "uuid": "13b89523-f475-4e11-8407-9da47293c2f2", "value": 4064003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648464210, "uuid": "c5e5034f-e7e9-48f0-b37a-add43c565aaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464210, "uuid": "cdf9e852-3183-4139-a900-42d50d1f49f5", "value": "Azorult_3.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c15386-ae5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447918, "uuid": "65b6005a-1a04-445d-ad70-10ff4e2a74f1", "comment": "Malware payload (Stop)", "value": "e67a1c3480ceeeedfba1410e4a032ded", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447918, "uuid": "a4fe124f-3b9c-4dea-ba0a-f50cbea803bd", "comment": "Malware payload (Stop)", "value": "7c192e65c2e3b074cc0d5f23c219aa06a765c3fbf9ab35eb99009e9d90687127", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447918, "uuid": "3abef4bf-468a-4128-9ebf-7ea2ea3aa57f", "comment": "Malware payload (Stop)", "value": "c92976c8878380de6895904d54b7f4f34010ade4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447918, "uuid": "e042a45c-df79-48a9-8db3-b78f97f6baeb", "comment": "Malware payload (Stop)", "value": "496e294cddcff82987b98d52cdac9efb7bd7041ecd1fba29c411b93ac08372f35df3c6b9b983654944d683767160e0d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447918, "uuid": "c67b7daa-3bb4-43af-b9fb-6d80876ff944", "value": "T13E05223170869133D13A65716546D6B05B6BBC342E31DE533B8426AE1F323DECEAA34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447918, "uuid": "6e3dfbec-2c13-4b01-9470-638b3b7c43d7", "value": "1690f0efc188c620ac36940e114b98ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447918, "uuid": "465fcd6d-50ed-4d95-aa34-4722145bb57e", "value": "24576:Z5P9IIyFnDSdPtH2cdzLTDmNNqDFOpzE:DP9IIyFnD+Pp2cpDJDFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447918, "uuid": "f95af61a-af85-416d-8b1b-50d5da4c70d5", "value": 822784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447918, "uuid": "0cc6d81d-dce5-437a-82c0-aad59f7585ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447918, "uuid": "fc3704de-05a6-4f62-8bc1-64814b8c1033", "value": "7c192e65c2e3b074cc0d5f23c219aa06a765c3fbf9ab35eb99009e9d90687127", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d653a216-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648448288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448288, "uuid": "b3771e13-3102-4f4d-8bf1-e23d2b461bae", "comment": "Malware payload (Formbook)", "value": "0808b68d09cd655fffd75fa7ff512cdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448288, "uuid": "1967fc29-906e-4d27-808a-d7a2b3093fdf", "comment": "Malware payload (Formbook)", "value": "7c4498328cef0faaab309c43e2b0122dd33164c9cadeae33f47d3a348d1bcb8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448288, "uuid": "c59b3d35-fa04-492d-a3a0-323dd0f30a07", "comment": "Malware payload (Formbook)", "value": "51099ae2efd1c4273aa82a8b497c6caa0010fc8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448288, "uuid": "579fe149-83cc-4b1a-a59b-65c9ff9123ab", "comment": "Malware payload (Formbook)", "value": "3c00e5d915cc0d96aa7717005792e022eabfcf53fec0d56a901cc7715d65d702830249ec528a3e7608cecb9a3055d73d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448288, "uuid": "07c425ce-920b-434e-8d2a-37a3ddd67d9c", "value": "T12235F10236E05B95D07A53B6CC6844DC07717E096E7DD20F2DD276CF1AB1B818A2AF9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448288, "uuid": "f3642b55-1522-4fff-a94c-83a975a6dd92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448288, "uuid": "94e49a34-7ddf-4772-8027-972a27128fbf", "value": "24576:apX3hMap5/5L5GMtLW5QlppvA5VKP38Wq0GG:ght5/ZpxlppvsKP3Q0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448288, "uuid": "7ff8a383-c731-4107-bc38-4a778a02ade9", "value": 1102848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448288, "uuid": "4a5fba21-8b3f-4578-8df3-c1a9bb584bde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448288, "uuid": "76e43f24-4c4b-4319-aca2-a86c56a81b95", "value": "Payment_INVC 4894983swift_845595488.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344f2434-aedf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648503422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503422, "uuid": "61897fa6-2f07-422a-accb-f76bc30f28d3", "comment": "Malware payload (Heodo)", "value": "c50914e5166e6255c4ee3ca4b7d6fbfc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503422, "uuid": "b6849a35-0428-4840-98a0-3271a73775e1", "comment": "Malware payload (Heodo)", "value": "7d2045a7570dc8dcdb25a6e8deb37667717c9ace7d7960df1586e9ac431bff25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503422, "uuid": "f1d05511-5848-4d2b-8690-3bf8e3f09b8e", "comment": "Malware payload (Heodo)", "value": "e60e8c5629574dfc9dedbd84c63c2636be2820cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503422, "uuid": "b16897b3-9245-4c30-8697-fe723b701b09", "comment": "Malware payload (Heodo)", "value": "dabe9524a4f9ef471a15491e07f70e472fe4667a00ba4cd17349e9a0daae0858b5b30cf1f75cba63d2a047bbf25fc292", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503422, "uuid": "2d05584e-ac5c-450e-85a6-a546cfd78557", "value": "T1FBE48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93FBFCD302514D7432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503422, "uuid": "4056d3f9-4598-423b-9156-a097a15cfaa2", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503422, "uuid": "edbab45c-34a8-4bdf-8a6b-57d915eda1ed", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7UvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zqCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648503422, "uuid": "66c6beed-48e2-47c1-abe7-af1c71c6fe3f", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648503422, "uuid": "82ec70af-0b56-46f7-95a5-23ceaecbdc25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503422, "uuid": "8f8b1c06-e8c9-4951-a9a4-bf2962e96745", "value": "c50914e5166e6255c4ee3ca4b7d6fbfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89baaec0-ae6e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648455032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455032, "uuid": "087addc9-58b4-4810-8e88-5a7787f912c4", "comment": "Malware payload", "value": "a53bfb0fc84e8089de15900ea1c45806", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455032, "uuid": "64131c15-91ce-4e6a-8e6f-4d9d34f3781a", "comment": "Malware payload", "value": "7d3520fde6dc4290874543f9de75c769b7d8a5080fd38eb0671ecec46b97c30d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455032, "uuid": "9016192f-fed7-4242-b198-860e9726ba0f", "comment": "Malware payload", "value": "e4fc682b75a940326b3e4a67fc9bd7d436b5db95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455032, "uuid": "10cf1240-ec5d-49db-ac76-da4ca1c72923", "comment": "Malware payload", "value": "085a40abd4c7ae1c8478d0b0b4d1ad1bc5a1e5643ec366f7cc406c829f3aace796a1b086eb139006bca305af4d8de976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455032, "uuid": "d3d78d6d-a47d-470c-ac72-1ac5807328c5", "value": "T172D59D46BBD08F27C16A4B798AE787157339DC445F435B0B6348B2293CB23F46B926D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455032, "uuid": "47991930-7b25-4e67-ac1b-ba60e3a4a6dd", "value": "24576:jnNi2Lx6OFvpxJY5BHwDYtFy6b8XxU30VUV78d6ij+RNqN+7A6RdexYcer+5k8:LNDFFPJu8fBsVE6ij+RNg+UKp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648455032, "uuid": "bc992eff-93e8-4722-aa53-44483c8489f9", "value": 2987447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648455032, "uuid": "88d46057-8079-402e-9050-ffe2a649a9e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455032, "uuid": "87140744-bd26-47bd-ba31-d4cce6347f04", "value": "a53bfb0fc84e8089de15900ea1c45806.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7308223-aecd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648495991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495991, "uuid": "732b96e9-4896-4f83-b8f8-b07b1dc446f3", "comment": "Malware payload (Heodo)", "value": "0101f2630cdb3f9c217b92b18e2662b8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495991, "uuid": "34e3306e-118f-4c38-8d39-e55618e67140", "comment": "Malware payload (Heodo)", "value": "7d6b565bfc1fdf5e6cbe3df5f2b7202141675491440c5d89a7f1304443e52867", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495991, "uuid": "e516f0d6-b4b0-4808-adfd-b0a1f2b19fd6", "comment": "Malware payload (Heodo)", "value": "e9ebee9dfbb053944d26d273c1b01aacdce86e6f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495991, "uuid": "307e98cd-44ee-42f0-8b60-a8dd6b0fe872", "comment": "Malware payload (Heodo)", "value": "1ed27201cbee7263d6b8915bdbe8450bf440fc84001e6785d4fd9e46bee2071d3341aeb6030706d6a76f7ff8717eba6a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495991, "uuid": "94e86265-c220-42ee-b2d5-74610111fcb0", "value": "T199059C596B46C0F2C3B53CF0182A42B11D9AFAF2C7B7023B9E84167D9A70DC17768D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495991, "uuid": "5bb7a3da-9ac9-4b00-a069-316be8d6838c", "value": "cd97bd977cef263c697f451ae2c47380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495991, "uuid": "c53fe222-ca84-4c10-8b97-e9ea2e0fb14c", "value": "12288:V20BXOMcVzpWfmmnDDQX5P8fMYsvFE6NKGfLjx8QvbxafqNPOd4jy:V9XOMc1KmmDsX6svFEDGloyNPOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648495991, "uuid": "b37bfa8a-768f-4fe5-a87c-6080067cbe97", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648495991, "uuid": "b8ab5c69-7fa7-441b-9db3-4fb1d901bc4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495991, "uuid": "8b9652c4-776c-43d2-a9be-f802b184e175", "value": "emotet_exe_e5_199087f6895ba7530acf1e6efb49c26faa74ffd0981e5f850f7930ab7f363bc4_2022-03-28__193301.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5877552e-aece-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648496181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496181, "uuid": "c12d2864-7ca2-4607-8041-dadaf75b0692", "comment": "Malware payload", "value": "89267f55c5949d6fb55a556e9ceab491", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496181, "uuid": "d9e82442-63f6-4be0-85d1-b20628fc590c", "comment": "Malware payload", "value": "7d7391e8020f9e99400c39bf827ebad61954206ae53d7b6e3f42a85948d574e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496181, "uuid": "1f22f397-33fb-4541-b059-0a44d79731d8", "comment": "Malware payload", "value": "0b63b0c5ef5eb3f38a9e9395fa0a77f257d07875", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496181, "uuid": "a9d3b79a-b37f-4c39-9bbe-43f5204ae1a8", "comment": "Malware payload", "value": "52272e26110dae3bd82ed987003eb13e07daf5022d1cc6b964d910d132545dcc9d732a0b4e31d81e355079889f02c81e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496181, "uuid": "abec21db-741e-48eb-86f3-bb299bebdd73", "value": "T1A49423674419B84AFDC3953E4FA108C287B6642F1E86F37F90A1F84F259A394796FC84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496181, "uuid": "ccefbf82-6701-429f-8012-c0e00fd05e13", "value": "2068e4b063a1e98b58dab0f59167b1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496181, "uuid": "dceeb126-e69f-412d-9be8-164c85c509dd", "value": "12288:vMtwhuGh4RCDInQWXFl7zpwzQ4yTNBzl1GGAAKPr1:EtwhnhnDIbXFZSzATNBZYG3KT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648496181, "uuid": "e3262d68-5c0a-4ba8-8f45-b301127398f3", "value": 422496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648496181, "uuid": "3969be74-7ed8-4f84-9a91-54cc7ea4f17f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496181, "uuid": "293ac5f0-9eb6-4bd6-9187-49d7ac455635", "value": "data64_5 (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82af314-ae74-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648457713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457713, "uuid": "723cbd4a-1f9a-4589-8b4a-7960a3f20aa9", "comment": "Malware payload (Heodo)", "value": "5510fa227a98112933afbc5b74442ed7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457713, "uuid": "7d5ea8c9-1e8c-44d6-a717-bbe8966c877b", "comment": "Malware payload (Heodo)", "value": "7e75f22214c0f0923504d79286553f749ccdb93c9ad6d6baa0eb775ebfe1316f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457713, "uuid": "9a2b72fe-67a4-48f2-b44e-60afd5848a2a", "comment": "Malware payload (Heodo)", "value": "7cc16882fe76030eb8531279ce01772a3b024c87", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457713, "uuid": "2b68db9f-bbc7-4c5a-8280-6b2b68aa083e", "comment": "Malware payload (Heodo)", "value": "adb0f1381d2d4f281043e940944d4fde1760db9d71bce59b81cc5082f172467c84bfcb271673f424d7ac60944540689e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457713, "uuid": "deebe0d2-7f4d-45f3-8532-4962fd7842be", "value": "T1F7058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457713, "uuid": "833f288d-8f3e-4f5e-b83d-ea093c77643a", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457713, "uuid": "042a434a-75f7-4518-bd9a-291ebe1ca4dc", "value": "12288:Wvz1CLJyyvmMLSrBgU4ruGbPlVpqb+DlYzv:WJCLJyybLqBR4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648457713, "uuid": "b5c729d0-26a6-4823-b4dd-5028660aa072", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648457713, "uuid": "22f6874f-4cba-4f75-8993-966345d81897", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457713, "uuid": "ff38a26a-5a7b-4111-91fd-c160f7e9c1cf", "value": "emotet_exe_e5_7e75f22214c0f0923504d79286553f749ccdb93c9ad6d6baa0eb775ebfe1316f_2022-03-28__085455.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f0e9a7-ae35-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648430541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648430541, "uuid": "ff58420c-af21-4020-9140-815d8bc49a9f", "comment": "Malware payload (Formbook)", "value": "8930a6c2109dad377a218cf36fdfbf96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648430541, "uuid": "4e27be9f-9ac0-45e4-8e6e-9e9690b69c38", "comment": "Malware payload (Formbook)", "value": "7f2f847bde8c4df56662677d1df9c413b2328786469a6065b6793ad90198e35d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648430541, "uuid": "cefee912-c7d6-4d09-afdb-47ceb7a16839", "comment": "Malware payload (Formbook)", "value": "6e0e5170f838144c456fc008e7778d103df6cdf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648430541, "uuid": "bdbfcd82-878e-4da8-971f-65bda6e62323", "comment": "Malware payload (Formbook)", "value": "22f9a3263e657ada122ff5a7b8d3a21c2b793d40604ac39d12b2592dd8ea61ff520a2d4c16471bc26ac0a42d1f79beda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648430541, "uuid": "599f43b9-883d-4a72-9be2-dfd56b966681", "value": "T117E4E6ADB2F075DFC86BC172DAA81C68BA507C67930B4103D02735A99A7D997CF143B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648430541, "uuid": "bbf5cb71-8376-4214-905d-acad9a80d2e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648430541, "uuid": "68d1acb4-6d66-452c-9d77-f9c73e848670", "value": "12288:wQXtSmz9J1ATm8CQt6TU0ABkch+8M49ll/R7sDHl4DANtqbqoyp15Z7oXagVLADd:wQXtp9JmrITUr1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648430541, "uuid": "b7d53c75-7edd-4396-ae4b-fd47212697d1", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648430541, "uuid": "35cbc213-a150-45e1-8e72-88cd7b0a1bb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648430541, "uuid": "72473a95-9266-41ca-908c-e256f0666138", "value": "PO-34482.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e06c27-ae57-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1648444982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444982, "uuid": "a871c051-dc92-440c-99fa-63a377b251c3", "comment": "Malware payload (DCRat)", "value": "d53709f9394a559d7774b5998decb1ef", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444982, "uuid": "2a47c854-d2b6-4140-8b47-f5a2f2dcc67a", "comment": "Malware payload (DCRat)", "value": "7f621f583dd73a873897157c49e5a2c7d4d4590265516a3f7549641b53052276", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444982, "uuid": "83ea336e-3a19-4f48-a615-e0680f0bdde9", "comment": "Malware payload (DCRat)", "value": "2f883b030938722949b33839c6d26c64140be3aa", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444982, "uuid": "fb1231bd-e9c8-42e8-9cc2-47bbbb2494fc", "comment": "Malware payload (DCRat)", "value": "f46601a7cb4057afb3d85b99c943ae1579b0711ef84177d6c238c3d61b0be6d7995fef64b45d066c381f31238076c2a6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444982, "uuid": "f40ff25b-a69a-40da-8bbd-1725aeaf1041", "value": "T16E75AD12BA44DA07D06A4B33D9DF842847A8AD422B67DB1F7E9A339D15413BB5C0E1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444982, "uuid": "9d26411d-4316-421b-9502-53c9fbf395ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444982, "uuid": "1820136e-22fe-49bc-a911-36555f8839e8", "value": "24576:lbfESdvMj6hoGDAQsJ+N6XcHQWq3QY2SrXQLdok0OjYS4mej+T1kJCv:REi6GDAQORcwW5/oBjme81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648444982, "uuid": "d914d5d2-38b3-4840-9760-abafefa6837b", "value": 1594880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648444982, "uuid": "57a4592f-d14d-4ae7-a0d3-fa9b1ab4a3eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444982, "uuid": "ccd4ad74-0254-4fdd-88fa-d3a5acc783cb", "value": "NvH1b04rCk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e50c8a-aedf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648503394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503394, "uuid": "3ef9cda0-5653-4f9e-9ddf-75bb607a3eee", "comment": "Malware payload (Heodo)", "value": "3ceebe0c54099a1e436b4511187eb0d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503394, "uuid": "308af22e-235c-4409-b8f3-93291d40fab9", "comment": "Malware payload (Heodo)", "value": "7fa3c3152fb914bbec2dd7dfb9e634c2e1d4a72d50ecd4ff586dd722d759b16b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503394, "uuid": "90249a78-f453-4e88-ae13-11429ffbd756", "comment": "Malware payload (Heodo)", "value": "acb66d05a6192155fd6c487418d87785e3291462", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503394, "uuid": "6d98f93e-9a5b-42a7-9594-fd69f0c91915", "comment": "Malware payload (Heodo)", "value": "833677ff3141cd78089c8b1aa82b86afb09688a0d44685c4a642aeacd9dcf09a4c29fdc8d80794b4982a21804408396d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503394, "uuid": "16944ee3-1eaa-4d54-a160-8d87ec78ad9d", "value": "T11DE48C1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514DB432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503394, "uuid": "3fc61199-b738-4b50-86d6-f368a4567dae", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503394, "uuid": "8404342a-7c9c-4eea-b7cf-fc5dec68f2bc", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7cvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zCCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648503394, "uuid": "282e0ec6-292d-4fa2-8c1f-170d251ebf73", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648503394, "uuid": "e5e6dab9-4d50-4ae6-bbea-d371f0005bfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503394, "uuid": "f8b69aa6-a8ca-4bbc-a238-822e8ec2762c", "value": "3ceebe0c54099a1e436b4511187eb0d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcbd0082-ae5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447923, "uuid": "a42be624-37a5-4bc6-b9e8-33f001ee29b3", "comment": "Malware payload (Stop)", "value": "61367abbbcb34d979366f8e6e130d2d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447923, "uuid": "92620235-7b43-4a3b-8c8a-4e694b6c06b6", "comment": "Malware payload (Stop)", "value": "7faa3c5a451101caee04dc8275d9269d41cc73b5c042cc338e33b654b7f0924b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447923, "uuid": "035e1574-ce20-4271-9bfa-772544835b5e", "comment": "Malware payload (Stop)", "value": "61d26bf63405625b4c4a24a18f9be72583e27fab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447923, "uuid": "efea693a-d1b5-4857-9aee-5c823b7ad007", "comment": "Malware payload (Stop)", "value": "87c5ea5438215e8610dc797d585ff5bc3f833ae817cfd63b0f31368a06ec70303d27f459b71249444b599da65cd89851", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447923, "uuid": "b8c4a288-4ef6-4cbe-a997-2f2dd2f22f60", "value": "T10F0523413866C4B1E45A03317515DAB15AAFB87D19622B8F3BA51B2C6F342E3DF3930E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447923, "uuid": "20ce6dba-4213-4d61-aa2b-4f606a74255f", "value": "bdac4e084518b9cc081bc073b01c0898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447923, "uuid": "8c9ca446-3e86-4925-82c5-23d40b37dccb", "value": "12288:4qxq2jkDlJFBIL73DDxDFkHzF3T3uhXeB7o+AsT0fW+VBNyeW8F8M5R9lqlzX:JvI+73DDkBq2cX20ftkGF8kR9lO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447923, "uuid": "3baf8495-dc04-4bae-a51a-2a9861f8304d", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447923, "uuid": "bf201d48-549b-4c65-80d1-0e264802c265", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447923, "uuid": "0c98d0e2-ee0d-447b-804c-11074f162d8b", "value": "7faa3c5a451101caee04dc8275d9269d41cc73b5c042cc338e33b654b7f0924b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0efb82e-aec0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648490316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490316, "uuid": "bedf6dfd-0c8d-4d03-94af-acc683d61b60", "comment": "Malware payload (AgentTesla)", "value": "d04f7cb5beec80d783f173e6d4cdcf2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490316, "uuid": "e5ad9e68-d8db-4b2a-a4e4-4b790b6d6fc6", "comment": "Malware payload (AgentTesla)", "value": "7feca553fe39611281c589f69707d7b6e8b9906162e522beb0d4e7469f64b81a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490316, "uuid": "2b68f211-8912-4981-bbc8-5656b1664ea7", "comment": "Malware payload (AgentTesla)", "value": "239ca4bbfa0c608ef1bb4726394287f8f3dc8143", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490316, "uuid": "c60e0c10-b3a4-4b1f-a568-5792d550b12c", "comment": "Malware payload (AgentTesla)", "value": "e8a842216aab1bcec452966c6efa5a18fef6979725ef38368135b27956dca698039c45cdf9311d4bbd299049b968f071", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490316, "uuid": "7829bc80-66b4-42b2-9e92-2ff913dda3ad", "value": "T11515120773E86F92E477DBFAC95A1A5443B2B129250DE2495CD630DB12F3F4083A0B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490316, "uuid": "879df01b-a1b5-4e0d-be64-d89d53898761", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490316, "uuid": "bf86809a-1578-4801-b445-9090c892b534", "value": "24576:OmPwO/wfo9BWXffvu+KM+xuBipmwUqW03uy0:Ouf/w2Bsu+7Bip7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648490316, "uuid": "1a7e9171-6a3b-4591-82b1-fa3e05f97bad", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648490316, "uuid": "0ec3d0f5-15d3-40d4-adfe-0397d24eb6ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490316, "uuid": "51ead68e-957b-4658-852c-64461d91944d", "value": "mv ERATO-CTM request ETA 25 feb,2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2094822-ae8e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1648468843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468843, "uuid": "91a196a8-ade6-45b9-bec1-fa7d88939dbc", "comment": "Malware payload (Quakbot)", "value": "09e0175787b5924f271a4bb66ef3e4bf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468843, "uuid": "2ef0b7f9-6b10-45fe-9f0f-9157ac52715d", "comment": "Malware payload (Quakbot)", "value": "80358256a7d226c54c2c7f0be7ba475cd56a5a52f30dd104a385cb114087dfb6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468843, "uuid": "1b51453b-4bf2-43eb-bf71-405b9c533bed", "comment": "Malware payload (Quakbot)", "value": "6f196fae6744714f9644b72e055f3d0e64a9f0e6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468843, "uuid": "c7a96a58-d6fb-4618-8993-4d3a86063546", "comment": "Malware payload (Quakbot)", "value": "b39c9b1bb681e7a816fbc4029f2c67e59652bd20db736b726cc2be234e57d75e0b7e6de09a6e6fc1a34d57d19670ed27", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468843, "uuid": "e0853f7c-ac14-4ec3-8240-a1c7b6c10e03", "value": "T17FA4C0B976043DD6E52E467BDE96ACDC13B61763DAC7D4C980A477C306A3371EE0280A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468843, "uuid": "39e8b2eb-dfec-4f17-ac8c-9197d5aa6f28", "value": "d2e55687d0da61f27b29b4c4cf28df38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468843, "uuid": "e8f138b7-ee09-48fe-8c37-803a59690511", "value": "12288:+0zoiwP349Ps7Wq/p/rzHzLCKiNIyoHho+AlGmSq:+MoTf7/rzfCKiLTlGmSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648468843, "uuid": "1f451f81-8f3b-4bba-81dc-dbc65211c263", "value": 459760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648468843, "uuid": "34bcb52d-c295-42cd-bd52-1dee36fb0e7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468843, "uuid": "50801892-76d0-4b50-af8b-bac457d777c9", "value": "44648,6101579861.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1756d6-ae68-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648452434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452434, "uuid": "2890cb2c-eb88-4197-816f-e6e20e633a76", "comment": "Malware payload (RedLineStealer)", "value": "1efc906a620fa56572e1cb4bf681e58b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452434, "uuid": "7b56a323-bbfc-4c26-94a6-495bb2615642", "comment": "Malware payload (RedLineStealer)", "value": "8067712553e67dbed539a1a61eb65bcfb0afc34b351e99d691581f9d98669017", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452434, "uuid": "d1848b77-c778-49f9-8e76-4f433550a818", "comment": "Malware payload (RedLineStealer)", "value": "cd0f582aca8f6057ba27467095b2a7cf8118d09c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452434, "uuid": "2f18378e-fcae-410b-99a4-905cdd340125", "comment": "Malware payload (RedLineStealer)", "value": "c8a32fa6212208f70dbcc666569ff9a37fbde9bfa9c1afa9366841b5c39f8fc225bc7894449b4c655c1d935d99d798bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452434, "uuid": "4b9e9451-e195-4cd4-965b-ede82844411a", "value": "T1A04512B29790EC02D54D38378BFAA44D1960F4EAB34D8F4F032DD199EA99547FD402AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452434, "uuid": "6a36d7a5-d2e4-4980-b4a7-cf23e0543128", "value": "7555d9d8f7e2bdcb99fb06148be18a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452434, "uuid": "cc8f9b89-b277-402d-a8dd-2ee39c8ee523", "value": "24576:phcGGOZSpskxs2oLvmbzUOopRRBRCCGcWHYYfYscAj+zhBAOfcd:kGQx1rkDWHJlcAj+tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452434, "uuid": "e79c1af0-5376-4998-95fe-0cc004bf3cc2", "value": 1214864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452434, "uuid": "0529ab46-6a0a-4512-aff7-f4bb6d979c43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452434, "uuid": "a09c04aa-1065-4048-b49a-aa4de23df0a8", "value": "1efc906a620fa56572e1cb4bf681e58b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba84df4-aed7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648499998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648499998, "uuid": "f751b026-c1da-4756-8801-c2c0c5744fe4", "comment": "Malware payload (Heodo)", "value": "178bc9ee64cb6625dd59bb92f86a1b88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648499998, "uuid": "8db0a933-64ef-4626-b33d-d44e8261e934", "comment": "Malware payload (Heodo)", "value": "810fb24865c1b7fac7d21866e9c10fce6c2ecc19ec93d0309cbd42ff251aacff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648499998, "uuid": "731ea36f-e947-4012-9e70-409d386fefd6", "comment": "Malware payload (Heodo)", "value": "338ed9e11ca34f85b8d6bd1c85d23c7edd06dfa7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648499998, "uuid": "854c7827-ee6f-47f7-b800-1387b44652a2", "comment": "Malware payload (Heodo)", "value": "76a2fe7a6c26ecf6429a4a264e905565b6248c71701770a7d7578fe8dc49ca2ef29f5130388260f0cdb689257f085510", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648499998, "uuid": "6c2407d9-07b2-4c1a-8d5d-8b2c9f781798", "value": "T122E48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514D7432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648499998, "uuid": "fb43a31a-50dd-4a6d-875a-c6557fc5e91c", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648499998, "uuid": "9b0e9ed0-0ca9-4f2c-a831-fd7030d7d806", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7AvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zaCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648499998, "uuid": "062c7252-37df-495a-93a6-9617386ab42d", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648499998, "uuid": "b6d357b2-fc91-40aa-9280-9f6e2d56b294", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648499998, "uuid": "cd43c683-144a-469d-9f3f-4a29c3889303", "value": "178bc9ee64cb6625dd59bb92f86a1b88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be2518e7-ae88-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648466287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466287, "uuid": "76f30eda-cd21-42d4-9ed6-8f5085c2bfb2", "comment": "Malware payload (Formbook)", "value": "94608f5e437c4e3ace2481dc34b4c2ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466287, "uuid": "094045c5-d69e-4ab0-90a4-6dc8fdd993ea", "comment": "Malware payload (Formbook)", "value": "81626ff8f2f5eb89a55ac197d51ab0d35c33e0607c9fd2a7077ac834a1a5c926", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466287, "uuid": "458b1648-d652-4689-924e-edaeb57760b5", "comment": "Malware payload (Formbook)", "value": "ed53ece522fe5ef3bf45a5d3faaf69e20466a826", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466287, "uuid": "633b5fb2-6031-48c5-a096-447669a8f038", "comment": "Malware payload (Formbook)", "value": "eff8a0731732310910a7e511c66dbbd60f76e486af54778d3f8d0357909c9ee1c1c4c06a064357749eaee370e5bc3c76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466287, "uuid": "2aa0e5f0-30de-47d3-817c-0e18ad41e79e", "value": "T106657B98325071DEC467C972CDA81CECAA607C665F1BC207A053329E9A7DA97CF146F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466287, "uuid": "18b73e8b-71fa-4c2e-87d8-c8915d1262be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466287, "uuid": "690d32f3-7ade-44b2-9bdd-e9a08935446b", "value": "24576:YzJ22jjAAIWO6P5Cz0jDd9F50pqMfKituhEZMtfMx:U22jjdOUDrb0p1GT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648466287, "uuid": "2012041b-7aa3-40cf-b0dc-809662a7f7c0", "value": 1418752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648466287, "uuid": "74b3f405-b9db-4c60-b9af-7d1e87190490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466287, "uuid": "7728eef8-e1a8-4a7b-a321-1c4c7d5b28dc", "value": "Quotation-pdf-scan-copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6319acb7-ae89-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648466563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466563, "uuid": "3a187585-5711-4099-9d67-401532c9c153", "comment": "Malware payload (AveMariaRAT)", "value": "199550f3d86cada714d1fa41416175f1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466563, "uuid": "8ba0c25d-3003-4194-94b6-e447e36b16cb", "comment": "Malware payload (AveMariaRAT)", "value": "81f04137e7a461fc23702729eaa91ca2532df6f9ac33b58e6dd542633b53e59d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466563, "uuid": "4eadbd0f-bf93-46ad-963a-38d99a50c3da", "comment": "Malware payload (AveMariaRAT)", "value": "6a661211016b14e6659deff0aea6446407bd3b69", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466563, "uuid": "2d84468a-be05-45e2-8177-47c8c9eb2b8f", "comment": "Malware payload (AveMariaRAT)", "value": "8f5a99b051258f22834286c5ff73ed0c3de024eaf83669cf57acef2a11155f8e5f03237faaf5cc0c2fca8ec01e3884cc", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466563, "uuid": "7e9079da-60f9-402c-beea-cdb0766fa351", "value": "T12CB4D11B6BC52BA1C4F8767D4364945803F0E1CF1620EB7F2DC152E8DBA77866B22693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466563, "uuid": "c5c7a717-07b3-402b-bd81-be50f30d31b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466563, "uuid": "f4ca2508-c938-4070-ae61-b757208dd498", "value": "6144:V1IJTv+wS23UoiYx8HHQXMWou+3fkPL55qV9gdahar0ThuTTbWDVr:zW+w73Uoib0ouP55qV9yahTThuLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648466563, "uuid": "0c66f426-c251-4c2f-8f19-8fde9fc21651", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648466563, "uuid": "46f5e214-c0ef-4cca-b93d-173b5e7f328f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466563, "uuid": "39412209-5322-4f95-b5db-2c408f99f196", "value": "Purchase order PL0028.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffec39bc-ae68-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648452653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452653, "uuid": "bab2e606-e25e-4d16-98a8-5419ddb71f20", "comment": "Malware payload (Loki)", "value": "46e0c5ef3ad2ac4d1e65a9af951ffee3", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452653, "uuid": "a7466ffb-7296-4083-a2d2-b6743c0e6ee6", "comment": "Malware payload (Loki)", "value": "832e18a3d0807fd2303c9e0d83be0d1e1332d1db45f7801a37dcbf3cdd841fe4", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452653, "uuid": "76064c9a-7347-4d2b-9e32-3a960123a521", "comment": "Malware payload (Loki)", "value": "ad2a1ff1491a0cd69d0e22c6bf94518807eebf47", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452653, "uuid": "c648aa73-33fa-4b6c-b42d-d620b7348310", "comment": "Malware payload (Loki)", "value": "0c41730974b793b87463198d78e18fce5b37650960df2e32d38027fad6c7e3eb552e8319d610c79f1d9f0229ca63dcbf", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452653, "uuid": "caf12574-6d4c-4ca9-9a94-6e77ea4467f8", "value": "T1B714025437E6D8CEEF56DD7A1427E0839B00EF04896ABAC275A0776E04708B09C759FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452653, "uuid": "9df0bf7a-5427-47ef-be2e-552d0669e68e", "value": "3072:/ALfSU+aJ7n9p7p5MFFYkz3rm+urvCCYLZ44Uo3gajYy6duntS1z2/Pu3RH19:47ya1HwcC3rm+RCa4D4jsunwRH19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452653, "uuid": "264c2eff-b91b-4ca5-a145-46a8e9cf48bc", "value": 192216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452653, "uuid": "294debee-bd95-4375-81bc-7f513c1d7cca", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452653, "uuid": "a36fed46-e3d2-40c7-b9d8-279ccc12d3a0", "value": "swift copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6cc6acb-ae5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (DBatLoader)", "timestamp": 1648446544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446544, "uuid": "d4e19637-f894-4da0-8111-1ddd16f42000", "comment": "Malware payload (DBatLoader)", "value": "401876ed44662e54e9508f7dcf26a0d6", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446544, "uuid": "e39365f7-26d0-4d4f-84c3-a495209da683", "comment": "Malware payload (DBatLoader)", "value": "83a1ca1bc7363633b8e514a8c2b79ff0e223fc578b0a20e4e088a3daf5424a61", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446544, "uuid": "1ff05733-9200-4e1c-982a-157882493bb3", "comment": "Malware payload (DBatLoader)", "value": "6bfb986b8358d801b3723511b5ffe3591c7c0b23", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446544, "uuid": "8a59ad96-e959-41c6-812c-cd049a35d5f5", "comment": "Malware payload (DBatLoader)", "value": "99cbca66305f43e0cc7b61c6e658ee6584efb3456ecd386fe842f0a48b44d285b425d5011612bc2976184c89d2ab74a0", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446544, "uuid": "a350920f-c3a6-4c80-81be-3d53d0179aa1", "value": "T1B0259E6EF3D18837C23316788C5B67A59A36BE002A24D8873BF97D8C6F3565138252D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446544, "uuid": "41dae20f-fb35-4b49-8bfb-a898928f17e5", "value": "9dc75159f9856a920bad74849f5be4be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446544, "uuid": "b4d0c294-cfb6-417b-aad3-a3e5dfb34a70", "value": "24576:qWG21PwrPE7r683IX5i+KF1wvysosT4GKH61EPdCLHb:qVo2E7Yoz6SPdCLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648446544, "uuid": "48d7f788-6eff-4191-b173-21d696d59ec0", "value": 1057280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648446544, "uuid": "961ddd14-a82a-4c29-a004-b83c525df633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446544, "uuid": "ebfecd4b-92b9-42d1-8a0b-d4574317eb18", "value": "Waybill.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfaf8fc-aebd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648489021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489021, "uuid": "fe538ef8-1989-4660-b932-29d842bef673", "comment": "Malware payload (Heodo)", "value": "ea3a33651d2e28e64795c810d430c7ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489021, "uuid": "89e9e3d4-e75c-4588-b9b6-8c7da429c40b", "comment": "Malware payload (Heodo)", "value": "85eecf546157b8fbdf22980bf085f173003d8015f3dd78decd18bb1f0003c2b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489021, "uuid": "c74f0345-d31f-4763-93ee-4f5be26d42a6", "comment": "Malware payload (Heodo)", "value": "41779fcbd364e5c93a1f69aeb8af0ad560c39cbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489021, "uuid": "91da3206-8e0d-442d-abc9-f8868fbbc975", "comment": "Malware payload (Heodo)", "value": "aa069d6d9f46eada23d8396a7871947c3987f7d1bffe0ca0cbc41a4458d214374c69169a5dafdb89b0ea1070df270b9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489021, "uuid": "9eb69f76-ba6e-42a8-a942-d13c5ab5d3a4", "value": "T1C3E48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514DB432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489021, "uuid": "8f05c65c-c462-4237-83c3-3cd4d4ee31a5", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489021, "uuid": "54354618-2a8d-47c2-b860-422928c44781", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7BvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5z/CMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648489021, "uuid": "e6f3d772-1c68-44de-bdc6-04a0903afdbd", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648489021, "uuid": "f582c239-e42d-4e18-a4c7-288ee9ba9565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489021, "uuid": "5203007e-744f-4957-968f-1a941a0a8cf6", "value": "ea3a33651d2e28e64795c810d430c7ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02b8107-ae68-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648452600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452600, "uuid": "d9c52fad-c836-4381-90cf-188178e66289", "comment": "Malware payload (AgentTesla)", "value": "b2746234dcc5005b4df95f3023a07e84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452600, "uuid": "94216176-399e-4047-b454-4ee8db995381", "comment": "Malware payload (AgentTesla)", "value": "866b26f2e2b3a92a5b345aeff17a023f84db3c789b40407ddff13e911777bf16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452600, "uuid": "76a9dc1c-1f07-48e9-8e3a-18bf372b13b3", "comment": "Malware payload (AgentTesla)", "value": "7082cda5ba450b3db0049d087542de07c3107bf5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452600, "uuid": "5c8f8755-847c-4065-85cc-f9167a565e07", "comment": "Malware payload (AgentTesla)", "value": "c1b1e4bfea69320db3063344e3b9e939c9ece251beee0ee5e94ea32d4d6bd951cbc084c9ab2cb4be70de33e346569fc8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452600, "uuid": "aed9d2ce-f6ee-462e-8198-de931ef694dc", "value": "T1271402CC7BD3B8A8FA1F893846655636E958AE0DCE4A9B9B5C00FD508C33DD14250F6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452600, "uuid": "ddbcd197-1a8c-4736-b8e2-77ab75592741", "value": "3072:RPNZctrmTT+tJrylNnY6xQF+zi66fVmRj3qfLKNPJA+kDUvQmq5CAwyjPQ3fSip:xqrm+tJryl5YI9i6wkdNhMDUvQlUA9Pi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452600, "uuid": "17bb36f6-712a-443b-ba67-a3d683475e92", "value": 192248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452600, "uuid": "f3008134-76c9-42aa-91ad-b370cb71e223", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452600, "uuid": "6bc13fc5-5339-4ac5-83a6-362eb6438fa1", "value": "RFQ_PO_CATALOG_B_DESIGN_28032022219000000000.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e30b58-aebd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648489008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489008, "uuid": "9dfa5d9d-65e6-4e74-a6ce-a010934a235c", "comment": "Malware payload (Mirai)", "value": "5bd086e1f5e7fe5d2ca4c78f535d91b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489008, "uuid": "12d23af7-7ff1-43b3-a39e-8faa583e4ad7", "comment": "Malware payload (Mirai)", "value": "866b915ebaee257e0eadc8750c788a006a90ed7a155920cb7b04d76f414e66c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489008, "uuid": "a923408d-3fe8-44c2-8ebd-e16d9c07c3da", "comment": "Malware payload (Mirai)", "value": "d5b33d52e3df5f0b64dec65a17ce0418eaa04247", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489008, "uuid": "ee6c4fb6-906d-48b5-9a4a-4f5ae5a24ac9", "comment": "Malware payload (Mirai)", "value": "819cb2e1b363bbd79c5eda0f4e722ca6f87d345f209b1dbfccf58443ea2b5361d2d1081a519426d4b3a6ee37782d523b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489008, "uuid": "9644a60b-ec03-491c-b25b-fcaebbc038ec", "value": "T1234338C6F801AD7EFC5AF37A94120A0DB621722451930B736377FD93BD321A46E16E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489008, "uuid": "78282627-8d80-46ff-b258-ede04d46b798", "value": "768:g7FP/2AnmvqbXdDfj92+BIk7WnCFdrnsFF4igaOuDMBhxUGI88ZYwwH8Hn:M2Q97r73Fdru8anDMtUGzaYw+8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648489008, "uuid": "50e95ee1-7ae6-4260-a54c-276e9ce912ef", "value": 57528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648489008, "uuid": "980f9865-082c-4cab-9fe7-364ce2829c3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489008, "uuid": "3923f659-3796-4140-9dc6-fe42296924fa", "value": "5bd086e1f5e7fe5d2ca4c78f535d91b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6521557b-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448098, "uuid": "371b270e-4ae6-4083-8ad0-ee5bd8f1a17e", "comment": "Malware payload (Stop)", "value": "08b34785ebdb326dbde2ec8663906153", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448098, "uuid": "4efbf4cd-0872-4627-91e5-5b22c86ac05d", "comment": "Malware payload (Stop)", "value": "8674c9ccf72e58a699642780869eafb33e39f150a8e4cb59c8d9d2e16986e0f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448098, "uuid": "23660975-9bc7-4fda-91aa-6a6b976a21bb", "comment": "Malware payload (Stop)", "value": "237be6b9a1b7e29dbc595bdd8eea9a67f39ae419", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448098, "uuid": "76b964c6-3eda-479f-b562-e284350939ba", "comment": "Malware payload (Stop)", "value": "629861f4b46547df8a86e607dc3f7080f68ac5786e02b38a4984ae904e3afc30f7150c4eecffec86e7fb69bb3ee14297", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448098, "uuid": "d8fed88f-1be8-414d-8e46-3aaf9d78f840", "value": "T168F42250F742D631E062A63FB05E0263627CDD319AD01847BAA8B4271F623E57BA735B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448098, "uuid": "99ac9e27-2ca6-4fcf-829d-1b4b52529e91", "value": "98af1336ee9a8378f1e2c2d0d9027760", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448098, "uuid": "5056dc8f-e6f9-4245-99c0-584365a3be8b", "value": "12288:5gS6/qWNMKzTJmoq3zygHPB1bVCCQv0MhjZ8OPYHAZsMt0LznbX2M6k:5gS6VCDzzHPB1BzMPSUntgznz2+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448098, "uuid": "0787c875-feed-42b1-a5c9-7be6f4943be7", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448098, "uuid": "8e1c8869-7ba6-41d3-b1a2-ef6e2efa8031", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448098, "uuid": "766b196b-ff72-488f-ad82-9a7e1c1659f3", "value": "8674c9ccf72e58a699642780869eafb33e39f150a8e4cb59c8d9d2e16986e0f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f96d6c-ae65-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648451244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648451244, "uuid": "aa81676f-6fcb-42a1-9f12-d0b854fcb5a3", "comment": "Malware payload (Heodo)", "value": "e5c359c5536f139180ad2e168ac74371", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648451244, "uuid": "3dd92239-7af9-48c2-a65c-1431b9191975", "comment": "Malware payload (Heodo)", "value": "867a2c059fa089baedf5c2cb65cda586395248e62b6478687d928404852892f3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648451244, "uuid": "d98a3859-8247-4955-8c36-7eeec42ecdff", "comment": "Malware payload (Heodo)", "value": "83d9b78380b0df1a4016b5ff992d6a58bcd7f2e6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648451244, "uuid": "cc19b466-39d4-45bc-a97f-06201f128446", "comment": "Malware payload (Heodo)", "value": "f4cb03f0c414c173fdb2e4e3fd076627501d3a05241f48058a80c69a384c2f45fe76955e1d07e32b55cfa8aceb8c8305", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648451244, "uuid": "29112aeb-2642-407c-81ab-70ba09689281", "value": "T1DFE49E1177D0C072C2BF3630551AA3B566EABC708DB9860B6FD42A7E2E745829D3871F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648451244, "uuid": "df5a21c4-2f86-4253-b188-cadccf67f270", "value": "923a5ec702466ffd61b422bacc94c6f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648451244, "uuid": "d2e73fba-44a7-4ffa-ac8c-b1cb28965be0", "value": "12288:JSycC8Tu2EEAeClIHRFa7UdUzrAKytI8X0oXYl2N17OP:JSDD7RDhH3dUfGtj0oXYl+OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648451244, "uuid": "f6a73673-f8d2-4022-bb2e-1d2f7592aa9a", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648451244, "uuid": "6e092b0e-78c3-4965-b73e-e12f6970bf8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648451244, "uuid": "db1014d6-a52a-4b83-b560-d550026264b5", "value": "hViJyWLwQTzPPf6dUPDwj5Hp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca067c3-ae9a-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648473747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473747, "uuid": "fd350f96-8c43-4851-b86e-34e635f23259", "comment": "Malware payload (NanoCore)", "value": "f7e56c64c8141e2b7b9d02c4a6971c59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473747, "uuid": "6250f4fd-e19e-4788-96b1-fe6b4f81ede3", "comment": "Malware payload (NanoCore)", "value": "879ff8af101103d2387bbef6143dc2b4e233c7436d19e116c5fd78e132cfd05d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473747, "uuid": "116a6736-a224-43e0-9bd6-2b2dba5123d1", "comment": "Malware payload (NanoCore)", "value": "04d8a40c7fb0c06d9bcac5e842012cebb63915cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473747, "uuid": "e51ca69e-9b97-4a2a-a9bb-9c884d6222ad", "comment": "Malware payload (NanoCore)", "value": "99aaf9d1c5dac2cdece71ae9f58c0ad5b600c01f3580cf1eb6ea87518f6a5682f4e120964f9d42b3c60be0d6e177c53a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473747, "uuid": "b935c71d-7cd2-4abc-853e-2812c943dfa2", "value": "T1F8042002657CA8C3F69C6C73A8DC975E1EE06C6C4676106DF247B6E9E53F103E6212E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473747, "uuid": "f336707d-1104-416c-b861-dba03b440dda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473747, "uuid": "6e3f8f9e-5841-4b32-a0ec-f29b0b4f8812", "value": "384:P8m4b84z+uQM4ZjMoSSjYlR/1hFVeGJdNETT4k4g6tGocA04sQm6eS2KWVAkaneS:PSb841b/1/Ve9afe3ElGVBB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648473747, "uuid": "f92bf0ea-a50b-4be0-9ead-9f983fe27889", "value": 174592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648473747, "uuid": "fbced0a0-e34f-409e-964d-8a600d3788a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473747, "uuid": "4f944ee1-90a4-4122-aac2-c59d6f7f2233", "value": "PURCHASE ORDER NO. DFT-000184.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4d62e1-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448137, "uuid": "21e4a3b3-c6f6-458b-a61c-841d2214ce7e", "comment": "Malware payload (Stop)", "value": "a914fd60a4f067201de3e2efa19ed621", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448137, "uuid": "6a0c838a-3b22-4c5b-935b-0d00a606017f", "comment": "Malware payload (Stop)", "value": "88255867cebe9b14735d4c76285954c9603caf4049de9c55030d913cdacd67f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448137, "uuid": "6c034d35-d05c-44c4-a548-ab65d89263c4", "comment": "Malware payload (Stop)", "value": "4b1d761e4ab4ff4965b16f1532efad2a20d745ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448137, "uuid": "bbad3787-bc22-4f71-a689-7641a2af1fb3", "comment": "Malware payload (Stop)", "value": "1b545c77198b3b2bdbdbfebbaf38ed072c87fb603fa7a4039c06db7fa6db2bd8d7c9b0fdaa9cea78fa084e0b7f998b76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448137, "uuid": "16103cb8-e924-4527-b872-b792420d2b66", "value": "T127F40201BB50D439E1B312F4593A93B9692E79B19B7590CB62E52BDE1235BE0EC3031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448137, "uuid": "d50d877d-c57e-4459-8cad-da29d5c3c521", "value": "3944abc45db6fde5aef61e579409b3ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448137, "uuid": "68f1626c-c331-4b44-baf9-6b43c4dbcdeb", "value": "12288:NyV2mtIveB2UgZ5rth9+mmLUr+kpVQkuJEbW6WC5WBXSvjv46gPYX6OJ7JJghlAh:EV9tT2H9f3LikEboWfvtAXglAZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448137, "uuid": "60f757c5-3e57-4d9b-97b6-4b0c8cc80231", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448137, "uuid": "438f757e-b5e4-4801-8c9b-d4af2708feb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448137, "uuid": "56e256b3-887c-4bc3-93d6-1da1047e9e3e", "value": "88255867cebe9b14735d4c76285954c9603caf4049de9c55030d913cdacd67f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5545b0bc-ae7a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648460098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460098, "uuid": "0c90f4c1-2c6a-47f0-9cdc-ef3def8c8a66", "comment": "Malware payload (AgentTesla)", "value": "37cf96d69f40084959e2ab544501f6e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460098, "uuid": "9ee1c91a-14be-48e4-833e-42ed1d79e9e1", "comment": "Malware payload (AgentTesla)", "value": "8861ea0d403ff819359dfbad372af21fe86e3728dc4a607e7f34ddde92cb3e80", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460098, "uuid": "aabf8ccb-5b7d-4836-9081-776391b61687", "comment": "Malware payload (AgentTesla)", "value": "76d57da1cde078b28bae5c3f84bfdcd22dde5695", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460098, "uuid": "d47f9992-35dd-4de0-9aff-3260a713fc54", "comment": "Malware payload (AgentTesla)", "value": "53b2aedf4a49c48b82c7a09c8ef4b98cc926ca480469a703580c532f4d3dbc1d756d0a98a69bd135239c5bf97701c0cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460098, "uuid": "158a24ba-04c9-472f-863b-54102fec3b32", "value": "T1E81529ADF1F075EFC82BC17299685C68BA507CA7931B4113906731AE993C893CF257B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460098, "uuid": "c1798f78-6322-4816-804c-d5dfeaa38008", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460098, "uuid": "754812a9-90d2-4183-a6b4-0f7a309478b4", "value": "12288:zQXtKMYrvG6xr2u113ibbFVEI2uQxJuYSdoslcx/eUIvg+pnB/Ky3Y2vrsETlx2e:zQXtK/ruA9ivF+Ipb1CbLIusQUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648460098, "uuid": "820bfe75-2cd7-4bf5-a4bb-706e99b3d38d", "value": 906752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648460098, "uuid": "1882c82b-4d5b-4fda-989e-1e27172713d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460098, "uuid": "2ca60661-43b8-46f2-a556-f990b90bd7ac", "value": "Purchase Order Number 0062101239.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203a4558-ae52-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648442829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648442829, "uuid": "ab16f186-7e8e-4b6c-bc77-c4ba3a7bdd57", "comment": "Malware payload", "value": "b7d474f11e6f538efdd89cf066965917", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648442829, "uuid": "e53ad9b9-0f55-4f36-af2e-d595b1bfa70a", "comment": "Malware payload", "value": "88bd8ce470eeddba5cdeabe2b4e326267b3e31df65458140a3e091ddb56d3cfa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648442829, "uuid": "19daae59-880c-41a0-b82f-6c53d7123c70", "comment": "Malware payload", "value": "50d65e4c8253c338a2e88c82e6c2e47b09d966ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648442829, "uuid": "c64cfb55-31e6-42c8-beda-8ceca00f5714", "comment": "Malware payload", "value": "3d502b21a7480e07610143de30b5b700cc8e239e5424b5257034b3825261fbfe363ce246eba0a067318dab988573040e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648442829, "uuid": "0e55a06f-92cc-4bf3-9289-2c66e6abfe0a", "value": "T1D213E14FBA912D91CACF4D3B5DBD023856D1A6E4F21313CCD2E49E3ADB2A687560D06C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648442829, "uuid": "ed99c178-93fd-4a41-9933-e90520406895", "value": "768:XBshRRrx1ceb0vDPgDRFfu4bK226sER1zQOjb6p7LxWbWRrd50F8LX:XGFrx1cfjgDvuB2dsER10Ojb65LxWcDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648442829, "uuid": "9bfa67d6-43a6-4da1-a26c-c80b59e3b30b", "value": 42488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648442829, "uuid": "13cd728c-ebc6-411c-9a46-0071e4165bdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648442829, "uuid": "4ecdf4d4-00d4-4a35-b719-2f0801d74f43", "value": "b7d474f11e6f538efdd89cf066965917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c763aa37-ae93-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648471027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471027, "uuid": "3b63eb09-15fa-4065-95dd-a7349573bccf", "comment": "Malware payload (SilentBuilder)", "value": "e1e509857f6068917b8d0273a9844c71", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471027, "uuid": "2ac6f755-f653-4d02-b5d5-917397ebcb61", "comment": "Malware payload (SilentBuilder)", "value": "8939f3d3031c80d90cb14d8271fc8e943290c89e844d2375ab5e1d716307b7e4", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471027, "uuid": "e7cf26a9-857d-4ae6-8388-ecbae342b99f", "comment": "Malware payload (SilentBuilder)", "value": "b87a0564ed2847bc7e453c3ec40f3efbad38938d", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471027, "uuid": "952bb8fb-e040-4e80-aa01-ad9040f73c98", "comment": "Malware payload (SilentBuilder)", "value": "d4672241a3e126da878f9059f3facf5e05a2ee2b0aedf33b1e310ff1772f876b0e11751f53036e686bc905f78b90e998", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471027, "uuid": "f591a019-c968-44e4-aaf1-7b2cde319879", "value": "T18C43E95BBA49985DEA14877548E743997323FC304F6B074B3269F3257FF89A05A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471027, "uuid": "011c18bf-7bdb-4f71-9582-61f4fda9fad9", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umv/:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648471027, "uuid": "f347e49f-96e7-4fdc-aa7d-aa09848754f9", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648471027, "uuid": "f68c79e3-d2c0-4a70-add6-a0fbefc52113", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471027, "uuid": "2c88606b-1424-48a2-84c7-683b33d035a2", "value": "52171709971431148603.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938d7884-aeb1-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648483824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483824, "uuid": "699f0171-9450-4135-bbb6-230531233491", "comment": "Malware payload (SilentBuilder)", "value": "70d4a6fbaea293dcf2dda124f784131f", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483824, "uuid": "a5cd7288-a843-46a3-acfe-cf94bcf40a64", "comment": "Malware payload (SilentBuilder)", "value": "896b498361e9fbdae647e584d549c55e137292cc6acac366227a2a9b5f490dd1", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483824, "uuid": "eb339bb1-ad2d-48a5-a294-aca88e4f17c2", "comment": "Malware payload (SilentBuilder)", "value": "0c68f10ff9bad559ad6305fe645d8bb77d89c119", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483824, "uuid": "2c2c0e18-77b0-47c3-b2b1-0965806799b5", "comment": "Malware payload (SilentBuilder)", "value": "003cf18dbacbf1be1810e0f4c0e5bfdbbe09df8dd9c6b1ee518bb61ea080dedb73e8ecbdf25a27a68c92b1657ede8479", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483824, "uuid": "d5808978-ef77-4ee7-85a3-f539e165a3be", "value": "T16344D04272559439E8EE973414CB4A91923BFC20EB5A5B4B131233FA3F796B05E133AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483824, "uuid": "ef62ebae-2a41-4cae-8577-85fddfb1108d", "value": "6144:6Kpb8rGYrMPe3q7Q0XV5xtuE8vG8UM+sEpBLgoN8uJCLpgV2ZV2VUSpbLjtdy:FpBLgAgtgV2ZQ2ALjtdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648483824, "uuid": "87207974-ce9f-4f0c-89a2-a464ecb32039", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648483824, "uuid": "8d516c59-d66c-4600-9476-b74e2927077e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483824, "uuid": "d11697ab-7bbd-420f-be39-b85d240c416e", "value": "imuleoomurdqd.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c8e335-aec0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648490437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490437, "uuid": "16820ffd-98ec-4937-88f8-b794d31f5db1", "comment": "Malware payload (Formbook)", "value": "4620289210c262d1157a8d25c01767c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490437, "uuid": "49cfdfab-3269-4975-9189-b4f6d9626e0c", "comment": "Malware payload (Formbook)", "value": "8b5d88e926a81c4f325610d0d559f7d4bafe0b751bd5deabf2ba6e4a4c604e42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490437, "uuid": "7cf6e8f8-26dc-4fee-9d56-c8018f478e6f", "comment": "Malware payload (Formbook)", "value": "307ad97c77be7cc6a7dac36f6e01f1770fd3a52a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490437, "uuid": "03339f4c-c143-4b2b-8057-30fc5fbd1184", "comment": "Malware payload (Formbook)", "value": "58979d2ffa3e5574e1baa5b52a50e3dfd1f020f3a695e88c7628310341ec2117d25ed4e2870694b19f0b551d9fb523b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490437, "uuid": "7d65ca35-6d0c-4bac-b1ef-232b0ae4f1cd", "value": "T1A7642303BDD4E976C7A2C97005A1B7ACEB7A9EA51557E806A7E41FC32D328135C881F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490437, "uuid": "ba794576-1dbc-4d68-be45-82949dd94f0b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490437, "uuid": "63ac1a14-0613-4590-8993-006fc155ddeb", "value": "6144:rGiuOh0BTV3ezAEDXW8quRUQ+qClvujgQOFvbSTDY8qnBI/FHRy+:ivROAEDXvd+q6v6gpwDd/ny+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648490437, "uuid": "33bb829e-ead3-401e-9633-1fe3adc79730", "value": 310282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648490437, "uuid": "a44ecb9a-d6f8-4326-b29b-08c5b6dd6f68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490437, "uuid": "300c345b-ed3c-4994-85f6-957173c6d6a0", "value": "inv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff4aa1e5-ae5d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648447927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447927, "uuid": "aa669679-4e11-4c71-ba43-b771862bf28d", "comment": "Malware payload (Stop)", "value": "dbcd67a4b06b68b47a680644222eac72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447927, "uuid": "d3624076-7e46-4447-b1dc-75af33f22406", "comment": "Malware payload (Stop)", "value": "8bacf2edda6b201539cda649b9a1668374a5bbeb9bfec05ed250c83cef65b6f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447927, "uuid": "0c13e1d3-c0b1-490e-a25d-e37195297932", "comment": "Malware payload (Stop)", "value": "068131cc113702eeb585e51339fe41b11ba7c438", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447927, "uuid": "f4f96e5a-e99f-4644-8ade-4fe9c6781901", "comment": "Malware payload (Stop)", "value": "1a47d8f7876455975c8a603b444cb172d3f560b4254fea497a2e4bc47077ad1f38d82a0407243b27c8188ce2eb909cfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447927, "uuid": "9750afdc-8db0-4e79-a3b7-9434edb8cefe", "value": "T1B1F423202A618476C1524531B95AEB721A3E3C3115E9FF03F3986B691E193D2BF7F70A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447927, "uuid": "bef9b90a-ca90-4c70-9e7c-037f243c3887", "value": "3a09809e2f82aed7962ea0c7c3c640d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447927, "uuid": "d63caa82-4ff7-4824-85a4-0847d5fa0829", "value": "24576:Pk7VYwxf1m9qs7gxtcls/94Vw8IbUX+fLO0a8A9:MBYif1m9qs7Mq2l4C8IbUOTO0a8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447927, "uuid": "b651ff7c-eb5b-450f-a210-3dd560679904", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447927, "uuid": "31688dcb-93e4-4b93-b28f-2368baae1769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447927, "uuid": "2e919a23-f014-4100-ab5b-575f166b2b6c", "value": "8bacf2edda6b201539cda649b9a1668374a5bbeb9bfec05ed250c83cef65b6f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd2d94cf-ae70-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648456004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456004, "uuid": "5d0d0a59-963f-466f-8dd1-e02842271894", "comment": "Malware payload (AgentTesla)", "value": "b7438fc9f9226768426ecce49e5d236f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456004, "uuid": "30980963-0b18-4de8-99e1-3d7f003c23ab", "comment": "Malware payload (AgentTesla)", "value": "8bd6311eeeff3245297d2788deaf9c12976e9e70c81a352fae56731a8082206b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456004, "uuid": "26dc40f3-973a-4959-b6ca-5265771c6741", "comment": "Malware payload (AgentTesla)", "value": "2c717c138ed6c61062efac0cffa56d7b86044860", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456004, "uuid": "d518e461-fa09-4173-a935-f16332d83d9b", "comment": "Malware payload (AgentTesla)", "value": "f130f9ed7f595f86d71a108b68d73a3f6417c1d457547f75af554dc5546349297c7ef5abd960f69d8aef22f3c4c61787", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456004, "uuid": "1a7ecec4-2e5d-4778-a71a-d6b07e8bc6cd", "value": "T17C942384364372230FAA2D9E0BC5DB83AE67DF485173D2B7F8B8A8193D52E5D3B95404", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456004, "uuid": "04ed4277-6505-4fe3-8477-7f38382a5db7", "value": "12288:HEwukXEitp77oGDpglwf9zmRpv2DRVIY361:bHXEc70GdZ9zmbv2DjIw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648456004, "uuid": "8cd8afd0-0e27-45ae-9f14-cfd8b764ebf6", "value": 426222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648456004, "uuid": "dcf1dbe7-c62c-452a-887b-270d95877cff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456004, "uuid": "7a6350aa-895c-46bc-a040-ccc7d6951e91", "value": "COMPANY PROFILE AND PRODUCTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67373db1-ae98-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1648473013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473013, "uuid": "e9d98c76-1c1e-4204-aea6-f69af9f518a0", "comment": "Malware payload (Gozi)", "value": "5e0f7503be40d6b05fed29ea64785070", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473013, "uuid": "cf1e14fe-a8a5-4e75-ade5-bfcd653251fe", "comment": "Malware payload (Gozi)", "value": "8c271d173b369ad12c8cde19272aea7bbb57f451187a9424704f98bb3f846390", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473013, "uuid": "2ab8db6b-ffbf-4641-abbd-584499e507f1", "comment": "Malware payload (Gozi)", "value": "52f267583f915dd2ef80ee6f71419d4016bc1fc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473013, "uuid": "29f55202-541c-469b-a0d5-b40e516fb9b6", "comment": "Malware payload (Gozi)", "value": "ddaf5365b5222b5b63729ec0d1d5356cc5b325378c573553621ee784157724e65d85b9b0c83d713963c15e6e7b57b140", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473013, "uuid": "cd8c3458-ae4e-433a-89dc-f0e6d32fd7ba", "value": "T1FAA47C97F3B940B9C0AFC675CA52961BEBB1784A1234E34B42E0CBB61F13B71661E315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473013, "uuid": "0b2c020c-6fb3-4868-ad5a-cc78e6363c60", "value": "12288:mLs5pGwFbmeTVmgmk76o3UP7TkMILR0V7nFGI:mQ5Ew5meTzmMUPfkUpnFGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648473013, "uuid": "c3cbbf8f-2072-4a99-9cb9-23ea36d84ea5", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648473013, "uuid": "15f59225-b1d9-4040-a6c2-728d135bf689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473013, "uuid": "dc7d2420-ca95-40ef-99fa-1e35b8f64cc5", "value": "11ec0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565817a8-aed9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648500902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500902, "uuid": "7d1307d9-dfe9-44ca-a0f0-90e6629eb10f", "comment": "Malware payload (Heodo)", "value": "a2c5a653057e561d32e3ef3ce6e7432c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500902, "uuid": "661af95a-00df-490d-a9fd-8f4666ae0e0b", "comment": "Malware payload (Heodo)", "value": "8c32742b021be53a45ea563b5db8a1259c30d935ef0e78948cba22eb50d7b40e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500902, "uuid": "243d54a0-1cba-42ae-aa2c-ada382e2595c", "comment": "Malware payload (Heodo)", "value": "cd7c912d6200f5564bf84e3cafd36e6ce34b2d35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500902, "uuid": "a1d4b9c3-3196-4f77-b75b-d4f178fb34e6", "comment": "Malware payload (Heodo)", "value": "74b84c8033666349c6be75ab8e30a2246db91032c871dab52c5f1a7f08e79d16dc336087e17646add0049267a8333139", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500902, "uuid": "693ff367-b453-45f6-b073-6e51f6f0e329", "value": "T116E48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514D7432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500902, "uuid": "ab02e532-ce6d-4876-b823-6f96c6a4ca36", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500902, "uuid": "115a64a2-92a8-438d-81ea-99b99c42f9ca", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7pvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zzCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648500902, "uuid": "d57d9fad-30e4-40c7-824b-39c91ee0dbb8", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648500902, "uuid": "16b72543-2b99-481a-9846-8880c4fdfca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500902, "uuid": "ddb0d81a-bb5d-4660-924f-933e4f8ac2ef", "value": "a2c5a653057e561d32e3ef3ce6e7432c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896f3aa5-ae6f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648455461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455461, "uuid": "d7f73b75-cb83-4270-9eb2-3efb37177d0d", "comment": "Malware payload", "value": "3e450c1afe629ac10ae2d25cbc1e4f96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455461, "uuid": "35a8f0b1-7ec3-44ca-9fe9-07970f024051", "comment": "Malware payload", "value": "8daa18852c288df1cb1d1f88c8107643d971d716d6f80d757072e5b9297b32f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455461, "uuid": "e583dea4-dfec-4fc8-b2e4-7daf5b20e361", "comment": "Malware payload", "value": "fd32e0a45a06fb6f6e1e172b07dd5f2c743e9f29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455461, "uuid": "5138a93b-2a61-4268-aba8-21a751737f95", "comment": "Malware payload", "value": "1e4bc434d8f1db195ab14a28b25057dbfb788ae91c06d1d6f21a0f74890f08429be6f5593856251e368c2313398a440f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455461, "uuid": "3db30de7-a16a-4309-95ba-24d8aaec751e", "value": "T1405633257A396850C8B866FEA50773D0C03A17DD63C1F5DC3E8818EAC6A32E56D1E7C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455461, "uuid": "74637eec-983e-400f-aa88-836b4ff1b2a5", "value": "07f6da3e6fc4e2060cd319831f8c479f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455461, "uuid": "264a56ed-53e8-4783-99d6-7dcbc0e5c7ae", "value": "196608:5Nn0h+sp0v0k5bp62RwanCxjU5x+baJhgK70R:X0h+sypbM2RwanCx45Y+H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648455461, "uuid": "9db3cbd2-7c1d-4a07-b4a6-8e35ae1becff", "value": 6378177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648455461, "uuid": "78b7f93b-19fe-4a50-b5b3-ca2a0a3b5dc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455461, "uuid": "1d07d489-8a90-4d9b-a190-d54cd6c90914", "value": "3e450c1afe629ac10ae2d25cbc1e4f96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f61839-aebe-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648489566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489566, "uuid": "3031fb86-e3cc-49f1-8cc1-039e6cce60d4", "comment": "Malware payload (Heodo)", "value": "f28a4344851853f38005d681a83c964c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489566, "uuid": "8d91a1f8-de0b-407e-8bd6-34cc086fa6c6", "comment": "Malware payload (Heodo)", "value": "8dd59361d8c0e18f324238a915564eaeb325f2277a1cf228f905f0324d7372f2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489566, "uuid": "dcd01056-fb99-4725-958e-0f2efe5d1640", "comment": "Malware payload (Heodo)", "value": "d9036d3b433da603b33c81b193a8ba48588bdc54", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489566, "uuid": "5aff904f-f1b3-4ac5-9dea-2e12c078bbd5", "comment": "Malware payload (Heodo)", "value": "000ecb418fc23b5cfaafebe244dfc69a4ee0f82a806a29e661fd2030a8553ce4097b8f86ad257580a5c999beab228f66", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489566, "uuid": "19912e1f-f5d4-4381-aec9-d36e5516860f", "value": "T143E48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514DB432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489566, "uuid": "6c1c1cb8-0b0e-4b4f-9680-4211a8985f35", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489566, "uuid": "0784bb99-c722-4442-8587-402f78c3312e", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7QvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zuCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648489566, "uuid": "51a96faa-beeb-4d66-9b2c-c950d523b259", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648489566, "uuid": "2e70f994-e7c9-410c-8198-cbde2751ba68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489566, "uuid": "a2658e36-5121-4ee7-b2af-81f2ce538ded", "value": "ccRIPP8rXlNtvctuCQUh.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d4d0b0-aec2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648490933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490933, "uuid": "e21b1cd5-ba9a-4194-a7a3-bf45a48cc292", "comment": "Malware payload", "value": "00a05c8f1c323fbf4b3a8137757d5906", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490933, "uuid": "80fcc862-b0c6-4930-971c-2bafe560e4f5", "comment": "Malware payload", "value": "8e9c54cadf84d45560f4a23d3cefc2c4f084353b3f2a95cfa76f0124af930326", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490933, "uuid": "5afa6dc0-b481-4699-8b21-4d59a2c22141", "comment": "Malware payload", "value": "5eecbace5bc823761558f107627ae3eb284e54ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490933, "uuid": "76343a01-c43d-4bcf-8e1d-ccd24495b3d9", "comment": "Malware payload", "value": "fe6826572dc9e8ccf0a9f6457e201f2bd1a4b0624fefbfa418b6bd40fa9b2b623c6708eb9e12fad866384be9e0176d08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490933, "uuid": "ff1c8b04-7732-4505-95c9-4b58b2982f68", "value": "T1E1A46FBC7A614A72FD1DD1B0A5518AC4BB670B0372809A8717FB26C8874F4F76E45CCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490933, "uuid": "c93e4767-4d0c-4b9b-98b9-e4def3777570", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490933, "uuid": "0258ec73-748f-45fb-b6c4-92ace577a703", "value": "6144:PjPSqOdRUA9AFDX9C+RC5+vycUqhU91ITtKJFR/LWlNbnxEW6l:PjPSqOd/sL8+nqcUq+nBsxEWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648490933, "uuid": "a3ce2c7a-3255-443f-a01d-2f24e29923e9", "value": 483840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648490933, "uuid": "9e71b8fb-d683-4130-aef0-fd251dc8361c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490933, "uuid": "e00c069f-067b-49a4-b8dd-ab446b394048", "value": "MV SETY V 93L CTM Request Form.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b08d51c7-aeb4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648485162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648485162, "uuid": "670743e9-cd3c-4887-bf78-e673ee488c02", "comment": "Malware payload (AgentTesla)", "value": "3427dcdfcb61d7712b11253266047041", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648485162, "uuid": "290127ed-e0a1-4fd8-b98f-cd650b97a496", "comment": "Malware payload (AgentTesla)", "value": "8f1cf99520951221adafe095f8f507e7711b404bc5fec11a065b909edbe67c46", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648485162, "uuid": "66622421-53c0-4588-b808-647011c41e4b", "comment": "Malware payload (AgentTesla)", "value": "42c200406cbe5add36f1c09c79024cde59da0500", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648485162, "uuid": "dd2d7bed-5b33-43ee-8a25-720c7a63edca", "comment": "Malware payload (AgentTesla)", "value": "43bbde8908d9bf74ac6f2f86530c0b89144c7d84808351f85843825cf821ee2dff1760e1037927a5b9bd34a4d0a6b2be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648485162, "uuid": "27684a31-4373-40ea-b574-deb73ad3d656", "value": "T1015422116BC15673DAA68A3062F1EBF483FEC3C822E71E170BE4BE157C59052EA0B955", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648485162, "uuid": "a679f7c7-2014-4bd9-ac7e-8051bfbed17e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648485162, "uuid": "b75ce3c8-f63a-41f3-b24f-c1f935148877", "value": "6144:rGixPnoYnarDdTa/FopAFwq6059bQxyH4ySTAshqZ2th7kGyvu:za1Ta/EAFwE9bQatS/mG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648485162, "uuid": "ee3bbe49-bce5-4add-9d57-abdb95aedb3c", "value": 292981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648485162, "uuid": "1c36104d-c034-4522-baec-301d2114145a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648485162, "uuid": "c42cf75f-6c57-4dc7-baaf-3a67d770be1e", "value": "Bid Invitation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45deac57-ae31-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648428719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428719, "uuid": "fe1a9855-aa1c-4bd4-9740-0d38a363f29e", "comment": "Malware payload (Heodo)", "value": "d96b8f58e46d7ee5a5a7d6de28fd49c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428719, "uuid": "c3dea8ae-cbdf-4a4c-a7b7-3ee5ed4bdea0", "comment": "Malware payload (Heodo)", "value": "8f3244a5320d2f1473e801b3aff0b2942f22cb65c6ba5820cf324a7eadbc0fa5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428719, "uuid": "de33e754-f22c-48e5-b6d4-8ee24f559d59", "comment": "Malware payload (Heodo)", "value": "c0e8378c6137216a3e19580ae3885a6d70b1de7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428719, "uuid": "e3071193-7645-4622-b21a-c4e68a19f64b", "comment": "Malware payload (Heodo)", "value": "8a5fc95500a77db6c290853695fb28cb127dfdbb69a31d1855e84821c2b101aa9bc294dcd2cbadbcae63e0955c705407", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428719, "uuid": "efe9c2cc-8bb3-430c-9648-6f7cc65c5c74", "value": "T103E49E1177D0C072C2BF3630551AA3B566EABC708DB9860B6FD42A7E2E745829D3871F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428719, "uuid": "9a2451ba-30d7-40b1-878e-403a50459626", "value": "923a5ec702466ffd61b422bacc94c6f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428719, "uuid": "fba1e98b-c33b-416e-9268-deff27dcb763", "value": "12288:JSycC8Tu2EEAeClIHRFa7UdUzrAKatI8X0oXYl2N17OP:JSDD7RDhH3dUfmtj0oXYl+OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648428719, "uuid": "6f449beb-24b8-4d80-9e6b-9fd0cd437668", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648428719, "uuid": "664a060e-f78a-489f-b36c-b17adc34474e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428719, "uuid": "b7f425c3-9c4e-4691-8abe-d5a08c3a55a6", "value": "d96b8f58e46d7ee5a5a7d6de28fd49c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74af2b99-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448124, "uuid": "c72aaa77-cbbb-4187-a75c-2033732b445d", "comment": "Malware payload (Stop)", "value": "03216ee38c31d0994a688710dc0f2663", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448124, "uuid": "02f5dd37-257c-4793-8e0b-04acd0bc6177", "comment": "Malware payload (Stop)", "value": "909204a217771a3830a59178d9bdcabec2c4b58eeb96aab7e10f34c2daee4392", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448124, "uuid": "58b4d405-4da9-45bb-b29c-f0eeecc3c6fb", "comment": "Malware payload (Stop)", "value": "5c15e55e3c108f940ea38adba6217a78638aa9c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448124, "uuid": "3021d29c-e82a-453a-b6ab-b52b1fb8c6ea", "comment": "Malware payload (Stop)", "value": "d3ba2cab7fb0c1d8d0380bd26fa17222d4b184c54621c1e7e749a0dfc9d6fe2898cafffc89691a65e15461b23420c9b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448124, "uuid": "96724203-8e6e-4022-9f43-b3a1e3e14744", "value": "T189050210BB90D035D5B752F8497A93AC7A2EBAA05B2895CF32D55BEE16342E0FC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448124, "uuid": "739d2a83-6b43-4322-a50a-febd08fd2c64", "value": "0f1855557318264240cd30e161847f03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448124, "uuid": "453b6ba9-f6fe-4227-8460-2242c34906dd", "value": "12288:zZOVZjjxAQ7FWWX3jSYSwmxHivzctLK+eF5LBszuUD3YbZeJRQpqQn0LqcH:NA1FJjzSTwgtLK+eF9B/Xb7pqpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448124, "uuid": "00f7abbf-2f24-4684-ad7f-cdc56b9e5ba9", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448124, "uuid": "fa460c0f-ba3b-4f54-9cea-bc6dc9157efa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448124, "uuid": "a0013d27-60e9-45b3-af56-b4804e1c64d0", "value": "909204a217771a3830a59178d9bdcabec2c4b58eeb96aab7e10f34c2daee4392", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c094834-ae78-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648459143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648459143, "uuid": "76cbccea-82bd-4174-a976-81ecd0f19794", "comment": "Malware payload (AgentTesla)", "value": "45133015e30368bb6c8ef7dab0bcc675", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648459143, "uuid": "37c59663-26c4-4bd0-bf5b-031afe719c58", "comment": "Malware payload (AgentTesla)", "value": "91db81cd38b9f713767e35c4012057b99734e8e0e889af77935c6a0b47eedcbb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648459143, "uuid": "8c065623-132b-4f22-9673-d50dddae4636", "comment": "Malware payload (AgentTesla)", "value": "22a645961d6bbf81628fa16b4b4453192ca6eda5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648459143, "uuid": "65ed3621-522c-4a03-9e74-9b813142ec8a", "comment": "Malware payload (AgentTesla)", "value": "525fb283af20283a4e5818872a497342c45da60a578bae236b4409490e7b5e58c07af76a2e6d85952f05ea0319bee144", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648459143, "uuid": "4bbad688-ad60-44b5-a830-48f966184384", "value": "T10FA4D08372AF9BEEC228053128D64237E3125C1546D38E5733AD367F66F2824965ED2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648459143, "uuid": "fc535389-56cf-4201-b8d8-348dbc375fb0", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648459143, "uuid": "3f0b0924-b8f2-4439-b7d0-fe84c5ad9653", "value": "6144:BGizepOs/T1eMg4DP0hThgbBhUJkXl7m4KJOU81kjfDX3MGNKiiyPGAl:Nelbd2hWBhBJm4oOM7L3MGNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648459143, "uuid": "d56124ba-347e-49db-be39-73f605c0043a", "value": 453667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648459143, "uuid": "f9a8b590-a4c8-4c0e-8617-b1f317b388da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648459143, "uuid": "fb275b15-e0cc-454e-9c8f-7864a83819fd", "value": "CIF Specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55431b11-ae8c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648467829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467829, "uuid": "d4cb3f7f-21d6-47a0-92fb-a05f93b3bf7f", "comment": "Malware payload (Heodo)", "value": "045234331f4170087ee8155d27f6d587", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467829, "uuid": "814f107f-7973-4fb0-8859-57a3635b3537", "comment": "Malware payload (Heodo)", "value": "9204de1a26453f59649613fc39e909c78f00a5d513c64cd09259c06c64ac1bb9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467829, "uuid": "7933a137-f443-44d0-a4e0-a2b7accdd765", "comment": "Malware payload (Heodo)", "value": "ab1ad766a0d19b0604f0824513fbb1834532ab52", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467829, "uuid": "a4d0fdba-61aa-47ed-8fc2-60f86bc12868", "comment": "Malware payload (Heodo)", "value": "4a3b097ffee1e52962833b3a8eb9f967d2e9c41053cb3c26499f625f52b778804597aec1b96940e47c5c65888deb3390", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648467829, "uuid": "a25cb00d-7422-45ab-bc0d-4513dd367680", "value": "T1B1E4BF513781C0BAC16E31B4491BA37962EDAD708F399787BBD05B7F6E740C2993821B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648467829, "uuid": "34cc8e53-89ee-4e66-b751-09c88aad46a2", "value": "12288:tFpMOnifD6xu1XRiTFIy30ZKm0XTsD12m1yMu0mPVOXNZ:tFpUDBQTFIy3mFWTa1/cNVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648467829, "uuid": "48f59f6e-4bb8-4186-bcc4-170cba79a770", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648467829, "uuid": "9d3da25c-4223-4a53-8829-2a078fce624a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648467829, "uuid": "4e36cdf5-2571-40f3-a01b-a9c354ceb7a7", "value": "emotet_exe_e5_17461f6ce85c43c1e0fbc28ce0f4583eb617c28f63c40090baadbbb82cdae9f1_2022-03-28__114340.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd51e97-aeb9-11ec-8e58-42010a9c0032", "comment": "Malware payload (CobaltStrike)", "timestamp": 1648487383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648487383, "uuid": "942e8478-b797-4b09-bf52-fa90f93e6696", "comment": "Malware payload (CobaltStrike)", "value": "d8b56d703242d0d7eb791a52bbc61aeb", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648487383, "uuid": "a686e24f-6d8f-469b-a366-2c69643ece2a", "comment": "Malware payload (CobaltStrike)", "value": "922bc53f37d8f146b6bc6f14195c3dee3b668cb57e17f666db1bfd5ef5d722cf", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648487383, "uuid": "50d1cc35-6fec-48a4-ad77-223ed0b0b10b", "comment": "Malware payload (CobaltStrike)", "value": "79dc90d157ccd6497b49c424b5ebb2c8450696ac", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648487383, "uuid": "c08af33a-c35f-4127-a461-e74c1246f1e6", "comment": "Malware payload (CobaltStrike)", "value": "588249c4bed53b023cbbc65642c5399269b6aa2cd4b9fcf4b30b90bc1fb5fee6a28c13a9d2cbd3e4c73372bbc6eed566", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648487383, "uuid": "7dc7c37a-fa54-4861-8c05-9cdd8ed19be7", "value": "T12224BEB1B41DBDA4F08B46B60D4EF0B6AD50EED7A89EA61B70F4A40597CA573300F643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648487383, "uuid": "b6b4958f-8bd7-482d-b9b4-960a5eb38b5c", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648487383, "uuid": "2f42c226-1c71-4153-96f0-5afb0b12b00d", "value": "6144:P443XR4SH8C4BeBxi66thkbAzLks1YarGR8ej4rC5B/P:LcZMBIz+YLks1YarGR8Pu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648487383, "uuid": "72b32b0f-b06a-48d4-a825-c27dbc6d66cf", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648487383, "uuid": "7c0f82d5-c484-4635-97ea-22483dd49f37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648487383, "uuid": "7c0b4db8-1593-4744-93a9-52c9d9098ae6", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc8c7ba-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448143, "uuid": "ddd9966f-8405-4630-a30c-c4b7725d9353", "comment": "Malware payload (Stop)", "value": "7e14a5fcf3970eb6710be7d3579643c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448143, "uuid": "509b1b71-8afe-4c15-b3a1-3d59b96b1f52", "comment": "Malware payload (Stop)", "value": "926737175a80bc387a3ef8f1e5a6c6db8354c539ad0d35f6a74487ba882649cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448143, "uuid": "515023df-d65d-41c2-9805-de7e5f0e65bd", "comment": "Malware payload (Stop)", "value": "577fbd4ebc41e5de84d44dbf260a45426115b743", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448143, "uuid": "162e7109-b80e-486c-b500-6af1c9503a0e", "comment": "Malware payload (Stop)", "value": "fc9c6cfe559a69c7d98d6cf0dacad95a58d74246d4cede04a0cf5442a25c451519bead6f9b70ca4b998f711097abed13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448143, "uuid": "ca281ef9-1bf4-4688-bc0e-1c2148e87377", "value": "T1ADF401007BA0D034E1B312F8597A97ADB52EBA719B3459CB62D966FB47306E4EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448143, "uuid": "da34d1d4-1a52-45f9-a0d3-8d8102e9e273", "value": "deca2b4731d9efa027759fcb7d7a6a95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448143, "uuid": "46a2212f-3e7f-4959-b8df-8311be9af21a", "value": "12288:d48mxu5iTHE1bC5vfLzotGUxmZsLCTsB7JBmXLXQvN6qU8z7y5RKLfGn7U3FoR9H:IxEsYULcCISWN6qUOaKbG7U+Rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448143, "uuid": "81ac1651-630a-4be6-9437-d74265cc8b55", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448143, "uuid": "5061508a-3da4-40ee-ae47-e5999f45bbb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448143, "uuid": "2e6651ac-d7d8-4289-a335-777157ae205d", "value": "926737175a80bc387a3ef8f1e5a6c6db8354c539ad0d35f6a74487ba882649cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c718f50-aec6-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648492644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492644, "uuid": "4ef6bf55-481a-4644-a86b-fbf8e6872b6e", "comment": "Malware payload (SilentBuilder)", "value": "f46f108f67739061514d18316e81ca36", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492644, "uuid": "f76092e6-8600-4348-b178-75225a81e633", "comment": "Malware payload (SilentBuilder)", "value": "9329e57da13f9b624804d6d51f3620920909a7d5a10a3d7e32457eec779f90fd", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492644, "uuid": "3854156b-f016-4dec-a88a-952663e63cee", "comment": "Malware payload (SilentBuilder)", "value": "56e308d278268d0ca9354e49d68ac6181ccca2ba", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492644, "uuid": "d47aa58a-78c2-4e65-82de-a2b27f3bae4b", "comment": "Malware payload (SilentBuilder)", "value": "86470877ea055fbf9adf7a1467f3f6546045439f769798a0eac8fff4d67e38a52ca8878df99b9fe605c87777749454da", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492644, "uuid": "22179feb-6c21-4417-8fd0-ac57901ef300", "value": "T10F43E95BBA49985DEA14877548E743997323FC304F6B074B3269F3257FF89A05A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492644, "uuid": "31c61ecb-41af-4d1e-b554-58b1c92e822f", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umvj:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648492644, "uuid": "fbbda5c9-2224-4197-9d6c-06c276237776", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648492644, "uuid": "b987d997-9448-4339-bbcd-a7837b462761", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492644, "uuid": "4c1d1be3-aa56-4bf2-92ee-75205e4562da", "value": "Documento.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8a66d7-ae68-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648452459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452459, "uuid": "41608f4b-cce3-4a1b-96b5-60560dffc4f3", "comment": "Malware payload (RedLineStealer)", "value": "5546c1ab6768292b78c746d9ea627f4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452459, "uuid": "6729d558-64f8-43b1-9c35-4efbfdcb9676", "comment": "Malware payload (RedLineStealer)", "value": "93708ec7bc1f9f7581cc2e1310a46000ad38128e19eb1e92db88e59d425b3e15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452459, "uuid": "49abff19-f1dc-4e34-9792-e15c8279d7f5", "comment": "Malware payload (RedLineStealer)", "value": "be3bf3f21b6101099bcfd7203a179829aea4b435", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452459, "uuid": "f280d19a-96f4-48fa-a1f3-66d01fc85a2f", "comment": "Malware payload (RedLineStealer)", "value": "25e4369b9d9e3d856d9a68d046cd45eb0fa7aa2d3b8a9e59fbdd435b9a930a2d89a18cc797cd219c147214bb4f29a5c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452459, "uuid": "4cdd8a61-5147-4766-91d9-3475d48b45ca", "value": "T1D234BF01B5C2C471D6A2093179B4EBB3493DFD341B608EDBA7441F7B4E312E56A32E6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452459, "uuid": "d268e212-f151-4b59-9941-089af30f6683", "value": "b733e319cfa95087e6d4949eaecead8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452459, "uuid": "3a2b97df-2879-400f-9082-f035095cfde6", "value": "3072:+ixhq1JcRafOlrs/mISrK+ZTSyPmNuHQMEcbKr7U6p4gcBW8n0Ps1W+JjDQvk+jr:tq1SYjQTuyP0uHQM+WDnOiABjUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452459, "uuid": "b82afb31-0828-4c07-a39a-428b6386bfab", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452459, "uuid": "5a1e31e4-7601-485f-bfee-f9c72a5844b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452459, "uuid": "87b13955-f74f-4c2b-8836-bff4f022d6f9", "value": "5546c1ab6768292b78c746d9ea627f4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c37e98b-ae7e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1648461747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461747, "uuid": "f255fd71-54ae-4278-9518-fecad20adbda", "comment": "Malware payload (Gozi)", "value": "78b9c616aef45ff9255c238f4757b207", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461747, "uuid": "7d3f5324-eee4-468d-adef-1d72e27e237a", "comment": "Malware payload (Gozi)", "value": "93e0fc85608986b9615f74cb69249f666116c926c6e5085f426f224340f0d996", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461747, "uuid": "b93eea12-ead8-4d2e-aa4a-5113bf7f8c78", "comment": "Malware payload (Gozi)", "value": "7864fbe1ce78a0e97ee70d1ba252d7e542ec49c3", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461747, "uuid": "d19e045d-fadd-4d17-af03-f01ee7a54afe", "comment": "Malware payload (Gozi)", "value": "7c3c1833641df619743d678a8cfec0b74993a901f2894617ee3904a9e497e1444ce71af70fadd42a6bf6a3d32beca912", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461747, "uuid": "0950bbd1-6f76-4244-963a-fa3b7247675e", "value": "T18663F765B692D969D85907315CE7CBFB7336FC006E6B87033288B33E2FB99948503646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461747, "uuid": "b6417469-92c4-4a79-a84d-c34884f29dd5", "value": "1536:qNVQlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0Fd50bKmrnGH/EOmJYk8:qNWlYkEIuPm3fNRZmbaoFhZhR0cixIH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648461747, "uuid": "793b9820-46c1-48d4-9cfe-ab10bcc7713e", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648461747, "uuid": "0291156b-427e-413d-a172-6ce40c19cc15", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461747, "uuid": "db615dca-1222-40d4-bce1-5477b4a38115", "value": "2022_03_FAT_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8bd112-ae6e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1648455169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455169, "uuid": "e0747829-648d-4b52-9503-7cb592e6cfed", "comment": "Malware payload (Smoke Loader)", "value": "9568547bd4692d7d6e06e107ebed3863", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455169, "uuid": "59bfbadb-b6a5-4ecd-b596-e66aa98cf5b9", "comment": "Malware payload (Smoke Loader)", "value": "93fc4f2ee5e58547ba2073c5475e846a13f9e98209732bd160f9f5b355b41bca", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455169, "uuid": "55c185da-65b4-4bdb-a273-58f55c696a5c", "comment": "Malware payload (Smoke Loader)", "value": "7006cb663c21814d2823eb488eb7eeb673bdaa46", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455169, "uuid": "abcb3c1c-920d-4f35-b44f-41605799d81c", "comment": "Malware payload (Smoke Loader)", "value": "2ada821d188d73d9d20c6fe09870a29b943f1d4a31ce3ee53726ed8e9c2f347a6680ebc19a43713730a0bea3e441606d", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455169, "uuid": "eb437097-b307-42f8-bbce-d837f8e317c5", "value": "T1D734D0227591DC71C4974536B864CBE29E3AB83203A589CB33A9177E6F303D156BB34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455169, "uuid": "ee2ade98-ba46-4993-b848-4b7002b6666a", "value": "7d2f3e2df9d6e9df3acc14e0869523dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455169, "uuid": "33ef146b-de82-45a5-afc1-6b29cca33ea4", "value": "1536:lv1ul+xgkrtcNUOI62smHU8CvHV+P+zbUseqNof6ni65rEhvzUhiGJEzCMk2l:ldQQFpDpkf0Pceq5l5r6vzwipWMk2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648455169, "uuid": "efd52cec-1f92-445b-9a1e-491df9c7dd35", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648455169, "uuid": "8c81ef5a-9509-48ef-98c3-b3cc3b284f79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455169, "uuid": "411c946e-096a-46b8-8454-0b9673ca608d", "value": "9568547bd4692d7d6e06e107ebed3863.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5078eff5-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448064, "uuid": "88187d02-0690-4b8c-81ce-2a2edc72564d", "comment": "Malware payload (Stop)", "value": "ba29cef64376a102046dc856c1cc2d69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448064, "uuid": "ae79bbfc-e2b0-4acf-a6a8-f701dab37167", "comment": "Malware payload (Stop)", "value": "948ce483156ee498c5c9f12c052cbbf5125644ebd0c783d2831d551d148a8e6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448064, "uuid": "226672f6-6502-4d84-a5f8-dcd80c3262f7", "comment": "Malware payload (Stop)", "value": "2fbbfc09381ef0dfb60d98f2456b19f472adf1d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448064, "uuid": "a4a7d3ff-8a08-426e-970c-9084f9c49bb8", "comment": "Malware payload (Stop)", "value": "292fdb71ca92f9558191fa4f1f37e14ca1587023a5c26f31fda1d5b226980853ec98aa6e77cc6be299ac228829cc5c22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448064, "uuid": "950746a0-582b-4cac-86cd-39b138a218a0", "value": "T1EAF4231215818973D430A83274FED732DE6E246126A20F53594E57BC5EB33E49BF9E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448064, "uuid": "6ae4a184-d5b7-4859-90a8-399bbb2482e1", "value": "eced6e789ab34d24d903c2877d4911d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448064, "uuid": "ee2d1a67-4ba0-465e-a8f4-e7908df30427", "value": "12288:8/RuQWKPq17r/aZ8MQ3IUvn5LQmLZ6Ta1QF3wijw:8puQl2j3I6GMZF1wwijw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448064, "uuid": "070f5c71-c2bf-480e-a67f-d730dc076ed4", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448064, "uuid": "9da7a32d-4162-4b53-b676-7320b83162e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448064, "uuid": "4a700ce5-8cc6-42fe-84d2-30d3ee0ffc7f", "value": "948ce483156ee498c5c9f12c052cbbf5125644ebd0c783d2831d551d148a8e6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22ed579-ae6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648453784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453784, "uuid": "c394e45d-4c44-4b22-8846-0f5963f370f0", "comment": "Malware payload (Formbook)", "value": "640a03b4714580d9ebcf27d382ffcef7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453784, "uuid": "076d01f2-d157-4021-8af0-87724ce96d45", "comment": "Malware payload (Formbook)", "value": "94ceb336b485844f7a99ef24583d469a62d983310b1cb65533ac1904050e4344", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453784, "uuid": "8dec6f67-0d23-490a-910b-cbcd41c8205f", "comment": "Malware payload (Formbook)", "value": "487afbf88ddd2f4ab9981a03cb1c66f171936717", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453784, "uuid": "984aff7e-77b2-4bcc-8748-57abd48a1361", "comment": "Malware payload (Formbook)", "value": "f1858cac5e0b306dbeed2bdf896a10fd6e8fd5d15afce048bbbf1e0d0b4275fbe76b5607abae2320baa8758d78f1b279", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453784, "uuid": "0bba2c87-6f0c-4ecb-a09b-affe1785f4a6", "value": "T133358C0EE44182C7D37CF177E5FC9AEC0B7947A61087FC4918C96ACAD926E4B142BB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453784, "uuid": "ffd3a887-8959-456e-aef3-18de2f6126d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453784, "uuid": "c8fd4a2a-3cf6-4673-ac6c-116d1dcb2aab", "value": "12288:l5FQQzFp/zNVB+pVrrW09imvVbpggDZNCUgOiXmovm2MxhBq0zgtqtd+Xr2lyAKp:LFQs7+bK0k0DDTXgOi2ovJM3RblWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648453784, "uuid": "285bf627-3900-4dc0-bb21-43ad4f15221b", "value": 1079808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648453784, "uuid": "a0de2650-0de7-4f25-98f9-abe4b38ecb55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453784, "uuid": "fbaab509-5ecc-47ff-8d65-ee393e92b57a", "value": "Yeni sipari\u015f \u00f6rnek & katalog_WJO-001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3080225c-aeb0-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648483229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483229, "uuid": "09c66600-48a4-4dda-87fc-e4df95469562", "comment": "Malware payload (NanoCore)", "value": "114441b1c087db4809dbc5a8417b836a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483229, "uuid": "422d3f5b-d01a-4d67-ab27-5a1d31fbe6be", "comment": "Malware payload (NanoCore)", "value": "951791738b8256d710fb1c7b0960a4ff30636371ed39346a93bc5a9500614769", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483229, "uuid": "f2f530be-e4b4-44be-8b19-d1517cc54bbf", "comment": "Malware payload (NanoCore)", "value": "d1aaa79e6aadeca98ce420ba17b74f843f05471f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483229, "uuid": "a2b6f2a8-5f10-41f4-8705-d12b7806f076", "comment": "Malware payload (NanoCore)", "value": "9afe5b8b17a275bda7395f628d4e4de9469427c7cc42439fea8adee6822884eef459d0025de8c52a2373466a90ccf76d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483229, "uuid": "fcaf67db-a954-43b6-ba00-effe73a7328c", "value": "T12A05BF5631FF1056C7A2EBB20BD8FCBF86AEF173160F753931811A4AC762A419A42375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483229, "uuid": "591cd6ca-7bee-4f2a-84b3-c2f8e888a5f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483229, "uuid": "445f74b4-6564-41f9-9cfd-d0a165603261", "value": "12288:Hq5VkoSbrlIdhx0lp6LrAybKEvgwGFPs3zEmADhWM0nJN/iu/oBcTSxTe1B+/mtP:HhbrlIXG0LkybBvgxPiEmeWRnKBqjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648483229, "uuid": "6b14dc04-9ca7-4fdc-b317-beb748e8eb9a", "value": 863232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648483229, "uuid": "40620ae3-05ab-4e1c-85cf-5ebd5d58e319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483229, "uuid": "983e15a3-a555-4e09-9e16-286bf1c71813", "value": "114441b1c087db4809dbc5a8417b836a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251e9426-ae3f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648434677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648434677, "uuid": "915766a6-9d05-4008-bf1d-0e2006c3ba08", "comment": "Malware payload (Loki)", "value": "844cfe779150952a3daf65e9a6e5aa2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648434677, "uuid": "3f81b228-f386-4470-a8b7-265383443e91", "comment": "Malware payload (Loki)", "value": "951f607e9f0a0f368a363006e1c5236eadb847a91d720c803f640139f486b1a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648434677, "uuid": "92dc84bd-5982-4cef-a39f-789b2c042b55", "comment": "Malware payload (Loki)", "value": "ab7d6dce28983e5d1afd7a737557af18b3c8f426", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648434677, "uuid": "8b084082-fb1d-45a4-8c37-335358d369fe", "comment": "Malware payload (Loki)", "value": "b5ab84fb03e922e0c954d084bb78b6a5ccdd6b0958e1c44748a5e64879b52b30eb6f40b4039dd3e3c7017ccc927882a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648434677, "uuid": "11ecfbad-a6ac-406c-b49f-98ff0e1189cd", "value": "T1085412157DA86473D2B042B307F7ABF9E3B34668C1115B871B84CF6EAB5098253583EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648434677, "uuid": "8c1af402-3ca3-42ec-90be-aca687654a05", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648434677, "uuid": "14cc2396-d4ee-4ffd-90ea-4dbb5c11662d", "value": "6144:rGiS1RUXVzHdSktEJIS08RYd49tR5iyrUn:W1UNHdSktMbjQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648434677, "uuid": "3f2fa977-020d-4b03-9946-958a9d25a76c", "value": 300353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648434677, "uuid": "06276b74-3d53-4f0c-9149-d0bce838ca60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648434677, "uuid": "0ec5ea7f-8602-4cb4-9ff9-b48913c43e8b", "value": "844cfe779150952a3daf65e9a6e5aa2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5389da04-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448069, "uuid": "38be8644-4ee9-45aa-a858-00fb070dc9be", "comment": "Malware payload (Stop)", "value": "3271a78a7cd0f6d566a3a1016a8eb8be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448069, "uuid": "6ab5cccd-983c-48b9-825f-175daa04dbad", "comment": "Malware payload (Stop)", "value": "951f935a4d635364d6600071b51b60fdbb88f1963799357118973ca9b6c7d945", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448069, "uuid": "509a960c-2c02-428c-9739-4d9d8bde5603", "comment": "Malware payload (Stop)", "value": "b63e8f421a5684b0a236cdb4591bf838fc79b3f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448069, "uuid": "aead4814-ef4f-48d9-82b8-3fb00fc13e79", "comment": "Malware payload (Stop)", "value": "da629cbe9f4089dd57b3748d83fcb1476b3d8af8cb244ed10af32e2c1e1eeab0983d0bf010dc1dda5b426d7b57da5ee2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448069, "uuid": "b392ee39-3452-47e6-b9af-8d979234445e", "value": "T18EF40110BB90D034F5B315F89A7AC3A8B92E79B16F6490CB62C52ADF16346E4DD3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448069, "uuid": "8109cbf7-f32a-4869-bae6-6a8851848748", "value": "8b43e1344b27321e8381c60a4a19bca2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448069, "uuid": "51899d0b-2d14-41fb-a603-0ab65b5378ee", "value": "12288:Hcc6ne2H2I6Zjp1G7d5pKX5QIl6OUZAoP/au6Ws8RmREYdYjAWZ2a:TO+0JbKJQI0B9/au6Ws8RYEFkS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448069, "uuid": "7a400a51-3312-405a-b3b8-dbd1d92b77cf", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448069, "uuid": "155f7741-86b0-4a92-9600-015e28a52d00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448069, "uuid": "6e6375fa-3396-4287-9c54-51d096966006", "value": "951f935a4d635364d6600071b51b60fdbb88f1963799357118973ca9b6c7d945", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b2c84b-ae7b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648460454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460454, "uuid": "19021404-10b6-40b9-84a1-7b86f65ef236", "comment": "Malware payload (Heodo)", "value": "b697659ec571027de051ca61e8c00074", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460454, "uuid": "7fd036e8-9877-4552-9b14-b8b7f4b1572d", "comment": "Malware payload (Heodo)", "value": "96ef58870f269ce30494c9f9f0ad57ba0abc1be96343f98e73d1a83b6c0cba07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460454, "uuid": "c6ddd645-2692-4c69-84eb-d7ce69047c73", "comment": "Malware payload (Heodo)", "value": "32a904563942c3031f78d5312d3af7ba1ec1d8fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460454, "uuid": "6930705c-888b-4c77-9cf3-00cb625ceb02", "comment": "Malware payload (Heodo)", "value": "96193e4d58bfe370c7fd83b525d3f38e8a291977de5dd65dad3fb5764a57c7d9e4de30e96fa892b177570c0ac8049b87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460454, "uuid": "58d7c249-9df9-4cfe-9ade-1c7a3df8a74c", "value": "T1CE94CF0272D0C47AC6EF23785D239B5AA7F9FC208A75C647A751BF8D5E326C1893035A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460454, "uuid": "c92c701c-a422-4408-9b5d-1643fad9ee69", "value": "8f8b1cb86c6697dd342b65a36c6ccbb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460454, "uuid": "3f232ef7-f771-4520-820f-1c83f0d7745f", "value": "12288:zwn2hR3547jpDMgySNxpuCMS5AhugWarPU:DRJ47xjyKpuCMSqumrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648460454, "uuid": "2a447d3d-695f-472a-8e10-84d68e82b731", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648460454, "uuid": "dd838a99-4b8e-4ea9-94da-f4dad366da1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460454, "uuid": "dced9730-e15e-4287-b735-a772e8464253", "value": "b697659ec571027de051ca61e8c00074", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d9f95d-aeb9-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648487154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648487154, "uuid": "1b370ce9-e1ca-42f1-98df-8522954a5fe2", "comment": "Malware payload (AgentTesla)", "value": "a91fefc589c142e8f117070d22040d64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648487154, "uuid": "c89836ee-d5b2-4d81-9394-4a9713abb37c", "comment": "Malware payload (AgentTesla)", "value": "97c5e7323d073dca6acc124560bc7eac04e104f5db3e700b2cac4c35be6717c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648487154, "uuid": "0c4eb769-d364-45e1-9bda-16f839a36387", "comment": "Malware payload (AgentTesla)", "value": "b2349628756a44d03ba5705641dc7b4e4bfef4ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648487154, "uuid": "ef967da3-f15c-4a04-bb44-ae200bd49240", "comment": "Malware payload (AgentTesla)", "value": "0ec1d9134324d8e9a2b062574d2b035293f0fc58120be35e2729628aff5286dc33a63a32b2b17525dc71fd5f363a2d3a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648487154, "uuid": "1c56064c-2164-44dc-8e9b-521b475c87dc", "value": "T18BC423CE809AF7EFD241806835FD1829EC50E5A20E463937F28DE03DA7B6FE5B059255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648487154, "uuid": "18b0adbc-01fc-427e-b33c-26a310dbb419", "value": "12288:uOwheSTAqAsZRFy3rz/fq9SgIXnZbCIl83LsXxpNvItHzOzT:Yh1TAPsIrz69SgEj6bsXVvItw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648487154, "uuid": "10fc0186-1996-4b12-a150-88bca83d05ca", "value": 559514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648487154, "uuid": "a267298d-42e5-4ab9-8206-6204d892f72c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648487154, "uuid": "a82e6af4-a985-4bd1-bfcc-eda3796bcf8c", "value": "Request Quotation.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85cfd43-aec2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648491241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491241, "uuid": "8863dcb5-99aa-4200-bac1-43ae93fb5d2d", "comment": "Malware payload (Heodo)", "value": "50a2b1b05beaac5ab68603471ba5049a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491241, "uuid": "e7aa26ac-1541-4cdf-a510-fb08f2f3623b", "comment": "Malware payload (Heodo)", "value": "985c5bf1e6ed220b98c89719e6cb0502628b9a86c48efb4b02bfe635c19cec2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491241, "uuid": "cdfabdf0-6dbb-4772-b5bd-f345b24e4ecd", "comment": "Malware payload (Heodo)", "value": "e1b4631945c03e6aeb2d41ee2aaad876dca5afed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491241, "uuid": "8d0c67bd-5c59-4d1f-8eb2-624d93af1254", "comment": "Malware payload (Heodo)", "value": "9b57eb137e00e9841c69fec9d3aa44d9b09f7efd2e2bccef23edca8ed2aee5b38f8b92ef33b903022a04fc13a22b1b1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491241, "uuid": "893c94f1-73ec-4fa9-b6ef-578f4f1520ee", "value": "T141E48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93FBFCD302514D7432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491241, "uuid": "364ac956-c562-4e0e-9060-ff0d28306bbd", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491241, "uuid": "d5344532-3b6d-427d-b59d-8b88dde9544c", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7GvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zoCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648491241, "uuid": "998c5ab1-a21c-471b-a0ca-7da3958d8ff3", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648491241, "uuid": "ae23dfaa-9049-4602-a5ff-6e5c339dc090", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491241, "uuid": "16af051e-4e6e-4a2c-891d-6f866e1c5fc8", "value": "50a2b1b05beaac5ab68603471ba5049a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc047a8-aeca-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648494394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494394, "uuid": "7983f7a7-186d-4a11-b16d-ea7417355bd9", "comment": "Malware payload", "value": "157b8b1b340f665ebd4d13ca72ce059a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494394, "uuid": "2ac687c0-7353-4b9a-b987-92fbef9dfdad", "comment": "Malware payload", "value": "9872c46b016d2e96a1cfe675346e3b249956500bc4dcddfb42e6afbc9726a36a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494394, "uuid": "c87b6b8c-5c9e-4874-a42e-dff4b14c5f8b", "comment": "Malware payload", "value": "7325726627dd4ac244730f35bc8ded3463960072", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494394, "uuid": "1b5b9289-b797-4702-b10c-6f657603924b", "comment": "Malware payload", "value": "27e9c733ec4035beac8f4fd8afc3a97e324542919d7166ca3ede662a186aaee52039721c5cb85ca6e9be07c6a6a5646b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494394, "uuid": "a1b983ef-2707-4bbd-b268-37f81c2ef5f5", "value": "T15094228CEAAC2310D9BC8175E9394F59B888A96F8DD81D30F2C3F15B5B77761231622D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494394, "uuid": "fc2b22e3-1795-4f98-a673-3c04b57d297b", "value": "ca13c8701271aa55971268f1f04fdca5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494394, "uuid": "57bc1704-12d1-480d-a617-5f27220e6ea1", "value": "12288:PX6xDTMioNcOQWEKb21mmjOhp0F/hV3+U:PXcnM7NHQWEKOj35F+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648494394, "uuid": "e8068791-fb9a-4308-9c6d-c2cab55c36ed", "value": 445608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648494394, "uuid": "6399b0ab-6c77-481a-b0cf-656b9932e995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494394, "uuid": "64daf56e-b90a-466a-b8c2-8afd094806c4", "value": "157b8b1b340f665ebd4d13ca72ce059a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4055cbcd-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448037, "uuid": "f736cc5f-af7c-4ce8-8be6-9605fb8e2fc7", "comment": "Malware payload (Stop)", "value": "8a2a16957f5c9aeb0eb1a686f7ba29a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448037, "uuid": "7f06d3ee-5771-4e37-acee-35e4a79ff0a0", "comment": "Malware payload (Stop)", "value": "98aeeffa753fd000731a7fc8bef2b3151cef2d9cc79ff03620cfba524e729ddd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448037, "uuid": "7d8e434c-8108-430e-b0f7-bd937ce33751", "comment": "Malware payload (Stop)", "value": "bd22b12a1e0457ebd1075dbdf98940622a86802f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448037, "uuid": "51de2100-9b5a-4ce2-bdb9-3d093219e17d", "comment": "Malware payload (Stop)", "value": "6bfe41fb82345394c9a4b79a86f88f51d2225c0247fdd32f3fcb101b0390901c100b360c6327d21e1e656e811f064e46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448037, "uuid": "1062472a-d33d-4a50-b611-b1d10427c635", "value": "T15E050140BB61D03DF17742F4796AA3A8B43A7D605F6404CB12D52BEB5638AE0ECB435B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448037, "uuid": "719864e3-b8bf-41a8-9a74-4da74dc57ec6", "value": "d626a2a864a52e91dc5f85b5e98029ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448037, "uuid": "b8c96792-4301-4c8b-bb30-459c77616cf4", "value": "24576:DbR90PL+evSzMuaY6kM9WYGaKYRFM5rMW7psUW2TGq:O+eQ4PUPY7M6WthTTGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448037, "uuid": "450fb5db-c257-4b06-b758-4f6f6278d03e", "value": 836096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448037, "uuid": "0a54f373-6919-4ef8-b4ca-4dc395188967", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448037, "uuid": "6079bb6a-8dab-4152-b1f5-7a6a1ddcca1d", "value": "98aeeffa753fd000731a7fc8bef2b3151cef2d9cc79ff03620cfba524e729ddd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527fc67f-ae3c-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648433464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433464, "uuid": "f62f73af-9e9e-4f4f-8031-db29378037a0", "comment": "Malware payload (RedLineStealer)", "value": "65bb991af07e72f16b54934ca980ef35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433464, "uuid": "7884e76d-e703-4847-81d0-1dc44bc32617", "comment": "Malware payload (RedLineStealer)", "value": "995cce8a3847b995d70f0d3148b782a3cdbc2b1297925dcb654bec2504bcf946", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433464, "uuid": "7c45844c-2a2f-41c2-af89-afd53c7ccc72", "comment": "Malware payload (RedLineStealer)", "value": "07cd3944226996c10b4a5636111d27d17bb7649d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433464, "uuid": "82ba437f-a665-4596-8ae3-7f5b49c83d88", "comment": "Malware payload (RedLineStealer)", "value": "06faaebab5526eaf2f8d9d55541bcfa97e0ef25b3d9c0721549a6550ea3226278d52925646374032971095597cc6238b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433464, "uuid": "bc9abb1c-5865-4488-8504-6d134d9dca3b", "value": "T12394F123F196C073E5A612B4AC62C7B19ABAB47059241A473FDC363D0F326D2DA7174B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433464, "uuid": "8343c1d2-1713-40a9-8025-23da1536e19d", "value": "159dcaa804632f606b007a362cfb6cc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433464, "uuid": "380147cd-55e0-4882-82b1-17a1bd4a3c66", "value": "6144:Dsdtv/biXPzkjcPkVfnFQGMY/GUGHIHG2dHcHKn7MUorAqq:DsdtXu4cmfPMY/FGAHcqnADH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648433464, "uuid": "4e8c9a94-d368-45ed-b98f-4239d66189c6", "value": 422912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648433464, "uuid": "856b4616-a519-4c0d-a1da-5fbdec998b2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433464, "uuid": "e953225e-fba1-4b03-80d1-ae617b0be154", "value": "995cce8a3847b995d70f0d3148b782a3cdbc2b1297925.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3947d889-aecb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648494840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494840, "uuid": "984e3f10-32fb-43d9-9cb2-e24a75f3c4e9", "comment": "Malware payload (Mirai)", "value": "27a2d9f605df6e4ff70ae38d7fcb4ec9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494840, "uuid": "90c6c16e-e926-49bb-b6dd-a1d24ee5e533", "comment": "Malware payload (Mirai)", "value": "998d486ee1bf3b442cd88eeaabde308d4301435bfbb8faa26896dc2a16a5a20d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494840, "uuid": "60b5dde9-63be-4b91-b06a-7fa5706beff1", "comment": "Malware payload (Mirai)", "value": "6c79c88ed78c0d50f1f89af07e8992523991c438", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494840, "uuid": "a0229ba5-d5de-47b5-95fd-d0bf8875f5df", "comment": "Malware payload (Mirai)", "value": "9a26c88a17b4084b8bf6d80cdb08317c6cc9dd21c988789ede2f700d7b7e59d57febd0a710eb05c839685ecc12eda4fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494840, "uuid": "cf786ce0-ae63-4b7d-83bd-ee9446e6639b", "value": "T1D8332ADAB902AD7CF98BEABE80160E0AB23123541053073777EBFDD37E321549956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494840, "uuid": "18e1f33d-4c21-49ee-a060-97c22be62040", "value": "768:mLGOe2kf9e9X9nbermI7vc59QPQs5gFHviPuzWeHXpi2UJTpDnH638gp:mL/4f8F1ef0YgFvimzpZi2UJJnHY8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648494840, "uuid": "e54fb312-475a-41a9-a925-569f9da30865", "value": 53056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648494840, "uuid": "aacdb62d-0e52-4268-bbef-164be749dff0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494840, "uuid": "b9ace2f7-99ec-4757-a64e-128550e6e1d1", "value": "27a2d9f605df6e4ff70ae38d7fcb4ec9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ddea90a-aed9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648500887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500887, "uuid": "2990770f-bb32-424d-8486-28272272d1d3", "comment": "Malware payload (Heodo)", "value": "b84e087906e0519a58ae00fb9cb524f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500887, "uuid": "201bda39-985d-4cd0-98fd-9775e74a4a3b", "comment": "Malware payload (Heodo)", "value": "99f265d26b3ba6285856911940afc704ff5ee5adc3eac3706a5ef4c021c76c20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500887, "uuid": "a241da94-20f2-4bfd-b457-a3d8543fa257", "comment": "Malware payload (Heodo)", "value": "6518f1d9606a73f43495e6564bccee95a8a1434d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500887, "uuid": "e623423c-fdc0-4879-8185-83d5259742a7", "comment": "Malware payload (Heodo)", "value": "b66aa641dc0ae68922b3788d0d7764458bbe5577ecd437470e96b0ec05d79873fbc77af01f2b5983fb094840474f683e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500887, "uuid": "57fdd6e7-f014-487c-8bcb-cc3d0ec8a21e", "value": "T1C1E48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514DB432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500887, "uuid": "611c18fb-1bb4-478c-be4e-51ee1b454eb9", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500887, "uuid": "af768fbf-380f-4a76-a7a6-4bca9ce569b7", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7XvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zlCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648500887, "uuid": "df1f6440-4b47-4977-bc00-ca1fb007a2b5", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648500887, "uuid": "f512b4ba-170e-4452-80fa-67f6ef2b9668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500887, "uuid": "bb30e29a-b70f-4a99-89fe-21dab47fe470", "value": "b84e087906e0519a58ae00fb9cb524f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ee519c-ae57-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1648444966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444966, "uuid": "17420c57-af14-420e-a39c-17ed8f79332f", "comment": "Malware payload (RemcosRAT)", "value": "4eacfed1c32ebfae5385028b2db73d74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444966, "uuid": "0fd49cd4-fc2c-4584-95db-018f4dc12b48", "comment": "Malware payload (RemcosRAT)", "value": "9aff6a22a0974ce5cf694c316397b6413455cbcf7ccfd1e4c684e45290176a50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444966, "uuid": "585ed085-7e45-40e6-ae9f-0c3fb3c122d6", "comment": "Malware payload (RemcosRAT)", "value": "1f506dc1bec0d495196ef0c60b546886004af863", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444966, "uuid": "bcb17d35-16d0-43f7-9688-dd1bfc867040", "comment": "Malware payload (RemcosRAT)", "value": "6c620fb6ef5e57ceab8965d9953d9966fa036b4bff9f1206bf9282fd9388db351ebd3f7db660504ea9568aeab1d449fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444966, "uuid": "cc044798-2b84-41e4-a142-dd360c115e5c", "value": "T1BC058E2DF3914476D13316344D5BA3A9AD37BE002E24B94B7BFA2D8C9F7735074292A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444966, "uuid": "f76faeaf-15f2-4207-878c-8d695a10a5fa", "value": "050411d35bbff71bc05083b3cfc98bc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444966, "uuid": "571fc2cd-900d-4ceb-a832-50aff8a7ea7b", "value": "24576:K01V/cee2U63yS26THrITr7Ruy/dpjZO/PdCLHOmS:K01Ve2dyqql7WPdCLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648444966, "uuid": "0c10f8ad-50dd-4ee2-b314-f6bfcdde4195", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648444966, "uuid": "024895b8-ea1c-44bc-a117-bd1cf79bd2ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444966, "uuid": "7866653d-6215-42e9-9b3b-a567f777379a", "value": "DHL_179030 DOCUMENT RECEIPT .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3084d97-aeec-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648509325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509325, "uuid": "8e855bac-f6f8-441d-ba35-c2bd2f9964e2", "comment": "Malware payload", "value": "b1c698070614abb9722615353b7aebd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509325, "uuid": "16d4ff19-1a3f-42fc-bf52-8fa283ceae40", "comment": "Malware payload", "value": "9b68f6082702082205344baf6812469cf2ef20345acb6b6a94022feebb087c43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509325, "uuid": "c61fd2f9-2427-444c-9996-6310bd4d769e", "comment": "Malware payload", "value": "31c45849b60c6e4bcde64f872f38b342f8e841ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509325, "uuid": "c50298be-ab72-4baa-b23e-bf3d2c3e2c80", "comment": "Malware payload", "value": "46e39cd28e3a0b6eb73e4df0b865c24830c047b715fdd7180332e1d6e60f475f232a6f311dd7cb7438b1a4ed35a22101", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509325, "uuid": "ffbc095b-c3e3-442a-a4f0-ff9ae7a22268", "value": "T1C1844A43F2A2A0ACD16AC1788757E673FA327C0946217A7B27D0FE312F65B50A72D705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509325, "uuid": "ad4d4c80-c9bd-42b5-889a-77b8eef6155c", "value": "b3f6dcc1b4af5b5c34940f50a3e17687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509325, "uuid": "aaf9ea34-5cdd-43dd-91f0-438ada02ce87", "value": "6144:CU/yZ9D1EdQ4Qi9rO3/JwOWGM/gRfDCVIpKUY0MVNDU2G:l/yZLPurSRpD03V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648509325, "uuid": "f5b91ddc-f6f2-4de2-804c-d81aba8adcbd", "value": 407552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648509325, "uuid": "0f27f912-f9a9-43ad-b63b-b02705bb24d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509325, "uuid": "28895548-5b89-45bd-baa0-0ba88355523e", "value": "9b68f6082702082205344baf6812469cf2ef20345acb6b6a94022feebb087c43.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d81938-ae75-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648457812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457812, "uuid": "6c01072c-9a05-4ad2-a65d-b95c3c9f8122", "comment": "Malware payload (Heodo)", "value": "8712d34012d38a638132ee92605b19e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457812, "uuid": "7102f9e2-eaaf-424a-8bde-b57d67110be6", "comment": "Malware payload (Heodo)", "value": "9cc77845141aeef9cdf2c58a86a2a1fe49cb0c4be99f8edec33a9c5c5fe254e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457812, "uuid": "63e2a63d-5038-4b2c-8c8e-839b7ae70d1f", "comment": "Malware payload (Heodo)", "value": "a0066ab2f259636a5fc2705f368d75e9d3d08a62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457812, "uuid": "6600ee67-2996-4c58-b8e9-a353261a2574", "comment": "Malware payload (Heodo)", "value": "82fdb8b1b5f4a9d51fbcb041bbf549ceb22d80918e43c79be6e1c08427e05ad5512ff1b05e7b014dd43da9206067acf9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457812, "uuid": "b6de065d-18a3-4aef-8fb4-7e55bac56a4e", "value": "T1A294CF0272D0C47AC6EF23785D239B5AA7F9FC208A75C647A751BF8D5E326C1893035A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457812, "uuid": "76e009a2-069c-4681-8e92-1548c2e2707c", "value": "8f8b1cb86c6697dd342b65a36c6ccbb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457812, "uuid": "6e8f9fad-b090-4878-b163-13d5d57f3ac4", "value": "12288:zwn2hR3547jpDMgySIxpuCMS5AhugWarPU:DRJ47xjyrpuCMSqumrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648457812, "uuid": "751b55bf-df29-48bc-b573-b4b1aaa03ddf", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648457812, "uuid": "1704b793-3304-4559-b504-33a4315cdd01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457812, "uuid": "50ba8d87-3738-414f-bb6c-a0a0726c0fad", "value": "8712d34012d38a638132ee92605b19e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceaa1062-ae85-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648465026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465026, "uuid": "2f28380b-fad3-4a84-81af-c5cb066baf21", "comment": "Malware payload (Heodo)", "value": "d4c4217d69e56aaeea9c3bfc3fa5b40d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465026, "uuid": "add01003-fef1-4259-bc80-3aa0238b3483", "comment": "Malware payload (Heodo)", "value": "9ced35a46d135430e3f25b9ae651b129b6abd60d8604b2c3a4c50ad654a0fa44", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465026, "uuid": "bc32c825-29b3-4b09-b123-3ec6c8921620", "comment": "Malware payload (Heodo)", "value": "7efffbaf034ad943dabc96613b90396b4de4fceb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465026, "uuid": "741a760d-c111-4a74-99bf-c493adda6e1e", "comment": "Malware payload (Heodo)", "value": "f3bc6fa866e4ef557ab526a9f81b3548cd6f866f59d8f8c21b037cee88a0d8cb90664dd2fdbd1efbc1f420dc6d869f04", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465026, "uuid": "4a693ee6-8b8f-4f9c-b4fd-55d8ac04c207", "value": "T184C47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465026, "uuid": "e563867f-6dd9-42a8-a00e-4b548687707a", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465026, "uuid": "f10d5119-204f-4298-a1c6-d5dbc0406ada", "value": "12288:S54yM33d3q3Z7Bog5reNmF+U/9JckIAGfUeb:SKh3831BoTN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648465026, "uuid": "c8c8a797-3afd-427c-94f3-9265a2029457", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648465026, "uuid": "60a27458-0828-40d8-a1b4-be2fc74cff32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465026, "uuid": "95b0247d-fd1c-4eba-a2cd-35b8745042de", "value": "wnru.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e39c5aa-ae58-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648445510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648445510, "uuid": "e37c5b7c-368a-40c8-b217-83373bfc8e0a", "comment": "Malware payload (AgentTesla)", "value": "a9c687f57cbef8fd824d6606af017025", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648445510, "uuid": "f5e3bd5d-fef8-4931-aa20-e93951a99f37", "comment": "Malware payload (AgentTesla)", "value": "9d724ef4b69f3205dd8d73f9b8c9115735147dfe94e2b86a0f9ed4948b3f49b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648445510, "uuid": "6664ce51-a12f-4749-9949-0a0a1c90d435", "comment": "Malware payload (AgentTesla)", "value": "818959025410abcdcb333d141660fe9b5d16f581", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648445510, "uuid": "6a3bff76-79de-4225-96a3-ebb3ad9d1e0b", "comment": "Malware payload (AgentTesla)", "value": "cb36ec3eca9d78bef15db907cbdd47f2d3daa9d161f5af8e78953c6e824c8ef1050534320742b039f84ccb88a7bd69eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648445510, "uuid": "a7f6a1ad-15b5-48d8-a224-ee2385318003", "value": "T183E4F6ADB2F071EFC86BC175DA981C68BA907C67930B4103D02731A99A7D997DF143B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648445510, "uuid": "41361228-db97-4310-a982-01eb5e2e1f79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648445510, "uuid": "330634ed-dd47-4ca0-aea5-f88d273642a5", "value": "12288:UDXtyl5epz0whgNZSt4VaOj3akyp2929+N3Q+geyUx7RHzUDDhMQ2ycJXJGnNjla:UDXtyl5e0zNo6VvjakypG33WenB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648445510, "uuid": "7f9c61db-dc63-483a-86e6-b589513178ac", "value": 694784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648445510, "uuid": "51b4cb91-f136-4b9c-bd27-54995c0c40d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648445510, "uuid": "e20a205c-f9f0-4d69-abf3-11f2bcf6a559", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d9091e-ae69-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648452685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452685, "uuid": "32e0b059-f0f8-47a6-8c24-eb2151d8bc07", "comment": "Malware payload (AgentTesla)", "value": "9e9239bceae7fa4246ab6a06edc1ef93", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452685, "uuid": "00035027-4b10-44bc-9a75-a2a9c412e0c3", "comment": "Malware payload (AgentTesla)", "value": "9fb53361c1ffadcef2fae5f0df0d7089d0decde35bdfa7d4505f241d1cf8ed1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452685, "uuid": "98e7a7ca-c06a-42e5-bfe0-ecd967fb9b18", "comment": "Malware payload (AgentTesla)", "value": "8be906d3bbe9e68bab75eef2c343d3b858bb75e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452685, "uuid": "0a040770-01c1-4f4b-b634-cc9310eba21f", "comment": "Malware payload (AgentTesla)", "value": "f341657a30f6038942f0a73ff9f0c6b2cc35125273eb49d94c3ec650f4011af3c00e82d1b6584b527cbdd675f62276b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452685, "uuid": "43deef0a-2a16-4708-a21b-76391733e3b4", "value": "T1E31412793939E193F027BBFD2A707228426BEC1E35209D07974737151E30DA55AE8F2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452685, "uuid": "1e3cba8b-1ad9-42c6-88fc-2b1c03c11208", "value": "3072:FRk8ck9C4Hoi7ogKlXuxaa3CpaxhsqsCFMo2AB2J6uclUzyJ2SiYuYV4fkVUsuXP:Pk8cM0gKlXMaayExhiCCxAIguclU+4WU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452685, "uuid": "58046eb1-8e31-40d0-9478-6eed9c59de32", "value": 192440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452685, "uuid": "19e7b866-d95b-4211-81fe-5840be5a0c7d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452685, "uuid": "216456eb-3300-4536-90fc-e1c83552a59e", "value": "March_Bank_Statement.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53203cf7-aed9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648500896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500896, "uuid": "845ac462-3df8-4f60-a519-d6669e1c4287", "comment": "Malware payload (SilentBuilder)", "value": "e95393785b9bbe238871d5a3dcb6800b", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500896, "uuid": "6ac4db5f-f0a2-48bd-9448-79a4ad0232db", "comment": "Malware payload (SilentBuilder)", "value": "a00b7f554fe95733ff0a885f74098e3a6c2e08f855f5e44b732e5d22e7ba3a5e", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500896, "uuid": "ca7230c0-3256-4c95-87a3-80633a6968ba", "comment": "Malware payload (SilentBuilder)", "value": "d575e09673fb3f01c5db916c0050becd194cf2c9", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500896, "uuid": "5277dd25-5abe-45b1-8f0d-a50b3b76f20f", "comment": "Malware payload (SilentBuilder)", "value": "28ef960edb3285faae3d261e75843450ebb4b5ab1b921c5943bf72ea8811e348edf56608a91e41847e9babea523846bd", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500896, "uuid": "c38f4aec-93d9-448f-95b9-521d3ada2cf4", "value": "T1D2C3AD8BB659486DF921877488DB879A7363FC344FAB47473214F3366EB95A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500896, "uuid": "b19d2887-f068-42ce-8af8-ee2c1482d516", "value": "3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlC9:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648500896, "uuid": "39cd2449-2239-4f4e-9501-30bedbb88164", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648500896, "uuid": "5d55915b-a25d-40a1-9f0b-e479080522da", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500896, "uuid": "718749cd-da40-4c6b-96ba-10766c95684f", "value": "e95393785b9bbe238871d5a3dcb6800b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0dc116f-ae6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648453889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453889, "uuid": "7c938619-4364-4182-9f2d-99993d9cfce9", "comment": "Malware payload (Formbook)", "value": "0c9834dfe4e8445567a0bc539c48586c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453889, "uuid": "50b443c4-ea9e-415c-aa24-40815f651b31", "comment": "Malware payload (Formbook)", "value": "a0af1e02a12e827298c0209e485466f4c3ce4d3bfc9b50f778d6004d5c2abde0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453889, "uuid": "3a61857d-f6ef-4c67-a71c-5278205154cb", "comment": "Malware payload (Formbook)", "value": "7170378a41c1a683b8f928a3f9ce209e0f05ea3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453889, "uuid": "e77558dd-ee63-4814-8752-a6734309cf25", "comment": "Malware payload (Formbook)", "value": "a46faa78b34f5cb3d10c901c97403d586b33423e9ec1ff890726e5bc69f86a4398c0c4acb35e4cf5863cf185a39c559f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453889, "uuid": "fc9a15e6-9a90-462c-a719-090110c7ba54", "value": "T18235F00132E06B58E47A53B6DC6880DC47B47E596E7ED24F2DC172CF0AB17818A2AF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453889, "uuid": "3c138b24-18e0-4f95-a0f0-1e6dbc2c364f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453889, "uuid": "6091e95a-8588-45e6-b08e-53294310470c", "value": "24576:6p4swNiEz+y7b+BjN8aOZxD1TTrEnXoFRZce1E:V3Ntz+y7CNOZJBPEXoFXFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648453889, "uuid": "47c6c955-5f95-4882-be21-4d50a7097003", "value": 1125888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648453889, "uuid": "897044a6-9fd8-4b59-b933-d58151948216", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453889, "uuid": "f63588f7-b39d-4e2b-bdfc-7756df2b3df7", "value": "yeni sipari\u015f pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3945f1d8-aed7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648499994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648499994, "uuid": "b1353a9e-54e5-4518-8712-0e713c50a509", "comment": "Malware payload (Heodo)", "value": "f54837e677058bbd569d927bc8503d6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648499994, "uuid": "cbf448f2-8c29-4562-832c-f41a4c4d3d53", "comment": "Malware payload (Heodo)", "value": "a0f2a829458a1f9097dbd5ac52832e2dd0f59630fc63193909833a63fcff71b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648499994, "uuid": "7aa4da83-665d-42a1-8a13-edadec3f0675", "comment": "Malware payload (Heodo)", "value": "39feda2437087e710417c639a6eb0c40b631b78f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648499994, "uuid": "76482a55-a9c9-423a-aecc-4204f8cd0357", "comment": "Malware payload (Heodo)", "value": "02c13136c59b3a4be9c741b409f596004e09a7f5e5f762fbb510d17bf2cc1d4dad6f54c69d6a85053ccb4db613666456", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648499994, "uuid": "8696bedb-8753-4100-a68a-12c612c302de", "value": "T127E48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514DB432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648499994, "uuid": "ec203508-174f-4d4b-a08a-2138fbbe557b", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648499994, "uuid": "8df08686-a24c-4c46-9df2-4309c7bd1c39", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7vvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5z5CMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648499994, "uuid": "4756e178-6ce2-48a0-970a-cc28529d638a", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648499994, "uuid": "0f100fca-3883-4c65-8bc3-2da82fbce8f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648499994, "uuid": "181a408c-20d3-40ad-8622-c15061108abd", "value": "f54837e677058bbd569d927bc8503d6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360cd2f2-aee4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648505572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648505572, "uuid": "85999d93-5fd2-400f-bd2d-36f5053bfece", "comment": "Malware payload (Heodo)", "value": "5070ad43514ea03304bff3aa50ecd9dc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648505572, "uuid": "ce4680c2-e42b-4304-ab8f-abc049b37e9e", "comment": "Malware payload (Heodo)", "value": "a1647ede008bdaa0eb65a5cd6698b6d21f9dc586085bb80d33cc107881fdbf00", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648505572, "uuid": "22f7a418-4050-4581-a899-b347719e8f5e", "comment": "Malware payload (Heodo)", "value": "2a81e0ba31298788d43fc8919683ad4b2a340b37", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648505572, "uuid": "dbfff751-aa65-4758-a0ea-05afdf808d8e", "comment": "Malware payload (Heodo)", "value": "8e84f93d4cfa139ed67d7e12c4a85bc37ab3a604a58c3a4d113700334487f4f49ad8bff2a689ebb2d657088ce67b3cd3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648505572, "uuid": "52d6d077-05d6-468e-9436-072852e91592", "value": "T1BBC3AD8BB659486DF921877488DB879A7363FC344FAB47473214F3366EB95A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648505572, "uuid": "c31c622f-b1d8-4d51-934f-57642f43f8ce", "value": "3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlC9:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648505572, "uuid": "dd6c8c71-53f0-4bf5-9d77-d628ae16774b", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648505572, "uuid": "a6e3c319-1176-41bc-84d1-b14a636c64ac", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648505572, "uuid": "72710624-1c91-4174-bbd4-c7d2956bf4df", "value": "5070ad43514ea03304bff3aa50ecd9dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e6cbe9-ae42-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648435970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648435970, "uuid": "4e8de393-0617-49de-9580-bccb5d487b57", "comment": "Malware payload (Formbook)", "value": "e481e4352cbd8ab6ead3cff49d473c37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648435970, "uuid": "76a8edf8-546c-4b14-b1d5-961c648427dd", "comment": "Malware payload (Formbook)", "value": "a1844c54e3b36bd69aeeeea0ddd335114f344f20904fcdfcd5a3980328ebf19c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648435970, "uuid": "c7228de8-7269-4a8c-b8a5-7b761ae56fbb", "comment": "Malware payload (Formbook)", "value": "18368f04293fc7ce3e9ab6d5a9650d42cd2ac822", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648435970, "uuid": "4833b099-7f1b-4505-83d3-5464c31956eb", "comment": "Malware payload (Formbook)", "value": "a8af23472d93b647a5c9f8b26d18c3d5ab8d02b31e93fe502acc066bfcf13a7cdf91d6bf0abe95d79fa1f6135d88a20c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648435970, "uuid": "5923fdb4-4439-49cc-956c-35aae3111f72", "value": "T1F6B41246B7D0EE73C29B15B05DC2DB349334FD945A672B6333A07B9F3D320A6A806295", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648435970, "uuid": "8954f224-f867-49c9-ae54-c2202be589d1", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648435970, "uuid": "1df26e24-47b0-4862-b6f5-2bc2823f81b1", "value": "6144:OGi8ZrvylOb/v5DQW8M5Ii9/3izavT79w8dS2W25pxvb/0YYlM1TKviw3QFSrSlf:nvQ4v5kOIzarphdvhj/Ee1Miwgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648435970, "uuid": "ab7b00ed-b0e7-49c0-9136-2860be00566b", "value": 504064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648435970, "uuid": "0877cddc-6979-4d45-9566-a172bb815516", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648435970, "uuid": "ae53692d-b202-42b7-8612-c6c23f7ffc71", "value": "BOQ and MEP WORKS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fdce963-ae2a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648425863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648425863, "uuid": "1b2d2a85-9989-4c91-9502-8ab0f8166e29", "comment": "Malware payload (Heodo)", "value": "9de560ea7997a21a8e715fed48a3cc6c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648425863, "uuid": "611669c8-b5f0-485d-8782-a417b2befde9", "comment": "Malware payload (Heodo)", "value": "a1996f23b14da78de0d9e84480c42b40bfcc25bd4d227aeb3233a166d562c5bc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648425863, "uuid": "0fddbc56-6e1c-4666-91e3-86ab1cd016a1", "comment": "Malware payload (Heodo)", "value": "afe3b55bf2e4496900042b4eb6ff3696afbb16b2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648425863, "uuid": "38222dd3-c1c5-4bd4-92ef-b339c6955748", "comment": "Malware payload (Heodo)", "value": "e26d36c7e6bf29f1751708c1946270e59670d906890923cdaba33ce7132d26327c563641f6f5865e49ac70dea967871f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648425863, "uuid": "2006f000-1e95-4400-bd35-eed76edba1e4", "value": "T158E49E1177D0C072C2BF3630551AA3B566EABC708DB9860B6FD42A7E2E745829D3871F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648425863, "uuid": "56c3e3c5-e7ea-43ec-b77f-bcc00999802a", "value": "923a5ec702466ffd61b422bacc94c6f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648425863, "uuid": "22003a87-4fe7-4569-be5f-1c708cec1bc8", "value": "12288:JSycC8Tu2EEAeClIHRFa7UdUzrAK5tI8X0oXYl2N17OP:JSDD7RDhH3dUfFtj0oXYl+OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648425863, "uuid": "fe7a93c8-37c6-45d0-9aa4-2c1f2c955c44", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648425863, "uuid": "b31c604c-899e-45eb-aaaf-379355e40376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648425863, "uuid": "9b677489-a081-4903-bc71-540203b04a2d", "value": "emotet_exe_e4_a1996f23b14da78de0d9e84480c42b40bfcc25bd4d227aeb3233a166d562c5bc_2022-03-28__000418.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8787cab6-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448156, "uuid": "a2e57e8b-e395-41ba-8075-3ff706f60cc4", "comment": "Malware payload (Stop)", "value": "e35a48929f622de24f25a4d3f0776f0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448156, "uuid": "4fcb7569-7e4b-4085-82b7-9f681458bb2b", "comment": "Malware payload (Stop)", "value": "a19bb352dd1f5f9c0b274718bf5c0b9a4889806571f0d982cdc9a5b9c3f55e28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448156, "uuid": "883e0c39-3532-4e70-b844-2747eb72d8c9", "comment": "Malware payload (Stop)", "value": "a1ec169e1fc521eaa01212060069fcef4389b33d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448156, "uuid": "3f5c7368-1abd-4e83-850b-f11e7c51a989", "comment": "Malware payload (Stop)", "value": "661df27534111ee05bb68e4014a1beb69052840ac67583e3a5154f7ee6f725d4b159e19662a4df5ed4ece61a1714cf9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448156, "uuid": "ecbbdf17-5708-47bb-a4a8-0efe958f6159", "value": "T1380512813A918437F62615F7B596C3F06EAB7C32B8619AC72F98061C0E313C69F99717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448156, "uuid": "7d15d20f-b7a9-4482-a162-2804ec629e45", "value": "1690f0efc188c620ac36940e114b98ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448156, "uuid": "b722e5de-0eca-43d6-84ee-15f6661e9604", "value": "12288:+3uM9nJKLIHW0l/Ub1dzZsl5GlA/uO9Dq1AYPl9NFjiZg+HPH87s:8z9nJeIHb69mP/uOI1v9bjycY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448156, "uuid": "b10b4790-c54a-40d3-8e6b-2fb8a73e238c", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448156, "uuid": "78526469-9644-4fe0-8082-01b65fb2b8af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448156, "uuid": "1a728972-4bad-4ebe-9c22-efd7bebf062d", "value": "a19bb352dd1f5f9c0b274718bf5c0b9a4889806571f0d982cdc9a5b9c3f55e28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f24f25-ae9e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648475426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648475426, "uuid": "bd8a3140-676d-402a-9bac-d18cddbc37d6", "comment": "Malware payload (AveMariaRAT)", "value": "464f8eb394f5a5eeafc1f1a60289a26f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648475426, "uuid": "b1c790aa-e626-4099-9d43-414af2cb2cdc", "comment": "Malware payload (AveMariaRAT)", "value": "a1e72ad944e02ee8ada1e6b4b98217e7eeb8fa0c0c19aeebaf7401e2f35ee54d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648475426, "uuid": "348a8bef-a332-4cb5-8dc3-15fc01dc2e02", "comment": "Malware payload (AveMariaRAT)", "value": "4268cf1f48924eebc848b33ebc7ae0fa6a63d925", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648475426, "uuid": "5852d8d2-feda-4e44-8e0c-eaa7939fbb31", "comment": "Malware payload (AveMariaRAT)", "value": "b3019eac63fc7d2b431f0fc44e986c1867ff76ad2401bda9e4375729e9abc527fad43652a56eb705fa4c86a0eefe4266", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648475426, "uuid": "b44b07de-adad-4252-8a28-7c74a9bcc0e5", "value": "T116058D3EB79044B6C1325A788C1BF3B9ED36BE002E14B94776F92D4C9E7774075292A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648475426, "uuid": "52eb0c41-92c8-4290-9405-f9495b188b1a", "value": "050411d35bbff71bc05083b3cfc98bc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648475426, "uuid": "32232f67-3cc0-4fb5-824f-a1322624c25a", "value": "24576:K01V/cee2U63yS26THrITr7Ruy/dpjZOnPdCLHOmS:K01Ve2dyqql7yPdCLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648475426, "uuid": "ae46433f-e78b-4e30-b258-7facbae94987", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648475426, "uuid": "bcc9367e-26ab-444a-a128-0b0137eca20a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648475426, "uuid": "eaae45b2-c455-4d27-a367-dcefd05dcbb2", "value": "034252482908.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43724637-aeed-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648509460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509460, "uuid": "2040dc5f-ed7e-4703-9479-eb88dc5a04d6", "comment": "Malware payload", "value": "be3f4b3bb633fb163a3cfd96356e0609", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509460, "uuid": "228e1bef-16f8-42c7-914d-8b0f4cd92e32", "comment": "Malware payload", "value": "a1fb10d62011929da1e2f0f667f7b8faa3c38c3a2c7c9a07bd5c3fd91f1df8a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509460, "uuid": "875dd54f-f100-464e-acce-27fdbc2bb07a", "comment": "Malware payload", "value": "0231554d96ad3931853ba08bb4e72b8de4131811", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509460, "uuid": "27700ca0-fcf9-4c07-923a-ad5167eff16a", "comment": "Malware payload", "value": "9483abf942096449974c5ddba9d9b1cb2be28b8730bddc9dd6f7cbfad21b53a1b02b364df7a44dcb0d1a606b26373040", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509460, "uuid": "5b98fe6f-d986-4c00-aa6d-0d936ada4981", "value": "T1D8B24D1667A4C665C9EACA7D5CF231FC0263BE03CCB2675BD4C8FF0E79322404A51A65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509460, "uuid": "e15f9cb7-ef45-42a3-970f-9211b578a2f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509460, "uuid": "10c7bfa5-8a50-4c47-bcfd-e1da1fa219d2", "value": "96:QpJGVdSCa2itFSmjxs+HXSB5c1w027mcYJd0SVL8x92ljzNt:/+Ca/SmdsuXMc1w09JdH8x92ll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648509460, "uuid": "ddab3eae-82c7-488e-8aa5-aa23554e0b12", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648509460, "uuid": "42fbb176-02f1-41b3-a7e3-c4acf01e59d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509460, "uuid": "7e3eeb93-82a2-4022-aaa5-52a4e5d7c5b4", "value": "QLT0208220167.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e7cc5f-ae69-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648452665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452665, "uuid": "1e066850-3002-439c-bdbc-5834b75e0e5c", "comment": "Malware payload", "value": "3f74a9ea43ed6fb21fd0c54d8bcc2aa7", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452665, "uuid": "fb0c0cf8-23b2-415f-970e-325e7e9ffa8b", "comment": "Malware payload", "value": "a20e272bcd381bb73fce8009c61beff8cc69fab7b326cfcb093514bf167c5b29", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452665, "uuid": "7433bc05-7cf1-4fd2-9771-1da224dcb865", "comment": "Malware payload", "value": "365d7758021e119ebcadfad2d86e3b055d4daf8b", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452665, "uuid": "9d44ce99-9685-4ff6-8a31-e999632fc714", "comment": "Malware payload", "value": "5fb74be5c153042d4d20e110ce24316a1b28ea4d8134b549254faa4c7c7280091e25e9acb75d7a4d76445a56a93ca251", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452665, "uuid": "cb7c3eea-e63b-4d8e-84df-9a2a3cc30957", "value": "T10E140248F625D96FD64E57FF2008D7E185AC8C4A7E093322B0DE33A4C77E664D010BAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452665, "uuid": "c569c181-ad65-4bf7-87cf-6bbccb30d921", "value": "3072:NIvPJRu+RHiXFIGbXjhPpoiruOoY49w6V9iE4RLjl+Ehn+bbbpAS0i:6JRuI5mXjhPqiyrS1jl+EdS0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452665, "uuid": "56addaf9-d6e0-4648-a2e2-409631a8da87", "value": 192520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452665, "uuid": "bc7d377b-d2b5-41a2-9f32-920035962d71", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452665, "uuid": "ac656a25-2a8b-4fd4-aac2-798cee1211db", "value": "SOA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4ef38c-ae6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1648453721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453721, "uuid": "80a37059-320d-423a-b6d1-2c991434048f", "comment": "Malware payload (GuLoader)", "value": "afe079e301b38d82f69a57b908886d41", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453721, "uuid": "8b8afb6b-6730-4056-ac8c-aeb70e1a752a", "comment": "Malware payload (GuLoader)", "value": "a2c3402096bb410d4002a9de4f079128862796402606c4e8a63616d8c5ad0156", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453721, "uuid": "67614df1-9549-45c3-a7f5-c647626e4d68", "comment": "Malware payload (GuLoader)", "value": "a5489fe050e384d2d1889e3f2ea1ab401c599930", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453721, "uuid": "4e978b3d-4b53-4417-b1fb-39c737cfe624", "comment": "Malware payload (GuLoader)", "value": "4693ca762732f1308325a42a755d81bf28ac532ec46a981169bd96c1e03c001ee03f1c6f60e442275b08124109cff992", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453721, "uuid": "d7a7f113-5722-484b-9d6e-96da55558811", "value": "T16AF3F1553660C473E5A123B11F37DAA3DBB4ED112A74474B33A06FAF3A77252A81E312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453721, "uuid": "8ec320c9-3504-4563-8e24-32652e6a30e8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453721, "uuid": "0efc73d4-0bd4-4704-aba8-3eb5938c0d77", "value": "3072:vfY/TU9fE9PEtu7ju10q0dRabGdLqBNn63FAcPFhvrc+2hpY394EZKq+Y:HYa62Cd68i6ycLvrcbh639VJ+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648453721, "uuid": "5a796082-c0ff-4bcc-8cfe-214607196b5a", "value": 169416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648453721, "uuid": "1569c06e-78ec-4425-aa54-088fb1f10862", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453721, "uuid": "059722f7-51eb-4dce-a0dd-6c104eb3bbec", "value": "HSBCPA~1.COM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3571566d-aeb5-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648485385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648485385, "uuid": "d06d16ff-f14f-4b2e-9dc0-48ed8e89f597", "comment": "Malware payload (SilentBuilder)", "value": "1ecf130b6653da542b9d6a7a31560afd", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648485385, "uuid": "6948c622-a8eb-4c5d-af46-f8b2f61809d3", "comment": "Malware payload (SilentBuilder)", "value": "a2edbb0f81578ba4d733e4682ab1ea879c5b6d7d531fd333223c183496f495dd", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648485385, "uuid": "16a398d9-99c8-4247-9fb4-0c7221ecfe82", "comment": "Malware payload (SilentBuilder)", "value": "63342e74b7382bb5c55714abf05412306ac8d8d9", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648485385, "uuid": "cc4f00d0-6d20-4e72-9ad0-633de392dfa0", "comment": "Malware payload (SilentBuilder)", "value": "417087c0a1640aaef5688a3ad438b1bde88b0e8d1b492275e47d993218541cddd4af13dfc84198397539ba104209cc63", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648485385, "uuid": "9c38d4c8-c54d-4156-bcfc-78316cef41d7", "value": "T15F43E95BBA49985DEA14877548E743997323FC304F6B074B3269F3257FF89A05A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648485385, "uuid": "78616a04-bd87-4f2d-bdb6-b274d112ac2b", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umvv:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648485385, "uuid": "57b92bdb-4346-4c05-bc23-b7f278e3a21c", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648485385, "uuid": "e1b904b8-34b1-425d-8e22-36d19b9fd4cb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648485385, "uuid": "d3254339-00b1-42b6-ac19-18a87e4d3416", "value": "SecuriteInfo.com.Exploit.Siggen3.30262.26535.17411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb36a0c-ae62-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1648449673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648449673, "uuid": "3e075f94-626b-44d2-87e6-e55643fe4046", "comment": "Malware payload (RemcosRAT)", "value": "28701e281458640d619c818a9e4e5b90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648449673, "uuid": "1540a75a-b13c-49eb-afa6-4eade6107de1", "comment": "Malware payload (RemcosRAT)", "value": "a3792b703dde1aa5a935183c6696ce91cdea54579e9045b55848df91e6b312f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648449673, "uuid": "09b9f3c1-c185-490a-b3c1-e635bbc898b8", "comment": "Malware payload (RemcosRAT)", "value": "95b2d014b91c6317d7e4af6e2502fa0ce863d5cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648449673, "uuid": "e7e1e6b5-d53d-4997-920c-eb0e6cd6743e", "comment": "Malware payload (RemcosRAT)", "value": "aed4d92fb9d5289570a376459eea92e819a5015a9a2b9ae3280752175aec8b596a69ef92f99e5226f4d54aa3011ee001", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648449673, "uuid": "13b90c5f-6b3c-4e01-bc9a-bad59644254f", "value": "T1E5059F2EA7D05473D1731B788C5BA3BDAD337E002D14A94BAAF92D4D8E7B34074192A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648449673, "uuid": "9f07b094-326e-4ef9-add8-2df059938fb2", "value": "050411d35bbff71bc05083b3cfc98bc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648449673, "uuid": "0f1b9edd-d743-41e1-ac11-bbcde2a676db", "value": "24576:K01V/cee2U63yS26THrITr7Ruy/dpjZOZPdCLHOmS:K01Ve2dyqql7gPdCLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648449673, "uuid": "b4077ca9-f810-4339-88c1-af15cfb665ff", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648449673, "uuid": "49e9ad87-134b-41d2-b8b0-9d0137e85f45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648449673, "uuid": "edeae651-9ae1-4800-b62c-763354e6bb71", "value": "PO From Fibrex Holding0039404UDJ400948A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7227fb0-ae5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648446572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446572, "uuid": "826b0ce0-0d36-4501-a075-ffea544fab99", "comment": "Malware payload (AgentTesla)", "value": "8ea5ad8081e6a1ac3167ac8397854c3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446572, "uuid": "3cc51149-2ac1-4bcc-8047-f855f2a2536c", "comment": "Malware payload (AgentTesla)", "value": "a38eeff8dcb94fce98eec40a5012a46252e87d4eb9627f92df9454c321d7f10c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446572, "uuid": "89931df4-d3d8-4187-a35f-81df192f881e", "comment": "Malware payload (AgentTesla)", "value": "f32b0d8e9b1f2d21e2651a2702f6b45ed6eaa02b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446572, "uuid": "53585acc-35b7-4c40-ab8c-aed390f98f5b", "comment": "Malware payload (AgentTesla)", "value": "ce3825c985bcc041611409b308458edac8c060e232cda7e47257d277c3aa3fe81cba40b3b028207cd4c297dd3985d82d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446572, "uuid": "111baaca-550d-4299-a0e6-5f7f829bf927", "value": "T12D5423036581C637ED415C781BB7E6FAFBF942A412B26C1743A07F7F7A621C28857A81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446572, "uuid": "824a8ea1-3238-43ca-95ee-def4f2679781", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446572, "uuid": "9f8b7810-b9e3-4840-b5e3-1b89f0e938dc", "value": "6144:rGiTToWvIvkKHY7x6+QQKjqtkPRgvQr/dzXn7LybkKkeICYu09:sWwvTHYl/QQkPP26zr0kKk9ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648446572, "uuid": "52ee17e6-181e-438a-9bf3-5a9ed6404662", "value": 298747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648446572, "uuid": "7e281c9e-87bb-4ae0-99de-4ebb96bd067c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446572, "uuid": "5715da26-5f73-4058-89e7-a680b7a884c8", "value": "Tnt Original Inv_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d31d050-aeb1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648483706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483706, "uuid": "40fe1fe7-eaab-4afd-a546-3cce06eafbf2", "comment": "Malware payload", "value": "810604742e8e438a38524bc68ce4402c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483706, "uuid": "874a84ff-54a6-48fd-aeda-66ec66619e86", "comment": "Malware payload", "value": "a3de93197b49d8621d74287ca25241174c07af4456bbaeb66348be9de59bed67", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483706, "uuid": "a88b0e8a-6a59-47bb-9bf3-841c6981a473", "comment": "Malware payload", "value": "a510086db50c3cae274d8872c16ddce821345e3e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483706, "uuid": "c6b15e73-7fbc-4c1c-9dad-0a89bb9cc3a3", "comment": "Malware payload", "value": "6db06f4321a3a13353640b9fdac0b1e3289c2b273fbf3a89c4f55443dcc34dfb6fe1a92b2b84aa993a7dc71a3eacb032", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483706, "uuid": "8aac9ade-25bf-47e1-9935-c1b08d802b05", "value": "T13EE4138576C38584FC037C75D76EE36A3638D972CA4B0A1AE2D14A47AF93610AF90CD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483706, "uuid": "c14172ce-baae-4b5b-a724-365b089e0e43", "value": "12288:cNRDquksxdzA6x4RU4TX1xdzA6x4RU4TXRxdzA6x4RU4TXWxdzA6x4RU4TXd:auuksM6x4blM6x4bBM6x4bGM6x4bt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648483706, "uuid": "b5d332d5-9eaa-4175-bdd4-0d416ec1c3cd", "value": 666674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648483706, "uuid": "4d4050af-c548-4f46-9054-03c258bc55ec", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483706, "uuid": "b7609e27-472b-4af2-9fff-6c752c8a8eb5", "value": "dadga.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7712ba0f-ae71-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1648456289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456289, "uuid": "232c692b-049e-43ee-80a4-85835379cf7d", "comment": "Malware payload (Quakbot)", "value": "e3defec0807e4119ab5aa804eaf7e8b0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456289, "uuid": "e63a3a30-330b-481c-afef-667e056aca54", "comment": "Malware payload (Quakbot)", "value": "a3df872531012e9e0560ed008c4b4acd017f2f41315d372a7eab840ecf375022", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456289, "uuid": "2be7deb5-f146-461e-ba08-71bf6176e491", "comment": "Malware payload (Quakbot)", "value": "8b7f2fe9120bdfe6c59a3fc82834246e58375026", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456289, "uuid": "2a35a88d-1687-4f5c-9c70-399cebc4c8cc", "comment": "Malware payload (Quakbot)", "value": "48c9879b9517dfccf74d5f2da0b237e79bee242c76b8fafe52b2220ab9ffae3b0f5a835fe46695013285786a58e3fe3c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456289, "uuid": "a55f2058-1b42-4fe9-99b1-9c3bfdb8850a", "value": "T18724234C2083FD66D9C630E8E2E8FDA3FBD74214E89410CD90D5ED91A79996CB0BD293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456289, "uuid": "f7510f4d-fea6-46d3-b2b1-2babd971c1c6", "value": "6144:+Uu+BlNSDa8lSqeOgFoi57f3C/pAqhKbl8P2jDBUxSQ1YL3Zb:+b+sDrS7oi57f344jFU4Q1YrZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648456289, "uuid": "bb62534d-619b-47c2-ad00-37d22a38e02e", "value": 219434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648456289, "uuid": "d39365f3-e341-49fc-985f-253fbba1bcfe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456289, "uuid": "14d99e97-def8-4622-9b71-f586e1c315bb", "value": "llauiquma.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c916f9e7-ae9f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648476183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648476183, "uuid": "8ca39782-a7ea-4b16-8a30-5836c420c704", "comment": "Malware payload (Formbook)", "value": "5db0180eafb0fc3acccb9bfac222ad0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648476183, "uuid": "5993ef47-9db0-4f7a-a12b-e82c57cffb86", "comment": "Malware payload (Formbook)", "value": "a47b7491399bb9e706cadd4d755b28ac9572e5859418409cef76dcd339a82665", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648476183, "uuid": "71fd15b8-f661-4729-9e5f-39d15fbeeb29", "comment": "Malware payload (Formbook)", "value": "a9b93f65f95a9ea41f8775e578e67d56c43f7405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648476183, "uuid": "13667eb5-bb9a-486a-b79d-39bc4c90b8bb", "comment": "Malware payload (Formbook)", "value": "d9f15219e756808daf66abfbec5e4008ddb6360a48cc2629cab12578f05a1b704697e4ef759fce08a34ae88b9f9091d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648476183, "uuid": "6a3598ff-7dd5-407f-a402-e39c9000126b", "value": "T150758D9033E4CB8BD7ED0B32F979161C92B0B66E6779920D6906D2BE1CD234E0847797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648476183, "uuid": "b4dc1094-6611-498b-a07b-44002106fa91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648476183, "uuid": "ca9ad9ee-6f7a-4538-90ed-a26232a05808", "value": "24576:JUYJMQa0VjqmdxMRo1XypAPV3SVK2qlWp:J4p0pqmdxaoiHK2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648476183, "uuid": "0f118328-d08f-4e1b-b258-4a9e2d28e39d", "value": 1612800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648476183, "uuid": "3f258cc7-bdda-4ec6-a09e-ee2102726898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648476183, "uuid": "cfa71900-f101-4652-bc1e-58e775974f53", "value": "ORDER_CO.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d058c7c4-ae93-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648471042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471042, "uuid": "1eec6c1f-06e2-4dfb-8bdc-5524cc896340", "comment": "Malware payload (SilentBuilder)", "value": "afa82d8087107bc0bafe3eaea75d179a", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471042, "uuid": "0f568a9e-cfdc-4b03-8d31-159ca05f9ca6", "comment": "Malware payload (SilentBuilder)", "value": "a4ea06794b0d64527e340db895c9b2a8621f6c3e58e0f01ec9a0de3e28f974ba", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471042, "uuid": "0af0962a-e98c-450e-85d0-789d871ac539", "comment": "Malware payload (SilentBuilder)", "value": "2551ac4d15d8574c61ba9dc7710d9eaefc12db72", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471042, "uuid": "0f96c456-62ec-4ca1-bf73-dddcaae45c24", "comment": "Malware payload (SilentBuilder)", "value": "3709ecdc89d56b270089978557c866cbfe3b06565b8e7a34ab8b7b0d7aa032b0d3091217e73883647b46a6173978b16b", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471042, "uuid": "410e0d14-f014-4389-91ad-2c7d4205ac1d", "value": "T1CA43E95BBA49985DEA14877548E743997323FC304F6B074B3269F3257FF89A05A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471042, "uuid": "a5ec8097-c9d7-403f-bbdc-1a948841f0f4", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umvT:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648471042, "uuid": "3080796f-722b-4649-9f8e-1117e4b4e53a", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648471042, "uuid": "e107efdf-1fae-44ea-a6bf-e341bc1421be", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471042, "uuid": "93353d1d-816d-474d-9cf4-f9e55f20a3eb", "value": "HKY3991283965775_202203280951.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226209e5-ae69-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648452711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452711, "uuid": "6f65a7e8-4e61-4247-9d47-a37ffbb34b80", "comment": "Malware payload (Loki)", "value": "6aeead73b47b1a75a7514d22315b41bd", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452711, "uuid": "7f0d731e-6409-47ca-ba33-5066284753bb", "comment": "Malware payload (Loki)", "value": "a5ac07e54aced84e805fd0436d1e60e51fb92c82cae84541dd6edcaefb8a68a3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452711, "uuid": "1dd5e853-9f53-4286-8440-a096e92d8ddb", "comment": "Malware payload (Loki)", "value": "d059283531691741d131d5740c869a7cdb206be0", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452711, "uuid": "a9ceae3d-b0f6-469c-b638-abc9ba4deff1", "comment": "Malware payload (Loki)", "value": "4bb96d121fd003467188884447faa9c6a4c3e81085ebf597470b6da83ec69e8f70aee8c9862b33cd3ac4ea3319fc22a1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452711, "uuid": "0011ce81-00e5-4ba3-bfc6-0d997c5ccb4b", "value": "T19C14122DEF3ACAA6E3922DF04F60A10B06E7DC5BE94327B958C13F5FB53A52013A1155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452711, "uuid": "64d9e8b9-2028-4311-96ea-74f1346b2251", "value": "3072:HfHGXDYS3u2ptiT6RUcyGVQVlb+nQQgSWA6c6q/qE+KJXAVceX4xoar3GI:/HGXDYj2TTfmx+nKSZ/1/RAVzoxBrL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452711, "uuid": "a6206acb-9665-474c-8cd5-70ce304d46ea", "value": 192824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452711, "uuid": "dd475c08-238d-4edb-b9fc-e41a176188d9", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452711, "uuid": "a87842e0-36e5-4a38-a8ff-35ba2a431695", "value": "PAYMENT_ADVICE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bcf518-ae93-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648471025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471025, "uuid": "06d9f760-86f8-4ffc-b1dc-397f5fba4927", "comment": "Malware payload (Heodo)", "value": "5fdb15ee5b996cf5f407ce0085878a2c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471025, "uuid": "f4c83ced-acc4-4584-974f-a91014aac4ad", "comment": "Malware payload (Heodo)", "value": "a5e6825f5133e92f8f11e0d046b53347fd5575c66869372b2243b44bc41105f6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471025, "uuid": "e5729f76-8e42-48a8-afc3-fa0e44671a77", "comment": "Malware payload (Heodo)", "value": "12245721c8ef5b4b32d2da796959bf31350bdc02", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471025, "uuid": "f35fb394-ec2b-4717-bcd9-a7bfa31828b3", "comment": "Malware payload (Heodo)", "value": "f9d2e2d6d95c528fc567b36ccf30c4eed083633d533be74b01da092155e481f644bcf41db39ebd1da8cc45d6aeeaa158", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471025, "uuid": "68cbf2fa-f127-4de1-8ae2-b6a4e44520b7", "value": "T14F43E95BBA49985DEA14877548E743997323FC304F6B074B3269F3257FF89A05A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471025, "uuid": "7e5b07ae-28a1-4608-a0fe-9b6424b62e11", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umvf:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648471025, "uuid": "00f79665-a9b9-4e3d-829c-821ebea3c826", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648471025, "uuid": "a52d8f2b-fb04-480e-a259-21e7331f338c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471025, "uuid": "5204333e-bf60-4774-ac9c-a1be729ac94f", "value": "10094970941222628052.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9438f601-aebd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648488980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488980, "uuid": "46bee1ce-337b-440c-b71a-85383d434aac", "comment": "Malware payload (Heodo)", "value": "3019a078f3d82cbcf3747af80f700c45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488980, "uuid": "835acec6-66fa-48fa-93a2-4f4ffd7a5198", "comment": "Malware payload (Heodo)", "value": "a68490962a35c0a9ec2ed1f6d244c5fa8901df1e42f0471753dbfbbc80cad4c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488980, "uuid": "c62f4ef3-a368-4cc1-a78b-3e8dbe7f3e52", "comment": "Malware payload (Heodo)", "value": "0424c27dfc1188a7183593e42876b3f7962503a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488980, "uuid": "ab46d9c4-7ec9-4a2e-b4bd-9f32a89cd1a9", "comment": "Malware payload (Heodo)", "value": "1fd4b641486d3cea35451afec12a317f99af96b59c98427da555d5d03502c68ca4c3c9bb023329cef7aa4b0f589c0e93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488980, "uuid": "06b1099d-ad3f-427e-9b56-0fc1f7412ab0", "value": "T11FE48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514D7432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488980, "uuid": "707f1f24-171d-444d-a130-927fe44d9d6e", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488980, "uuid": "d64d53e2-403b-4372-9c7e-51824fee40b2", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7UvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zaCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648488980, "uuid": "9f3fc474-8b29-4e14-9fcc-7ef1506f0a24", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648488980, "uuid": "a1aef40f-5d8a-46f9-99c7-70ba11b25db2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488980, "uuid": "66208bc5-9787-49b3-a89f-4bc8cc602ade", "value": "3019a078f3d82cbcf3747af80f700c45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b019982d-ae45-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648437487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648437487, "uuid": "2dbac331-c1e4-4709-8f7f-81545ba1f408", "comment": "Malware payload (AgentTesla)", "value": "3bae12842e54744bc78a10e13bbd66ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648437487, "uuid": "47947d84-0c5b-4c7b-8410-91471c9b9d86", "comment": "Malware payload (AgentTesla)", "value": "a6d6dfb0f05974dc8b41f7f79a0aebcab35b5608a900e53c9726059b2afed130", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648437487, "uuid": "ff6b16f8-120b-4b3f-a5ff-4a8ff6f82e02", "comment": "Malware payload (AgentTesla)", "value": "1e71022fec8e572b1f5f95ec1f4bc2d01248d8eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648437487, "uuid": "39ad6af4-1fee-4ec3-a674-4fa1390bad78", "comment": "Malware payload (AgentTesla)", "value": "50402c30d39f4e8945af452400399f43b128d982a09cee28e136661b4edbda063179c3d16cf7f64e3812f6adf7a9c985", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648437487, "uuid": "8dd8a133-728d-4c1d-942f-c45dbf6ef346", "value": "T12255561321BCD6E4F42E3EB5C86847E806702D4A6D38E10BD98F7DCAD973683C915AD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648437487, "uuid": "ec9a51c6-8233-41b9-ae34-1afd1b83dfe5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648437487, "uuid": "448bed3f-15d7-4331-941c-a7e36d086008", "value": "24576:AppgmWPvOVP1e4YxrdAq1k1i9iBcpMEwovZV2XEV178D:/WVPgxCq1XvqEwohcUV178D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648437487, "uuid": "f78af829-74b4-4b40-b0f2-99ff9af868d9", "value": 1363456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648437487, "uuid": "62797455-1232-44b2-bdf3-6c75ff9a6031", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648437487, "uuid": "3f73887a-7b40-4bc5-916b-5b38b753c591", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f0ac52-ae89-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648466434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466434, "uuid": "ba00f1ed-d911-4afa-b835-2ac1648ed5ec", "comment": "Malware payload (AgentTesla)", "value": "ea157c4c75fabfaab92629a1f7e8af1e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466434, "uuid": "77117b6e-55c8-478e-87f4-060856b90b22", "comment": "Malware payload (AgentTesla)", "value": "a6e373663e30e364b4249197daaf130cb6c9b66f428d0a3f6d19bf9a45a2af0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466434, "uuid": "c0e23329-4d7a-4063-92dd-fe92b348827b", "comment": "Malware payload (AgentTesla)", "value": "ae24c7a689e9c1e8f9132b60c6ef5eb519a90e7c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466434, "uuid": "138cf7f6-3aa7-4461-a349-90ddc521551c", "comment": "Malware payload (AgentTesla)", "value": "112e7b73573b212d4e78ac82afc1ee62f6a6bbbaca6baeb51bff4cfb410679d63216ffbcedf9c0801de12018a36d0718", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466434, "uuid": "714ce2e9-72e2-4ac9-841f-d41b27e685b7", "value": "T1B0D4B4ADF2F075DFC86BC172DA581C68BA507CA7930B4103902731A99A7D997DF143B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466434, "uuid": "840e2a6c-7d3c-48f9-a189-d968e1e9761e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466434, "uuid": "921f7731-d15c-4a0e-91d5-40766a28d204", "value": "12288:MQXtRAoR313uxQIeGTYsneTV81olW8wd9Jq22xpwO50vG4MDr+aAMaDs08vXG4ln:MQXtRAuD6TYP8Ez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648466434, "uuid": "12c080f4-7c5e-4a16-b363-fdf56c373862", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648466434, "uuid": "420e009f-b95e-4c59-9acc-52fc61fd8247", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466434, "uuid": "c2963c4d-1db0-4697-a4da-bc075a8932a6", "value": "Shipment Docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c91263c-ae57-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648444970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444970, "uuid": "a594721b-24cb-4982-867f-65ccce599ea5", "comment": "Malware payload (Heodo)", "value": "4e35df0e662665965d181ab5be04d572", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444970, "uuid": "500a5836-45de-4b29-8443-5decfc5bb914", "comment": "Malware payload (Heodo)", "value": "a73e8251ed89f109c31ab67b9103e52449d7186f6b99d46b1bf29ae0de16704b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444970, "uuid": "28bcda19-0d8a-4c73-8068-b5b3546aac65", "comment": "Malware payload (Heodo)", "value": "21858206a23e9a3eb0a6fe90ec21f012c62c3958", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444970, "uuid": "cd30b534-808d-4bb2-a6f3-67ba7bc1d030", "comment": "Malware payload (Heodo)", "value": "32e2855d054806d43c4299c7214b51f06c415dfe08f3861df05a6a4b9e2df8ca43cd39f8e9915aedcc93d6c8aa966e6f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444970, "uuid": "df4daf5d-30e5-4ca6-9af3-e7ec42bb8d73", "value": "T12DD33CC2A776416AC96A55703D6DA4B6E7A85CBACF384EE793E3DD8D68331C0083114F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444970, "uuid": "7314a562-8f0d-4fb0-ab03-56f2c78df86f", "value": "28570bd8351c62f6e0c8e6211e57a6e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444970, "uuid": "81fccf1f-8d9f-4afe-a292-f185e4d5fa58", "value": "3072:QwalRy7iA/KQVYhv3vpoDnWnbD6zKnUe9hICvXbFy:IlRwMhXO6ncZe9y+LFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648444970, "uuid": "8ee181d0-22c9-4f2d-a420-8eefab0dc9d7", "value": 139377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648444970, "uuid": "5eaeb7f5-17f2-4213-9c85-b0706ec427d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444970, "uuid": "92f1ee5f-5784-44f8-9552-b2f70d814c73", "value": "FileTreeDialog.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e6f922-aeb9-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1648487310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648487310, "uuid": "0bbeed7b-d03d-431c-b2e5-a2a543891aec", "comment": "Malware payload (RemcosRAT)", "value": "816edb96c263895c4016a31140b04ff0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648487310, "uuid": "3d8255a2-3eb3-4225-bf3f-294a9f1186cf", "comment": "Malware payload (RemcosRAT)", "value": "a7619a482ab2c33cff9bb9bb390a74e61957af06c71374d500556d4edb4deab1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648487310, "uuid": "213de50b-60df-4caf-bb12-ac91f8bb2b6a", "comment": "Malware payload (RemcosRAT)", "value": "9bfec8f63dbc425e4c2d0e3b022cb27c7aa21a90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648487310, "uuid": "b0e28945-76f7-4e1f-a7e3-c2ce3b3927c5", "comment": "Malware payload (RemcosRAT)", "value": "b1b3b2041a9bc00c40328e4407e13980366b83fcdd52cfd845db8cc630f8ed4430255bedb27cb72f3bd429eb71f296ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648487310, "uuid": "9b4b7b6e-1bb0-4a06-a69e-9a8901dce7c6", "value": "T1C7058E2DB7814477C1721A789C4BA3B9AE267F001D24F98B67F92D8C5E7A34078253E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648487310, "uuid": "f92fe87f-dbcd-4cd5-b485-3349b68a0b23", "value": "e75c5003acd7e864dc3f6d27d565ffbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648487310, "uuid": "8f19be71-6980-44cb-9f30-c43bb2450f41", "value": "24576:nQeAdfvmxCKnOwj4XIiKDyyeagCG+PdCLHO/s:nh6WsaU+PdCLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648487310, "uuid": "66ab294e-9588-4ce0-98f7-4d6257f314f7", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648487310, "uuid": "34fe4fad-9431-4f1e-8ae3-7181fc2705f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648487310, "uuid": "3b7922af-d1df-4bbd-bc02-56096ee354d5", "value": "Waybill.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c63e13-ae4e-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648441152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648441152, "uuid": "0aab693d-9ff3-403d-afa6-d63957d349ba", "comment": "Malware payload (SnakeKeylogger)", "value": "c60a8a1f74802488155a472d6c69df8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648441152, "uuid": "2a3c51e7-b368-4e9a-a016-40698068eb56", "comment": "Malware payload (SnakeKeylogger)", "value": "a7807123c2857a67fda65abd23362dfe826ff087cb336afb838e7efc3bc99800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648441152, "uuid": "8a0a1390-1424-43c9-bd23-eb8a12a76b08", "comment": "Malware payload (SnakeKeylogger)", "value": "30218f271a22413ab8cd2eb459575929fc0d5c75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648441152, "uuid": "98b6342b-989f-41b1-9c5c-730858e38d42", "comment": "Malware payload (SnakeKeylogger)", "value": "c9d4f06863eae2f6447164731ec12418965ec7bd9164fb78f5ecdd18cea88ad38dd371c74781d5cfb3b642d393bbcda0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648441152, "uuid": "3575b754-53b6-4342-a62f-1a97264ce19d", "value": "T11135F11122E15B45E17A63B6CCA880EC47707D5AAE3CD60F1DD235CF1DB1B818A2AF5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648441152, "uuid": "820c45d9-2c2b-46e2-ad1a-bab978045aa8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648441152, "uuid": "f3a5ad62-22ed-4c92-8834-8472c352fb9e", "value": "24576:HpN2nhWoLjDlbQGkQrsgMNzAiEh1iBQOG:DQWMDltziE7cd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648441152, "uuid": "d95c6153-0d40-4c38-96e5-6b8924642460", "value": 1074176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648441152, "uuid": "00a61bb5-d893-44f6-8c29-0a55eee49db4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648441152, "uuid": "1f7e228d-1fa8-4e34-bcb8-f783c34dea77", "value": "IV2202055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc87ea7-aed0-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648497020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648497020, "uuid": "2cf26c11-9649-4d54-a70d-5da35ee09c32", "comment": "Malware payload (RedLineStealer)", "value": "9060b50c4d00eb3eda1d6f86510b2543", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648497020, "uuid": "a44e338d-8297-48db-9e10-53156c43842a", "comment": "Malware payload (RedLineStealer)", "value": "a7e01ef5e3aa602f27910b30a66dbc82bd0845f0148a86e4d11b6bbd6c2c994c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648497020, "uuid": "e56681f2-2bd2-43b4-965b-ed0e083bb146", "comment": "Malware payload (RedLineStealer)", "value": "8f192237e0082ab1b3877de16aa6141b73073cfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648497020, "uuid": "c5adbeef-2fae-480c-a6a3-b3e7da30b2e1", "comment": "Malware payload (RedLineStealer)", "value": "ee5de86fe6504722200658210682b33fe2184b092bb714b8d2dbf3dbce575b34d6fa3127b9ddad52328988effa64a11d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648497020, "uuid": "85ec7e58-fabb-4f7b-8fe3-37d843f7b3a2", "value": "T1D5D4237AA584FA39C05B6BFC8F1D5F6E0644D0BD28D8B70EF329070651918F5BA780E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648497020, "uuid": "abb1cdd3-9a9e-40ad-8efb-7bfe479aaf6e", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648497020, "uuid": "2f899c86-2390-4549-b79c-839d7b613058", "value": "12288:s4F+xhkf7SNJiHVNRe3F+cqYWVyQS03ULaHNqrxlKIQNogEqolY3NVzrEe0C:s44hkf51NR6x5kEaHNYK3f7oy3NVzLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648497020, "uuid": "166e35a8-fe93-455d-b09a-ec69f6bf36a2", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648497020, "uuid": "789df981-b7fd-4759-820b-a296caca184c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648497020, "uuid": "7f9410ba-de3b-4c60-9592-39e85f205046", "value": "9060b50c4d00eb3eda1d6f86510b2543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97cbac7-ae6e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1648455139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455139, "uuid": "0a89f9b1-b06f-4f53-a1a4-b171531696ef", "comment": "Malware payload (Smoke Loader)", "value": "4202ca2ff3ba0aa8383cafb402ec76ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455139, "uuid": "ab87b2b3-7cb8-4de0-9f48-df9451729cde", "comment": "Malware payload (Smoke Loader)", "value": "a820caf880ba4cb81e50891feb62ff304e0322a31141b11f3813fc477e2044e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455139, "uuid": "ecfcc248-3bb9-4eb0-a33f-2a17b82ffe6f", "comment": "Malware payload (Smoke Loader)", "value": "a7d74b5d14faee2a6bcdf87c759a260c24de29bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455139, "uuid": "f5e1562a-3506-4e5d-8c41-ac0d10429cef", "comment": "Malware payload (Smoke Loader)", "value": "500bbf50b46e5af66b94b04c3ee6d6e0128bc0f3d886d0ade6c9452fdab683adb668bf9895006c9e68d5237a2a2b21cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455139, "uuid": "03f36789-c87d-4cda-b99a-3b237c76aa75", "value": "T1E054BE123687C433ED2312746852CBB59ABBB83029655A8B3BD4166D8F352E3DF79306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455139, "uuid": "c60f5f2c-1c27-4476-ac30-449a7f4fbfdd", "value": "159dcaa804632f606b007a362cfb6cc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455139, "uuid": "cf8c093d-5624-4163-88f1-049e4efd70d6", "value": "3072:eMSdhjJY95YVj2d3tR8ggDEcUqU7Qffm6vfxWNn6Q2l:xaPdhgogcjSyfhWN6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648455139, "uuid": "d0abe38a-b572-4b23-a946-98b24babe4cd", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648455139, "uuid": "f950a87f-b205-4285-9ab4-352f0af8a18a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455139, "uuid": "86a8b90a-2ad9-43c0-9787-8d09050a91dd", "value": "4202ca2ff3ba0aa8383cafb402ec76ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ceded5-ae67-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648452144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452144, "uuid": "0bf5eb32-ac9e-497b-a88e-840f5044dd98", "comment": "Malware payload (SnakeKeylogger)", "value": "940b7a8cbda1bdeb2236ba64b4b94fc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452144, "uuid": "95a8cda0-0972-47cf-9393-982415fd4dd1", "comment": "Malware payload (SnakeKeylogger)", "value": "a83d62dd522f6d7248e3ce21eb17cd1d31c41e01d1284fa8a0ed82bb50167066", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452144, "uuid": "d45c4919-c1e8-4a68-a8fa-651f96f80b25", "comment": "Malware payload (SnakeKeylogger)", "value": "53ce9856d820000f88ca216bb105c7c96a348739", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452144, "uuid": "9a3fd6b2-2c53-41b8-ad73-06e7df81a3dc", "comment": "Malware payload (SnakeKeylogger)", "value": "8d411e52daad18161a47ad2ba5afebda06cb57b8db18a5c34fc4cc3af54246a56549b251f7010671577844ca822662f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452144, "uuid": "ff8a6192-2624-4ddf-a026-a173e5f1cf0d", "value": "T1A235F10232B16B44E07A53B5CC6584DC57797E196E3DE20F1ED132CF0AB1B869A2AF47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452144, "uuid": "94f7354e-82bb-4e09-b8e2-c87160c2f4d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452144, "uuid": "0b470fa5-15f2-49bd-9de3-1496e256ad3b", "value": "24576:EpqXpemuOX5vEfAXdWw4xwlYRZ1fRiOhG0:sm/5umewSRi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452144, "uuid": "a8e93648-54f9-46d2-906e-ab2d6a72f375", "value": 1075200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452144, "uuid": "0dc63e05-a12b-42d0-936e-cf6112047fda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452144, "uuid": "d7090c20-9126-4219-8c59-baff4ca21d2c", "value": "ice79DnGqwDUlAe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309b9adf-ae6d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648454453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454453, "uuid": "43ab115e-977d-4249-8b34-147125f5772a", "comment": "Malware payload (AgentTesla)", "value": "c2c50555ad59c413114dc3e71fdcf64c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454453, "uuid": "0f3604f5-5cbb-41c9-8bf2-d2d52018d90f", "comment": "Malware payload (AgentTesla)", "value": "a85b3b04c88279079b90d37499c66905595d463b33a8b42971cc7ccd042f5e84", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454453, "uuid": "b8bb0b2c-5686-4746-90f2-a587f03726be", "comment": "Malware payload (AgentTesla)", "value": "182f55e7b5064a5c396674ad4f98df1f0d591595", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454453, "uuid": "db4843f1-3ff1-42b0-ac8a-9153385cde77", "comment": "Malware payload (AgentTesla)", "value": "11e3924ccf25732ed9e884a3b44539e37245f3d44d230f2d3c9fed39d5353d22603fdbc53681a60c5d2a95590de4857d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454453, "uuid": "ce5e96bd-84ed-4244-b140-aa9782c3f3a7", "value": "T15C657C583250719EC467C976CDA81CECEA207C665F1FC207A053369E9A3DA9BCF146B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454453, "uuid": "9f83e8ef-65da-4680-a8ef-751c63de6cc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454453, "uuid": "195acc3c-28cb-40cd-aa84-e2e5b57d4c8b", "value": "24576:x07yIN9qOLiqaYHmpocPqafmcQqeAyItCoJX9DlzpzqUalaAr:uN9qOWqaiIyafmcPtCcff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648454453, "uuid": "8c1d3a6b-4b48-4bee-8d12-09d76311a231", "value": 1430016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648454453, "uuid": "cb9b9748-74ce-4618-8256-939db5898861", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454453, "uuid": "2503950f-be13-4bb4-aaec-f2b22b763ce8", "value": "c2c50555ad59c413114dc3e71fdcf64c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27106f9a-ae7b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648460450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460450, "uuid": "80839a88-98af-4b28-92f6-df4420448f5c", "comment": "Malware payload (Heodo)", "value": "40ca5f4a547e28594076f46818675df7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460450, "uuid": "c008e642-860a-448b-a091-1ace602f9851", "comment": "Malware payload (Heodo)", "value": "a8dcb31bcc26c7b4b9693b03f45249b3bb47bb78d2ca909fe4433f0d366d1e76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460450, "uuid": "34fe040e-573f-4ac1-b101-f15a31f0ee5d", "comment": "Malware payload (Heodo)", "value": "5cbbb7d7d9fc727396097394235b2a298e1f19dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460450, "uuid": "1d528d5c-0400-4429-b372-842cc85a7b46", "comment": "Malware payload (Heodo)", "value": "a49009aa343dcf755494a77eb6a1f6bc4bf9a7c8126880528e7dd8ca19c798282d959ef09e2e734f6449fba3db52413b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460450, "uuid": "e33d0928-3558-4a7a-aa9c-49b8911fa2ad", "value": "T1ED94CF0272D0C47AC6EF23785D239B5AA7F9FC208A75C647A751BF8D5E326C1893035A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460450, "uuid": "963d7d88-d8d6-452d-9d98-04a957009331", "value": "8f8b1cb86c6697dd342b65a36c6ccbb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460450, "uuid": "a4583b31-f8b8-402a-9ef8-8fced00cc8bc", "value": "12288:zwn2hR3547jpDMgySqxpuCMS5AhugWarPU:DRJ47xjyppuCMSqumrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648460450, "uuid": "0c2c4341-48f7-4db9-ba36-3342141e0afb", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648460450, "uuid": "0825967b-7a0e-4a88-bd03-ef40b3b2a717", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460450, "uuid": "380dd420-a975-49a6-98da-c54b6417ef9e", "value": "40ca5f4a547e28594076f46818675df7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c38706-aecc-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648495426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495426, "uuid": "44cdcbc6-8dbc-40a0-b47a-8f409573e4f5", "comment": "Malware payload (SilentBuilder)", "value": "8aabd50556cf7b58dace3375c5a6bf11", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495426, "uuid": "27662e32-3ea2-41a7-b3cf-e06a19500dc4", "comment": "Malware payload (SilentBuilder)", "value": "a91aca1916b5d2cf574bbfea582fe7704908c93b0878beb8f8b51a6eb7bc7f72", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495426, "uuid": "dc8d7936-4f77-4a2a-b5b6-268667a52319", "comment": "Malware payload (SilentBuilder)", "value": "2ca30a5f1b41d96205e59965d3bb3b0b7c96e6ba", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495426, "uuid": "77e9edac-b80d-4b1e-bea6-c8391dfef39a", "comment": "Malware payload (SilentBuilder)", "value": "78ec840d47467933e8d52c8e7be05db56e5ecd98b7f120a1c3bfa669d22985690ed10eb47e4cdb058f4c706fbe29d8c9", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495426, "uuid": "b051fbe8-7f83-467c-9672-c8eb15443da6", "value": "T16FC3AE8BB659486CE921877489DB879A7363FC354FAB47473214F3366FB94A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495426, "uuid": "24105d55-e2e2-4112-b46e-7d2803479690", "value": "3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgj3Siz+3z4Icu6hlC0:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648495426, "uuid": "ab0e7315-fc1a-4f79-8257-561d3a35264d", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648495426, "uuid": "08fe8994-9a73-4fcd-9860-4a4384c8a479", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495426, "uuid": "e9ce11cb-9aee-43ee-90cb-3787e7142368", "value": "8aabd50556cf7b58dace3375c5a6bf11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e28d3c51-ae33-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648429840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648429840, "uuid": "66dea550-4a6c-4556-8b56-465abdc10218", "comment": "Malware payload (NanoCore)", "value": "3cacce36b272ff7d87e404a58af3d473", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648429840, "uuid": "88d86c4e-24b8-4a0b-b812-25a36227a621", "comment": "Malware payload (NanoCore)", "value": "a95dc0b5b3f5c4346729e1e45c7d5d69736b273e9b5ef4187326c973d463d55c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648429840, "uuid": "0af3593b-24b3-4db9-8bd4-fa80d3c0d9ea", "comment": "Malware payload (NanoCore)", "value": "ead2d9589c7e75aeadb708d48b351c21ee021483", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648429840, "uuid": "83b50064-a923-4ef1-a2bb-59108523d766", "comment": "Malware payload (NanoCore)", "value": "d72a5b40445769b67b6e081ab0512ee8f77a64148e879a34f4fe7ff5f6a3b7954e2d3546ae65c7a263e366af8ef30c11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648429840, "uuid": "79ba22b2-8d82-4d1e-a511-bbe3ceee08f0", "value": "T19205CF0839E61038F93A8BB1CAD4FBF1DB6DF261E58970F554000E159646BBC8989EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648429840, "uuid": "3449b08e-833d-4ee9-9b6e-9346b94957b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648429840, "uuid": "24c4dbd7-3559-41c2-9b6c-f6556c32a72b", "value": "12288:jR/IKn/B7vF6U0nngcOQxJ+ovcrJ3gHPaBeX//b5L8w96qX1XwG3zsY3lWUL:JvEnaQxn0r+HPUeXtHPXJ33VX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648429840, "uuid": "39299200-0e13-48e4-8a46-c925d7c5a370", "value": 855040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648429840, "uuid": "ed94d210-4fee-4630-ade4-215474b69bb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648429840, "uuid": "f965a756-b6d1-414d-9b54-b01e0f101a1b", "value": "3cacce36b272ff7d87e404a58af3d473.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c847fa2-ae98-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1648472995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648472995, "uuid": "2bde323d-1394-4b0d-88e9-5daf8e63407d", "comment": "Malware payload (Gozi)", "value": "365a3238fe4dbc2649a8758aa810aa2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648472995, "uuid": "9d339eb2-9e9e-4de3-8495-763bf77bc6c2", "comment": "Malware payload (Gozi)", "value": "aa4fbdc5ce627bba27969922f443d27eb4c3d1937dfb28cc422f9352905ce448", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648472995, "uuid": "f192770c-a57b-4736-b0bc-6cbb3838ebbd", "comment": "Malware payload (Gozi)", "value": "7011e00c67e3909600fe7e542533dd8a2a62b9e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648472995, "uuid": "73ad2c13-189a-4a78-8e40-633495fe93e3", "comment": "Malware payload (Gozi)", "value": "a6b9b1800303408b886bf9de6ee16d1941316f3f05252ce9404b20c3e2de83aeec409a32ea9b028375bfdf063d059708", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648472995, "uuid": "5ca5e0c4-aa99-4a08-9915-1ef0b0b18431", "value": "T123448E5AA3E50D95E9BBC5B9CD93D217E7F234091A64D34F52B4CE962F03362B22C342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648472995, "uuid": "3ff9727e-bbda-4c72-ac65-98acec914eae", "value": "6144:8jOc9lLYJm9qCR8h2O1CCP1GzzBpbf7FWtM55YKMu:839VYJj0g2eCCP1GzzT7FWtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648472995, "uuid": "d5bce29a-b84b-4b61-93ce-33f8964211d9", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648472995, "uuid": "4e11f669-8bb7-4790-a309-c1c897236530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648472995, "uuid": "195c004e-7277-42ad-aecb-a9e3159e2696", "value": "11410000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb0e3dc-ae2a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648425863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648425863, "uuid": "e43045c9-5eb6-4533-af6d-9b2701a9c85a", "comment": "Malware payload (Heodo)", "value": "038bbd990bae0dba427ff1208b2b72b3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648425863, "uuid": "80cedef2-fe39-4c53-b66b-ec77143283ef", "comment": "Malware payload (Heodo)", "value": "aab6461edafe049be648c2af29a0fb7f88d41b6dce46757d3650fad6207fb751", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648425863, "uuid": "6ef4cfac-67e1-4deb-9f3e-a505a3f1f0cb", "comment": "Malware payload (Heodo)", "value": "a48103f575528af085b79fe36072a81c12777db1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648425863, "uuid": "97d8e15a-297b-4dfa-8f6c-133024de3cc8", "comment": "Malware payload (Heodo)", "value": "96e339e3760114500694066ffd5c62acb03261d76f2199569d717c0ee5eeaf69bc83fd61e000c673d9a47ee83ac8efa8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648425863, "uuid": "b7dc0207-c16b-48cd-b419-f01f1b5e5b45", "value": "T188E49E1177D0C072C2BF3630551AA3B566EABC708DB9860B6FD42A7E2E745829D3871F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648425863, "uuid": "b28b6821-929d-4be8-ae28-75a7efa7e816", "value": "923a5ec702466ffd61b422bacc94c6f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648425863, "uuid": "3184bb8c-23ca-485e-a1f7-81175550a2bb", "value": "12288:JSycC8Tu2EEAeClIHRFa7UdUzrAKZtI8X0oXYl2N17OP:JSDD7RDhH3dUfttj0oXYl+OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648425863, "uuid": "9536a34c-4131-4f37-b387-005aaa34006a", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648425863, "uuid": "f01542b3-fc24-47d8-9cce-724792a3c656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648425863, "uuid": "3f0788f1-7c85-443e-b0ce-e06e9daa26b3", "value": "emotet_exe_e4_aab6461edafe049be648c2af29a0fb7f88d41b6dce46757d3650fad6207fb751_2022-03-28__000417.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29490640-aec2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648490948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490948, "uuid": "b01e0104-62b8-4877-9183-98f25f4ea39e", "comment": "Malware payload (Loki)", "value": "f2bf3c03b631e942a7e06f99766007da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490948, "uuid": "a108fa3e-ae2c-4e0c-b53c-c8d836f3981a", "comment": "Malware payload (Loki)", "value": "abeb988f764df02f697a0bc06cd2ea67c051424ef955573ddd267b54433cfba6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490948, "uuid": "e615b093-0049-41d5-ac78-394dbf42767e", "comment": "Malware payload (Loki)", "value": "abfc461669fa528de26836a29dccffbeddf1f406", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490948, "uuid": "3da69339-f120-4382-9d5d-b915dc2ae49e", "comment": "Malware payload (Loki)", "value": "03970350e08cde20af8693591d0b2eba4c3e432a458e420cd40af6a7b74803030bcff49386d52f3a12695fe886702987", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490948, "uuid": "06c9fc40-e54e-46b4-9183-0efd57a33a7f", "value": "T156259DE229FF401DF377ABB12FC8F8CE996AEA63151A30D711911B768523A80CD61735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490948, "uuid": "d81fe83d-c93a-49dc-80e9-cf225a3136ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490948, "uuid": "ad49c739-f786-4440-9014-f1ba6f3e3880", "value": "24576:AD5k6OPOTjqeH4lZb03uKKg1kK9rGcDMaC/62Mjyf:AD5k6pKeHiZQS639rGcDMy2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648490948, "uuid": "49d08e85-5af6-4d10-88ce-d37e90f2b4a7", "value": 994816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648490948, "uuid": "b776f3ad-6efd-4075-8d56-ca13710398ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490948, "uuid": "8c1fc103-45c7-4f62-95b3-f7019f4beb32", "value": "rev_shipdocs0102022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c856f6ba-ae68-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648452560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452560, "uuid": "3b27b941-eab9-4820-a50a-440f4cb87fce", "comment": "Malware payload", "value": "7860eec7d4f0eab200e40afbe16dc9c7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452560, "uuid": "714ba1f1-4af5-4f20-be60-13aa982dbd7c", "comment": "Malware payload", "value": "ac456d7ae2465d0c48b1dfb2a76e89a4200f3768ba5982094b09276010d4b7cc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452560, "uuid": "1b29680e-b99c-4771-b01c-0540a79cee32", "comment": "Malware payload", "value": "50fb8a9b5f4d55e4a9bcc2114e47bae864868cdf", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452560, "uuid": "460fb75c-3ef6-45e2-a93a-e0bb2574912d", "comment": "Malware payload", "value": "13f6f16b337226af7b5145c3b14c246528223dd170259c16db0b86a9d4b8797542a9f19790e02013a96d6be5f196940a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452560, "uuid": "1018f361-b943-4e8b-98f6-ebb6d21f037d", "value": "T1079558F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E5651EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452560, "uuid": "a4acb3a0-9479-4274-a641-07ebe94edfda", "value": "12288:SYJCrqwpoHjm3m1rWngdzFu90qHW31Hk3zVcIJMDLm:t0qSoHjm3m0gv3qHMkDWIJMDLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452560, "uuid": "8f8069f2-0dbb-467c-88c9-6c79af0c0815", "value": 1946173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452560, "uuid": "9ab24949-4e51-4735-be87-4fb3832eee49", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452560, "uuid": "d9e23318-fb2a-486c-b9ae-278979e67fb8", "value": "Statement .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a17aa28-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448160, "uuid": "819cd00f-15ea-4f4c-9ffb-ebdbe342b915", "comment": "Malware payload (Stop)", "value": "acf460d50f3feae3182de833d9c9024c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448160, "uuid": "1acb1633-e75e-47b4-ae54-a6d1aa6557aa", "comment": "Malware payload (Stop)", "value": "ad6a09d69bd7b57c329336a6ea486acd2c7c275e2a6a9703d95a93fd5fc0070b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448160, "uuid": "454b7f6f-7b6c-4487-8b7a-2665cbde8915", "comment": "Malware payload (Stop)", "value": "a6f8c3c86272f399c3ffcff3cabcc0a5bb9af11f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448160, "uuid": "f0496ef1-70b8-4866-8cdc-136db22c07fc", "comment": "Malware payload (Stop)", "value": "4785befb7a64f41d231abfb9be43842a435cf9398cf398b214fdf94fdb41affae8e4949e136f4f932d2a05531d76b0df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448160, "uuid": "73349f92-1c10-43a6-9805-4865d7997349", "value": "T199050200B790C039F1F746F54AB9937CA52E79A09B2590CB32D52AEE5635BE0ED3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448160, "uuid": "94d326fa-d06b-4301-9d64-ad760a2d8d70", "value": "7288d715a9ee18d7dad5b71be8ad934b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448160, "uuid": "f1004343-086c-438b-8d59-e2912f00d185", "value": "12288:htCjm+9Sy7HHGIoVHF40YZ8wQhfgASJ4+vHa92:ybYdIM4vedsK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448160, "uuid": "81bf089c-3abc-407a-8535-366f92dccd7f", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448160, "uuid": "ae7c09ba-a941-4e03-a96a-cfbd0b640fb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448160, "uuid": "26d0aa52-fbdd-41cf-89df-19133c328f62", "value": "ad6a09d69bd7b57c329336a6ea486acd2c7c275e2a6a9703d95a93fd5fc0070b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092d2019-ae8e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1648468560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468560, "uuid": "6aca7cf1-b8ad-473a-8c82-4fbc5bdcbc46", "comment": "Malware payload (Quakbot)", "value": "a5d366000c70d4ce52cd53d844bc561c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468560, "uuid": "8a16cbc5-1213-4a56-8acb-a80a9ba79c0b", "comment": "Malware payload (Quakbot)", "value": "ad76026c3c59294e4d3ccfb18c1d1f1e4d17bfc304b82607de370121fc716394", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468560, "uuid": "9b561df0-0533-4f51-bb94-a96e12223ac9", "comment": "Malware payload (Quakbot)", "value": "f4c7de77a63e59127e83cfee35a16529ec4894ea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468560, "uuid": "c62a8a4d-d14d-47a7-8a08-19d0901edb69", "comment": "Malware payload (Quakbot)", "value": "4bc300348830b17c35c45fe097d645c8cc4d27fe35fd7c528999e30e5c9df2be54a4c57110ba65293bf526c17d676a70", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468560, "uuid": "16a4cb72-20d2-4615-8436-b8fa7a6e9781", "value": "T17DA4C0B976043DD6E52E467BDE96ACDC13B61763DAC7D4C980A477C306A3371EE0280A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468560, "uuid": "99fe0af9-548e-45cd-91ac-6dafe497f9b3", "value": "d2e55687d0da61f27b29b4c4cf28df38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468560, "uuid": "048fbdec-52cc-458c-871d-84b9d2cf0ff1", "value": "12288:B0zo5wP349Ps7Wq/p/rzHzLCKiNIyoHho+AlGmTa:BMoyf7/rzfCKiLTlGmTa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648468560, "uuid": "a5a8e835-0e75-45ed-b56a-9c10918a4e21", "value": 459760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648468560, "uuid": "6dd897e9-f456-4655-8d64-f5609fe0a7a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468560, "uuid": "7d34fcbe-518f-4132-8631-209257d11740", "value": "44648,6101579861.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d21c903-ae68-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648452407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452407, "uuid": "27455059-9777-46d3-9ef6-dfb1d94c3904", "comment": "Malware payload (SnakeKeylogger)", "value": "1bafc919555922a521ad1268333a37d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452407, "uuid": "18e1a93f-65ba-42cf-b197-194a6e2f2f4e", "comment": "Malware payload (SnakeKeylogger)", "value": "aeab503c3cd3b3d5206ba0ae473f62901a5e0a2f5ac342317b575d625d8061cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452407, "uuid": "e90eda5c-43d9-476f-9bf7-87e0f51e7571", "comment": "Malware payload (SnakeKeylogger)", "value": "a19314b612cf755e278a52ec3c09b72926f948d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452407, "uuid": "759fa8e1-3231-408f-bfb4-6fedae8787c5", "comment": "Malware payload (SnakeKeylogger)", "value": "acacc3dcee7f37661f02804e87cde2ae28a2735c527af709547d9265136b36657a4563f780851c0adff1897e32c1dea1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452407, "uuid": "da27e15d-0982-4623-8b08-ad3e320b88fa", "value": "T1B7B24F159298C665C9E6C63D5CF271FC4673BE03CC32A69BD4C5FF0D79322400A91A69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452407, "uuid": "bd8e9d15-5dff-4d3f-9cb6-a53cd1aa8d2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452407, "uuid": "bdb3b89d-6a75-47cd-a89e-f5dc7850003b", "value": "96:5xmRsJbcP7HvcHvtmJjFmzV5pH7yweR6mepHNQWshSVBax92qyzNt:5vbcP7cHvwJjKpbyT6DrQf6ax92q0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452407, "uuid": "3b03b298-a406-4284-895b-157b9fffac9d", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452407, "uuid": "6e98b629-6f63-45d2-9622-d8a16f9ea723", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452407, "uuid": "34125fa4-a909-42eb-90e9-c1a31560e0c6", "value": "Doc001307852000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e98f90-ae42-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648436158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648436158, "uuid": "eb3cbf82-01fb-4fa5-a9fc-4deee530c805", "comment": "Malware payload (RedLineStealer)", "value": "9c8c322d34032ac592f08454ca0dfed7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648436158, "uuid": "138774cf-e8de-4cd4-81e4-308cb94502d3", "comment": "Malware payload (RedLineStealer)", "value": "aed0d35fe387f68070bb711b510c723876208a4adf77a8d8613252943967dd14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648436158, "uuid": "4df17922-b297-44cb-a475-403034dbd6ef", "comment": "Malware payload (RedLineStealer)", "value": "900d2470f3fbe8e9508552f3811f1c367fc82e3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648436158, "uuid": "7f60da29-6756-4bb7-8d4e-d09b866958fa", "comment": "Malware payload (RedLineStealer)", "value": "54aa35085dab611c18e6af09ec2cbb6db6c239eb560842d412a5239a405b28573f5d99e3a0eb3eb55e19f598d1ff9d92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648436158, "uuid": "3dbb9572-7f20-4835-8f84-e513b43b1478", "value": "T1C1D423AE0718F9CCE6DCD8F09C72B9A2EE2210726368435BD7790E158B4F2E5D52D41E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648436158, "uuid": "0cca8ca6-44af-48cf-baac-fefff1418407", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648436158, "uuid": "6ed2082e-cda8-41cc-a632-c154efe78467", "value": "12288:iAb/uf1/dns2nrGtkqhpVrgYJLQS03ULaHNqrxlKIQNoGi8zRgW4h2m+:T/uC2nrGtlhDrgY9kEaHNYK3lzRgWsB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648436158, "uuid": "33936cba-515e-486c-898c-f7f262e1b546", "value": 609280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648436158, "uuid": "0574b761-cd37-474f-b8ac-02c53463e721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648436158, "uuid": "91d50e25-a532-4b5c-a265-5232ccda07cc", "value": "9c8c322d34032ac592f08454ca0dfed7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8569dab-aebd-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648489121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489121, "uuid": "6d831413-6d8b-4907-a720-0eb31e155d6a", "comment": "Malware payload (AgentTesla)", "value": "c00254fdcafb3a44e4a25f11548d53e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489121, "uuid": "12082d2e-b93b-44ea-b887-438cfef56daf", "comment": "Malware payload (AgentTesla)", "value": "aefcc5d5448a3fc16f8a0aacd92994424efd650ae9d48bb24006bd254a828c8b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489121, "uuid": "3844c771-c7af-4c1d-8f40-bb216d44f5a7", "comment": "Malware payload (AgentTesla)", "value": "f4422d682dce86361058d94c20e1c5567fbc2005", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489121, "uuid": "251328db-ce6a-437b-ae24-1fcc359cedd3", "comment": "Malware payload (AgentTesla)", "value": "f63a35968fe654ad0f6008eef64397e4119fd96a63f0319a346cfb2a26236afb86c1c85bef69f4fee501a3479bffd88e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489121, "uuid": "057cc448-cc5b-41df-8b1f-5c288a508c29", "value": "T1B9C45E5C7A055A62FDCE993249012A14FF6E0B2332B0F9C657CB16CBCB4F4966D16F88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489121, "uuid": "cbfa8a47-18cf-4c35-a8ff-c3f89aac85b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489121, "uuid": "569fe586-a88e-44d6-b6ef-7d559b2657f9", "value": "6144:RGSsrnUb33Gf72clWYyf+z8T6Qfr5D6SK3T7/PeIaLtthEu5:RdIUb31clWYyfSQISKD7eI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648489121, "uuid": "af846571-52a8-4dda-a184-f943ece2b38e", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648489121, "uuid": "dc8dc0f7-19fe-4924-b74a-cbe1b545ff51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489121, "uuid": "5e5e749d-18b9-4cdc-b308-7b411c4dc9a6", "value": "MV. Ever Brilliant - SHIP PARTICULARS.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84428cbf-ae8d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1648468337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468337, "uuid": "7f57d951-f838-4afd-8c6d-bfec617a0cf0", "comment": "Malware payload (Quakbot)", "value": "f19461e1271567f0784c5fd3faafc18a", "object_relation": "md5", "Tag": [ { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468337, "uuid": "19b80451-474d-4adf-852b-70af0c59560f", "comment": "Malware payload (Quakbot)", "value": "afcb7a53d2dd39ad16c4d3afbb1ce1620079d48817da18edb2b38219569b86f2", "object_relation": "sha256", "Tag": [ { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468337, "uuid": "0a3a6c50-920d-4ce8-84bb-cc07ead5ec57", "comment": "Malware payload (Quakbot)", "value": "aa0bd3caf52c3dcded920a7373512f22e68d39db", "object_relation": "sha1", "Tag": [ { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468337, "uuid": "5afce457-e045-4e75-bf32-ef00ebe09cc6", "comment": "Malware payload (Quakbot)", "value": "dd972da0b8f04984aaf9ca35a9b80f8f052d9dfecfdfe02de3ca0eddaf7cfe7cf19e575ea54d4d0b395362048aa77bff", "object_relation": "sha3-384", "Tag": [ { "name": "obama171", "colour": "#31C92A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468337, "uuid": "67d0924e-acbe-4e9a-8551-ba5eae1de6c5", "value": "T1D045122599B4A857DEEF4635500841F2EB1429B76FF0963C1D9E7FE628720B2C3E7068", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468337, "uuid": "1a89091e-a040-4470-b8e5-9e6eecba1467", "value": "24576:ypCBgZuLFjAEeOUJCDIxBhIz8FhpCBgZuLFjtpCBgZuLFja:ypCuZ2jAGUJCDcBCipCuZ2jtpCuZ2ja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648468337, "uuid": "66de7b2c-426b-4716-a2b2-a7aece844671", "value": 1264733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648468337, "uuid": "552db688-8d34-4458-88ab-aed0547625c1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468337, "uuid": "93651e27-b9b4-4af5-ac37-095039d11953", "value": "NFT-2103917571-Mar-28.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29bd1b6-ae60-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648449087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648449087, "uuid": "49d5bccc-9849-4213-8629-8eda85647d92", "comment": "Malware payload (NanoCore)", "value": "6c335c5adb8e31f5814028b4bacf0736", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648449087, "uuid": "43e16de9-9608-47d2-9a73-aa79d727c8b6", "comment": "Malware payload (NanoCore)", "value": "afcbb1b51f1b0d501f332a18bebc6f34200ccbfd1ec8c9c88b8db5c09c6d28e7", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648449087, "uuid": "9fe6de61-079e-4b96-9ade-8cd30f7ce9a9", "comment": "Malware payload (NanoCore)", "value": "5c68567eef0d0ee1dd9f1362feabb8912c23e5e9", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648449087, "uuid": "7549a4b3-a2df-41f4-a470-7d5af2748c3f", "comment": "Malware payload (NanoCore)", "value": "e6acdebb202b72c092c58ce86ab67902cd43d9b36aec66b9470f621e2fd3b21139f18b27ff6f777f0ee826444b2eca97", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648449087, "uuid": "1629b553-8d2a-43f7-8814-54ecbbcbbb71", "value": "T11EB4238003C19F3F7B0599BC415E8E82A3A39E775F0E19B5136FE0C9215D27B99B9392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648449087, "uuid": "75dddfb8-b6f6-4b17-b0b5-a1187bb899c8", "value": "12288:hI44M2yeGq7seT/i4OY3CKmOjuWSWFxNYKynC36l6:hB4ZDGqweT3OY3DVjPSKYK0x6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648449087, "uuid": "13deb7cc-0b5f-41a4-ab28-d0a0e1bc7562", "value": 505580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648449087, "uuid": "64ef45d6-3408-4165-badd-72619ef7c046", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648449087, "uuid": "0fa27311-b4bd-4952-a349-7d16fbfa7fd2", "value": "6c335c5adb8e31f5814028b4bacf0736", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78397ef6-ae4f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648441688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648441688, "uuid": "6c8b2859-c81f-4d97-b5d0-58e96a148306", "comment": "Malware payload (SnakeKeylogger)", "value": "14647a3184c02e836291d7370c2b826c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648441688, "uuid": "406b8c5f-e04b-48c5-b496-f6fa4cf30501", "comment": "Malware payload (SnakeKeylogger)", "value": "afe482e8b31cdab9fc20bbe3c2e39bac17c4c98a71e89ca57439ca9dd0f0249e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648441688, "uuid": "5fce4d70-a81e-484b-8b3a-a88c879df278", "comment": "Malware payload (SnakeKeylogger)", "value": "8ae85ae451d45ea1dfc13aa3d425df41d4819545", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648441688, "uuid": "4bff3b0a-2ef0-491b-a62e-1df9b892809b", "comment": "Malware payload (SnakeKeylogger)", "value": "d6c4313f1be37392ed19952fb6725d493ca460c7aa44a8395a47e6b7e171fd205ac5a4f884c53165739f5259c5c8f521", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648441688, "uuid": "70ed6ed5-04ed-4d30-a4ca-a5515c1c969f", "value": "T15635F10136A05799E07A93BADC6844DC57707E1A6D7DE21F1EC236CF0EB07818A2AF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648441688, "uuid": "f906003a-07bb-4ad3-98a7-a9e2a6c925b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648441688, "uuid": "4692e5c7-2472-4239-b6b7-7402d46bc169", "value": "24576:7pKhGhd3tDNb2fP+Od6MjPWx3OyuWmdDmx5aaIW:rDMfP37DqOyuWIDmitW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648441688, "uuid": "c01ae980-4a73-4315-a02c-c7908d0547a4", "value": 1084928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648441688, "uuid": "b8f78868-7420-4b5a-a736-afa8de694912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648441688, "uuid": "2fb6e06e-6d46-466e-b84b-1ac0a7cabc43", "value": "583953_03_28_2022,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b1ca11-ae74-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648457714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457714, "uuid": "0faec4ff-e377-44ef-b64e-ae3812d8837c", "comment": "Malware payload (Heodo)", "value": "1c8de48241756c6d359618bab27380f8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457714, "uuid": "8535728f-6760-4d13-865d-c40cb9079f8b", "comment": "Malware payload (Heodo)", "value": "b0122257e45a98eaac30a4180633f52c821623d8f19a4daca7d6b795e9b9bdca", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457714, "uuid": "6ffa79ea-dda4-4906-8171-b71bceea6058", "comment": "Malware payload (Heodo)", "value": "98ff8d2d1f3ff1843d1007ea629e98c4a65c2bcb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457714, "uuid": "a25f2559-dbb3-4b6b-997a-fa8c04ec0646", "comment": "Malware payload (Heodo)", "value": "8f9f8f6b069bbb14bd8b3568b83be725b910bdf41d0f1529f1cee4e3134042663be99ef7c7505c7442d8ccd5b8bb5f02", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457714, "uuid": "fc1b655f-4f8e-4552-84ab-5ba8923deb5b", "value": "T1EDB44C22E151E0B4C21744360607737DE60FADF01B95B277A3B015AFBAB5E71EE26326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457714, "uuid": "53b618e1-b7c9-48ca-a3dd-4775d9777e23", "value": "c354d2e1bcc359dcb00a22865c038d4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457714, "uuid": "02cb3c61-32e1-4e0d-8f1d-e1fe656bd67a", "value": "6144:TMhEi6lq1EvTzbQJqnoibRcJQfTf2ZsIhzED5TJycXo3ZqdK/J:hFGibRYQrqkoko3od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648457714, "uuid": "4523e33b-9039-4850-bee1-36a93e344106", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648457714, "uuid": "5d47b08b-d1a2-4003-b2cf-508bc1619a56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457714, "uuid": "22f917c6-7629-47a0-9cd9-cf7a6bc76ee8", "value": "emotet_exe_e5_b0122257e45a98eaac30a4180633f52c821623d8f19a4daca7d6b795e9b9bdca_2022-03-28__085501.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fccc589b-ae2a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648426019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648426019, "uuid": "f50b3420-5798-465d-bb37-9617c72b9e24", "comment": "Malware payload (Heodo)", "value": "afdeec9dabca10b1f4a5d90486dc5545", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648426019, "uuid": "e45ec299-85b3-4f02-bcc7-e7c2698bf253", "comment": "Malware payload (Heodo)", "value": "b090299b000da78a8c82d7dbaabc0abe27322766ee6cb92b021a5835ead1330e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648426019, "uuid": "27c43042-ad0b-42f3-aadd-22bf93c94a02", "comment": "Malware payload (Heodo)", "value": "f7b35325ce08f2780f01512d6daeddddb3e43e5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648426019, "uuid": "354905c9-7386-4c99-a62e-8b29acabe8e7", "comment": "Malware payload (Heodo)", "value": "a5b719e7db0fe67dff06e22a0f41c03158a14c517f886858e3af8e575a94935dd873c942fd62a763ddce79a3b4434b04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648426019, "uuid": "fabcccb0-58a1-4dbc-8640-1db58641d302", "value": "T1CEE49E1177D0C072C2BF3630551AA3B566EABC708DB9860B6FD42A7E2E745829D3871F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648426019, "uuid": "56c9134e-87db-4779-970b-eb70ed389650", "value": "923a5ec702466ffd61b422bacc94c6f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648426019, "uuid": "3211fa66-bf4d-4414-8ac5-9197e014e5d0", "value": "12288:JSycC8Tu2EEAeClIHRFa7UdUzrAKTtI8X0oXYl2N17OP:JSDD7RDhH3dUf/tj0oXYl+OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648426019, "uuid": "8cb58b4d-fbee-4e82-813e-2a284c5454d3", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648426019, "uuid": "9d112c12-ad12-4dfc-b1ec-93725b9d4a89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648426019, "uuid": "0d403ae4-8433-40df-a076-b48592b004ef", "value": "afdeec9dabca10b1f4a5d90486dc5545", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d1762c-ae88-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648466118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466118, "uuid": "74cf9135-2d12-4c89-8e15-40cdd9ec3448", "comment": "Malware payload (Heodo)", "value": "0e876cb9c7969b8ed23a995fa47a78b9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466118, "uuid": "12b11206-274b-4393-8797-815d90b6acb6", "comment": "Malware payload (Heodo)", "value": "b16b4ed33199ea8da417c36c2fcd687306f7f01aba036d39ce77912466e7f8c6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466118, "uuid": "3ac3f668-a23b-46f6-b311-0b3603bbee76", "comment": "Malware payload (Heodo)", "value": "38a70eed2ec865600e8478f7e8c63f114151ca42", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466118, "uuid": "7059da33-a96b-4f38-b371-799b8865b775", "comment": "Malware payload (Heodo)", "value": "b2c5ada0be473a5ee500f566d381591cc209310a7e0d3852f09a46228e54e5471542b0c0f8371671edaf35f52e518278", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466118, "uuid": "27a4dc22-1a02-4f09-b38e-043f875ff172", "value": "T16C94CF0272D0C47AC6EF23785D239B5AA7F9FC208A75C647A751BF8D5E326C1893035A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466118, "uuid": "4b22fc2b-076b-42f0-9786-b69845b98375", "value": "8f8b1cb86c6697dd342b65a36c6ccbb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466118, "uuid": "0a725e4f-7fa6-4bf5-a50a-89b5d05c6755", "value": "12288:zwn2hR3547jpDMgySbxpuCMS5AhugWarPU:DRJ47xjy0puCMSqumrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648466118, "uuid": "28909832-835a-467b-ae48-dec82037e00d", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648466118, "uuid": "f7894594-76d0-4423-a228-b98894bfaa79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466118, "uuid": "8bfbcf24-ef75-4e91-a24f-4927c6c17a85", "value": "S19a6RyyWCAHQukgQNFA76IS.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37605e7-ae75-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648458108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648458108, "uuid": "05bc9fd0-6629-4d95-9581-bfbd5e10c376", "comment": "Malware payload (Formbook)", "value": "ef3ef5bdd537965f91ce11672b28f838", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648458108, "uuid": "0922dd02-c2e3-4d34-b738-a05c6ba01076", "comment": "Malware payload (Formbook)", "value": "b2f9d174c3713e66dbb9caa157c134179d8e61f1f94d555df273e526120eda69", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648458108, "uuid": "53640369-c76d-40bc-900f-38864c3cf99b", "comment": "Malware payload (Formbook)", "value": "85fc8370fe69b465bd59c92ea3f70031680d08ad", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648458108, "uuid": "3731148a-a033-4a1c-b8c1-45e1873ae5df", "comment": "Malware payload (Formbook)", "value": "d406ed42cfd410bad101c2cb3f5fe7952ffde52049700ebfce47c86329889154bfd06c31732fb46e6afded63c7fa624f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648458108, "uuid": "f1c2d16d-afb6-4f43-8b79-c8d9207131e3", "value": "T12884239417CFE1285B3CA0EC1CA58370A654AAF5030F49FA94DC1C45CA9ADD86AC6ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648458108, "uuid": "b41abd42-32a2-42c1-b30d-fd8ec813105f", "value": "6144:c1YJYZx85fAcFPsTD+jCR8KCUUESaJIWZwD5nvA0FwZdBxdbenu7EGGB4sFM:4YOZx859JsuyzA5vAcaJbULGuvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648458108, "uuid": "a61fd584-e394-4639-bfb3-cc935bfa90bd", "value": 400278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648458108, "uuid": "b5df47e3-85ec-42e2-9f3e-b560191fc01c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648458108, "uuid": "c638c3f4-5969-465c-9dc4-e30de198b12d", "value": "BOQ and MEP WORKS.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588fe5f4-ae8f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1648469123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469123, "uuid": "4db54edb-ad43-451c-a431-38abdb809ec3", "comment": "Malware payload (Gozi)", "value": "c6b66579fd7511dc5558c897c337eb47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469123, "uuid": "9ef17942-fd3b-4f17-8bda-e14480bfa762", "comment": "Malware payload (Gozi)", "value": "b35bf7bd519e05bccf756bf1d1c038837be25283642d6d4d873d7a5820dbeab9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469123, "uuid": "10a5257b-0673-4c4e-9b01-5c5602111dac", "comment": "Malware payload (Gozi)", "value": "c9b3bcfea4ff6e1a96dd4a0cc838e50fb7498f10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469123, "uuid": "6affab2e-80d7-49e2-8038-381994c4750f", "comment": "Malware payload (Gozi)", "value": "2e63fcd6110166dfe965e70b1cce1e8e7637cbcb360580124e6e5d9455caafd102c3c61d89430a30198500575fb98f00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648469123, "uuid": "78c8c4ab-82f2-491a-8276-396eb0952248", "value": "T163447E5AA3E50D95E9BBC5B9CD93D217E7F234091A60D34F52B4CE966F03362B22C342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648469123, "uuid": "d6ca34fc-2386-4208-a329-aa0c95b43947", "value": "6144:8jOc9lLYJm9qCR8h2O1CCP1GzzBpbf7FWtM55aKMu:839VYJj0g2eCCP1GzzT7FWts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648469123, "uuid": "fa908503-f152-47e3-8b22-3a5d2f2e5dc2", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648469123, "uuid": "fb50f7fd-460e-406c-9a1c-18f315fce8e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648469123, "uuid": "32b64011-258c-4962-a786-ced728deb0ef", "value": "1f277c30000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60be846-ae4b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1648440047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648440047, "uuid": "e61e1c09-7817-47c1-8497-159e5e621d58", "comment": "Malware payload (AsyncRAT)", "value": "7619f3bf412f68ce1449545c814fb097", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648440047, "uuid": "6efc1d3f-5095-49d0-9e8f-59b10e3a5820", "comment": "Malware payload (AsyncRAT)", "value": "b391b28e6eeb24283524da11d8126873d55241bb49f506955b07b39712bb1616", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648440047, "uuid": "a9a2ed60-e688-42f5-914b-3cafa3959189", "comment": "Malware payload (AsyncRAT)", "value": "5c310f794eb84d6bbddf7a2529ac6c78fcc0d0b3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648440047, "uuid": "3d7dde95-1aff-4c91-a8ba-a9df7a067d92", "comment": "Malware payload (AsyncRAT)", "value": "658b190165d2455769ea6e03f08c4ab53374d5dd16898cc9f3adbe12ec852051d2a0b96263af61e15a54342f3ce9ea05", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648440047, "uuid": "a8c1ee87-be62-4763-9f5d-8a92007b0bda", "value": "T1CAC1B61163E85B3AEEB78B727D7342400671F761ED67CB6C29D4910F6D136004663B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648440047, "uuid": "2f2ef7e8-b28e-45bb-876b-e707a41d39bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648440047, "uuid": "f3fb34fe-868a-4030-a43b-4ed1e87b06bb", "value": "48:6/4vTgXiAf4sBgZVNM94i0MLdn6XVY38PPyyGWitQq2ecEnSDzlXEFLMFEXFqpfG:SvYu4i0dyLtQwulWLO3zNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648440047, "uuid": "6b9973a1-8c26-411c-8767-a1743a6c4afa", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648440047, "uuid": "a92eb3c2-e93b-4711-87ba-a79dbda33320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648440047, "uuid": "c21a864e-51ab-43fc-8632-1ac067f69e74", "value": "ecua.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125a4fb8-aec2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648490909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490909, "uuid": "afb1aec7-9dbe-40c4-b934-39c79c599361", "comment": "Malware payload (Loki)", "value": "777759775aa77bf0d96440d543ccf18b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490909, "uuid": "deb834f9-a277-4aef-98fe-458a65109da2", "comment": "Malware payload (Loki)", "value": "b392732e333e4ac15c22471870011f25f495371419a25375ca65c3f51999bb90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490909, "uuid": "4f96f37e-375f-4360-80de-899d81758075", "comment": "Malware payload (Loki)", "value": "3627e8c8a69176edbdb494106aa0711c6827bbcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490909, "uuid": "2a9565a0-89c9-4b33-be2d-c27b2510debc", "comment": "Malware payload (Loki)", "value": "0251e9f9825d44e518b8897d14d757f7ec1ebcfed69b5d285aeff4453d0c5b3e883c76e1581ae119f52a04662c0acf71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490909, "uuid": "ddc6a61a-230f-4b46-b4d4-d5bdc5c06988", "value": "T17F54120B7FA4592FEF9209311AB9B7F1E7B6E65040AB27531BF02C3B3851FC2942455A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490909, "uuid": "073e0f0b-6ba4-49a5-9079-134a58538067", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490909, "uuid": "0b90ce3b-1d12-4b3b-b1b4-9b1616f8f215", "value": "6144:rGi4YUEu+hLwN/8kbsuChYa9UExE49PEAbwfT6RvVL:BRwtHQz9UIPVbwfTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648490909, "uuid": "3635e0e4-0114-4489-b7c7-3d004c730d13", "value": 301839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648490909, "uuid": "2db4a9d7-5ed8-4ee2-84ec-48d5ad308c6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490909, "uuid": "bdd62321-e3d0-4bba-9613-444d1f672b35", "value": "Seatrade_MV JinJia_INV233.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce76e25-aed6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648499597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648499597, "uuid": "3d2c06a4-939f-4cbf-b7fd-24b2ebc4e625", "comment": "Malware payload (Loki)", "value": "f34c52161ed210ff3698f97856061187", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648499597, "uuid": "2d955f04-f0af-43ce-8d40-3781a7d3f66d", "comment": "Malware payload (Loki)", "value": "b3e25b1b1963dfea97cea3a74796b6363e4692bea51e709e6b1701ab5c851cd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648499597, "uuid": "0d787f13-f41d-4940-acfb-da54be1fe1b2", "comment": "Malware payload (Loki)", "value": "dbe1bf878ff0575fb74ed6f609e965605d00d506", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648499597, "uuid": "2167fed6-cdc8-4a68-b016-9063dbf7c060", "comment": "Malware payload (Loki)", "value": "b58f92066b4d2848e5cabe14cb5673555ce76b9da521706a1366dd450e071e4b738ef231402b0938d4562fabd148ad17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648499597, "uuid": "f93cdab7-e408-4092-9837-4b9a97983f5b", "value": "T17634124FADF29AE3C41604390FB2EA7DC77992C08533BD978B286F76A3711C74606249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648499597, "uuid": "b5c46e0c-0e25-4fbc-8a11-006639e748b3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648499597, "uuid": "bcff1a98-3832-4626-851c-e4aaaad331a5", "value": "6144:rGihpdn4pUsU3tCdWbVLUnmfuXeb+kzVkl:2pUV8ULUmf9+Uql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648499597, "uuid": "a4a60575-c468-4c9f-b483-010b7689c72f", "value": 241552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648499597, "uuid": "3d6fb0d2-cd10-42cb-aed9-4d49af87843e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648499597, "uuid": "7e418434-8d43-4c7b-86d7-8f1ddaa53336", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d6eb29-ae98-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648473170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473170, "uuid": "3a1a0ec0-a9f2-496c-9f89-eb9557571a04", "comment": "Malware payload (Heodo)", "value": "3dd4782de59306c2868fbad1b6fe3b18", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473170, "uuid": "977b8663-beb6-4efa-8307-38dcb219fd18", "comment": "Malware payload (Heodo)", "value": "b441c479246bf5b5f75f06f343745a24cdf5651710700a4807bc674d74d17580", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473170, "uuid": "5da84b2b-23d5-4a2e-8dea-d8e067da2d0d", "comment": "Malware payload (Heodo)", "value": "2f8b0f988ca5a028d235f3f2691f76fddf7d887d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473170, "uuid": "c225fd2d-88be-4c7f-a204-a31eb919cb3e", "comment": "Malware payload (Heodo)", "value": "9620d47b12cb791e79566d60812dfe3f28fe64a077014fb55f5d015dfc97e77d6a0cf7cc6455a5986c1322972850a414", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473170, "uuid": "95006882-4fac-46ee-8fcb-50d0eea276d1", "value": "T197D4623D2FAE4062D8661770145C0FE891ABCE25BB2255FF25842E2E2EB57C74879F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473170, "uuid": "700dbcf1-6cc1-4529-831c-d39e01c59c2d", "value": "6144:iKfJCALkjp1g4SbsLyKilbNUBmB5XORDlsOMAidDNcYs6kJ:iKJCPjp1g4SbBKilbUD4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648473170, "uuid": "a1e84693-14c4-4051-a024-a423fe0f71ac", "value": 605722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648473170, "uuid": "8b3ac36a-c9a3-4c0f-ab56-6838f8184390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473170, "uuid": "ca4734ef-b2b7-4bc6-a39c-517e426c2627", "value": "emotet_exe_e5_b441c479246bf5b5f75f06f343745a24cdf5651710700a4807bc674d74d17580_2022-03-28__131245.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71f0e75-aecc-11ec-8e58-42010a9c0032", "comment": "Malware payload (N-W0rm)", "timestamp": 1648495561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495561, "uuid": "fb5b0404-a9db-4f92-b73e-6fbdd94d2c58", "comment": "Malware payload (N-W0rm)", "value": "415bbd9b50ecc72f72bbba43cd268b06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495561, "uuid": "6b504b68-9f4d-4c64-8896-ca99d4f5e9c6", "comment": "Malware payload (N-W0rm)", "value": "b48372b694840f2e042a0ed009bf134c33a7bab3e5041a61dd9119e676169be4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495561, "uuid": "e3b5158a-8791-44de-9cf1-4ffb6f1ec099", "comment": "Malware payload (N-W0rm)", "value": "6f7697b3f6d76d3b60d333d91f892ebe3d5e4f37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648495561, "uuid": "27c26dce-107c-4651-98c2-a90a4b47eec2", "comment": "Malware payload (N-W0rm)", "value": "7bf21e235ba4bba4718096bb67488234bdfd86194e7642b82298d65969f6b36952ed0fd03585f6c21814f39a85018c4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495561, "uuid": "0dc9f85c-2444-411f-8fe0-9eeafc19d2dc", "value": "T1EE84BF00BB90D035F5B726F44DB993A8793E7DA19B24A1CB72D42AEE56316E4EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495561, "uuid": "0a0c8f71-82bf-4526-8d65-6dd806f787d3", "value": "c5abd0d249bf5319619ab44b6b97960d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495561, "uuid": "8f4f6172-5def-4001-b23f-d0100177185a", "value": "6144:BPItdfRZb4TIL8QwsKVb+spzvi+3d2JLUYOl+uPPP0Ilb7H0gf1lY8:BPIt17b4TIL8Qkddp7i+3kJYYXUPsIJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648495561, "uuid": "dff62ef2-0912-49b0-adfc-a4c86907419f", "value": 380416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648495561, "uuid": "370a9114-00d2-473e-bc6c-f09b85085c94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648495561, "uuid": "76c78e44-febf-484f-b4d7-0583a3a58d4d", "value": "415bbd9b50ecc72f72bbba43cd268b06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6dc6925-aec4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648492044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492044, "uuid": "c232e586-f893-4e85-92ea-0dc24ee68efb", "comment": "Malware payload (Heodo)", "value": "e150b26885b4e5d6efeaf7118b610c90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492044, "uuid": "e3bea327-3729-441a-a453-d0018385e974", "comment": "Malware payload (Heodo)", "value": "b4b32f11119b25ddd41f2475bc11c9ad353457e9a7b3fa2544ec2fbc6c18bf57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492044, "uuid": "65a9dc10-face-4ffb-8341-360f30ec5fe3", "comment": "Malware payload (Heodo)", "value": "45251ebebc102855230bf2257c075168af0f4457", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492044, "uuid": "72585c2e-360a-4264-a890-ca3ba9116c23", "comment": "Malware payload (Heodo)", "value": "12d0b90e5070d6947a837240e81ddb9296dc3a00cf3296ee570f2897c15d80ff5e6346bc53148be8aeb0ca87f84548d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492044, "uuid": "f241d0e4-7caf-498a-b5f0-f86075f7c995", "value": "T112E48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514DB432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492044, "uuid": "dd3e1aa6-147f-4e51-aef8-af17d295db2b", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492044, "uuid": "36f7fd9c-baa9-43b1-8c88-f7b078596b31", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7zvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zdCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648492044, "uuid": "8b5c82d0-01e1-4da0-9376-907da3d17228", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648492044, "uuid": "1140e78a-ab3d-4125-a093-6c6da4fb5885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492044, "uuid": "1b90d786-73c1-4e61-be17-5d2f63fc7ec4", "value": "e150b26885b4e5d6efeaf7118b610c90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3d63b8-aeb5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648485639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648485639, "uuid": "a0d266af-b4cf-46fe-b5ed-fbf35b4298b9", "comment": "Malware payload", "value": "61467c5542f3528e742dabf3ad366e4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648485639, "uuid": "413439fb-a68a-4c67-a2ee-9ae8073b4b09", "comment": "Malware payload", "value": "b57d7fdc13da4ebc56c644bccaa32e31150121eee06bd74f609e2f89f4b63c1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648485639, "uuid": "7699fd99-58dd-4b52-98c9-354b24e22179", "comment": "Malware payload", "value": "8aacdc7b6db64b14b390f45125d5ec35bd7a87ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648485639, "uuid": "94956724-06de-474e-be92-357add864794", "comment": "Malware payload", "value": "0e4c07c0a4fa5b85aafa7bfba1852f2abf8e2d2fb374549b8f7cf14fab9f8351c66eff8eb259d29857cda1bf6bfbb9fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648485639, "uuid": "9fe4c33a-dfe4-4412-b2f5-be37bb2cc0bc", "value": "T11BE33A3A0E3945B5C3DE99FC77E710BABDF48217432A9223CD237C1D8A7A3A4A56D450", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648485639, "uuid": "a6a8d0ec-9d7e-4b84-80c5-4f196f094998", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648485639, "uuid": "2c2db1f3-4e4f-4a30-a296-79cd6a821e7c", "value": "3072:e9QbCQnuzQCaooNjoHbZXGjZz4Zgz29Y0z7a36M0SqXtoOLYW:e9QbFhrNUHbZXYZz4ZgS9vnQ6ZSqXmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648485639, "uuid": "d8a869a3-b341-4ded-b200-e70f87b53248", "value": 156672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648485639, "uuid": "e98df0c6-725b-4fda-b3e5-5f677a272325", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648485639, "uuid": "ecd0e232-aa2e-4c6e-ab12-443260eebc82", "value": "Doc506111102067.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966047b0-ae95-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648471803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471803, "uuid": "2ddaf136-6034-4d71-9940-e840d12cb141", "comment": "Malware payload (Mirai)", "value": "35788946736f78a0f7f290eca5d3e0f2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471803, "uuid": "d34ee354-7aab-4edd-a840-cce28d50160e", "comment": "Malware payload (Mirai)", "value": "b59713aa1472a58608b4a451b13f6265052b699d819acc90c27b8a59c347ae48", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471803, "uuid": "1791a889-fd08-4590-8309-19f877fb8ea3", "comment": "Malware payload (Mirai)", "value": "ef87de5532352b94da11a9465da1d5196dcdbb9c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471803, "uuid": "5ffb3941-4504-4b8f-b5c0-872b7298fc90", "comment": "Malware payload (Mirai)", "value": "01e7fe32305339038e2f82f13d6bcfb10a3ffb9fbc72f13be8d9b7f4f829e7d1b5684fb63879e8c18c4699208db149c1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471803, "uuid": "133c2a7f-7708-4361-a4af-65d75770d43e", "value": "T1BB636C85E9C3E4F5EC110979307BBFA29E73E63E6078DEABC39965339945602920235C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471803, "uuid": "100d129c-1dee-481c-ad7d-5921a58e12c6", "value": "1536:NbNUucrtl/cDMVOHItwm3p4knqEPgL9b/sk6SX:NbNUu6l//k4wm3p4kqEoVUkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648471803, "uuid": "271503f0-04c8-4865-914c-6a61adb08392", "value": 70736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648471803, "uuid": "246db4b6-2856-48d7-9731-61be4eed71bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471803, "uuid": "f7f5e69f-e8c8-41c1-a392-469392a5927e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b12252-ae5b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648446977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446977, "uuid": "c7e4db03-6a0a-4584-99af-bd3a64eb8bf4", "comment": "Malware payload (Loki)", "value": "463213d94ee2d39351c15b4ad7a36837", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446977, "uuid": "66f25ebd-1eec-4955-8333-264955ebfe52", "comment": "Malware payload (Loki)", "value": "b5c78573c5853bbc391f749647f2a88acd826b8719eea317a34319e5ebfa9060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446977, "uuid": "fdd60ad2-2d89-49af-a77d-227e1d603497", "comment": "Malware payload (Loki)", "value": "ae8f449b7084c036e27d53286fb22c34d3ba60d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446977, "uuid": "68058e73-8f9f-48ab-a25f-838ffb5091b4", "comment": "Malware payload (Loki)", "value": "796452cdcf227775ada72f5d33e56edebe9918cadf973c4218a3a620d6a1845e44b357299eb83129838cfdd2aa218929", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446977, "uuid": "c4a01721-ff72-4d62-a5d9-abf70645f2b6", "value": "T145258D7463E291E4E0DB6A31B4EE46146A2135879F6CE3CC6011D27D0A53BB4FE3D7A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446977, "uuid": "242e5322-3975-42a8-9c5a-0aebd773aee6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446977, "uuid": "54c85e29-724e-4be0-8c96-6aec05a1f15e", "value": "12288:qP1zhesISBsYaY5iFQc0qM+3HdkaiXkNNv2:+/7ISXaYIuXQsXCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648446977, "uuid": "4a824bf1-5b92-4e7c-bdb2-39fd5f907117", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648446977, "uuid": "1fb9c17f-fcf4-491e-aaf7-f49082bdac42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446977, "uuid": "7884204e-0931-4f45-a9e1-4dbe03a13382", "value": "DHL DOC 74653898.pif.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53052969-ae6e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648454940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454940, "uuid": "7ad8b53c-7d82-409c-bae7-a02a1427e232", "comment": "Malware payload (Loki)", "value": "1821678eb54e3802418df29c85bcb0a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454940, "uuid": "d4850dbc-d460-4bb5-92bd-ec6a290c91b4", "comment": "Malware payload (Loki)", "value": "b5cc4c13df7466e47152fd98ab79bd9edf593c382f914b2158ab3226dc8ca1f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454940, "uuid": "c1fe6a7c-e4d3-436d-b438-5dfd74cb555b", "comment": "Malware payload (Loki)", "value": "8163125985a341879a1c15edb489b84017d8cc5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454940, "uuid": "542d3165-9efa-4ba0-92f8-56009baece99", "comment": "Malware payload (Loki)", "value": "b011ef8119feca77481d74212304af710ec49f073b00e18ceb8a504b808fdfd779ec7453a10dfb8a617e3520d8a8b425", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454940, "uuid": "2af63033-3875-4466-bcbc-1226c355f35c", "value": "T19934125BBCC28EEBD9E244B56FF77BBACF7A96C010A214474F281F676A663554200070", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454940, "uuid": "a329addd-7b3e-4955-9b0f-f261a6216400", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454940, "uuid": "b5e06f73-49c1-4c4d-8ce6-cb7f163348fd", "value": "6144:rGi3aNsla8/bEFVhcUV+NrU8SJLoXU+uPl7ephH+IwGf:zraSbsmUVl56XG97lHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648454940, "uuid": "4b2a51f7-5924-4eab-8e12-f1794059ea35", "value": 244177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648454940, "uuid": "0bc85d9b-9d26-4f25-9d0c-d86ee18127e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454940, "uuid": "8e2db50d-a029-4abe-9b78-82991906a7f0", "value": "1821678eb54e3802418df29c85bcb0a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c228ccc3-ae8a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648467152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467152, "uuid": "92ea50fe-d91a-4c1f-b536-39b794738019", "comment": "Malware payload", "value": "a9d9ce648059424ace2af359abbd72b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467152, "uuid": "a6b99014-7779-471e-92d0-e3b88dedf078", "comment": "Malware payload", "value": "b5f972903adf2cb5e27ff0258ef678b1cae82c94830168019317b161513dc9de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467152, "uuid": "a32f5c5a-7e70-4196-9b1b-c503e6eac712", "comment": "Malware payload", "value": "80cb17abce454c526b989c2e7d26b7d3eaa7ffaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467152, "uuid": "fe0e2498-fb63-4b51-9188-0dba8bccd0c1", "comment": "Malware payload", "value": "1bb4edb8e1b01594e157eb4d0a9f9565a55b76dcbfc76ea97158b578d713ca5ca377bbe76ddb1f279c767fb8b8a42072", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648467152, "uuid": "7104759c-c869-43e9-94b0-c57a6c71e7a4", "value": "T1122420A5EB50F85EEC25B039D461E4F81AF36C31D584D60F185D3D6A72B234320AEA6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648467152, "uuid": "c55b17c3-dd36-4797-8584-a9080072aa45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648467152, "uuid": "1c60be6c-c0e8-430c-9926-f9df01e9de20", "value": "3072:+UMd6ogU7UUBeEGkBHUUUecLMNmttnYBYeSsj0:B/vhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648467152, "uuid": "f170dba4-b47c-4fb8-bd32-8b968efb9d50", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648467152, "uuid": "83a51cf9-588e-4b92-a73f-8472c9a31621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648467152, "uuid": "6d7b8527-55c2-440a-b479-5878af6339e7", "value": "RFQ8976778.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f50e47f-ae8f-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648469214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469214, "uuid": "b540d15b-8d0f-4201-8c12-56645dff64a1", "comment": "Malware payload (RedLineStealer)", "value": "a2bc6d16ab3c57a8b0b9fac7e204bb2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469214, "uuid": "d68af59b-faf3-4865-8218-14e1d7422021", "comment": "Malware payload (RedLineStealer)", "value": "b6406059af8bc5dc3b7ae91ecd3e2ec7d4281436d2243c96ae289b6feb9ad4ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469214, "uuid": "a788137f-b7a3-4518-8c43-04ca891302df", "comment": "Malware payload (RedLineStealer)", "value": "4ef4e0b70a90037ea415c37e2d8daab00d14013c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469214, "uuid": "57227100-33ff-4c84-b016-e1ae92c82c86", "comment": "Malware payload (RedLineStealer)", "value": "e25f1069a841f9c042ff29f49511131070d8c25ac976af789585b5ec0a498ca58e37ff6d7e79b49f5d981735677e25c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648469214, "uuid": "cd31b441-09b2-4d77-9126-c501a8d37151", "value": "T179D423EBA78B2B16C20D89F849B02D4F80C59675BCD83D16E27B4F531425CBA8E345DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648469214, "uuid": "45be0e84-aedf-4adf-87b0-bac7f08becd6", "value": "6177777cd67f32c7dfaa28c6d6e9d36d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648469214, "uuid": "5a0827aa-becf-4a77-b053-a5132f4b82f4", "value": "12288:WVxghhvlw+SvHZrjIHygcECMTZV80QS03ULaHNqrxlKIQNoHI1mcOeOvql1z:WbazSV0SLKX80kEaHNYK3z1ZOeQqzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648469214, "uuid": "81bfc5cb-dd4e-4c36-b6bc-8572d5deb12c", "value": 603648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648469214, "uuid": "fa615b90-e281-41cb-b7bf-986ce41876dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648469214, "uuid": "a4da4203-3a76-44b2-86f5-71ad7e38d33c", "value": "Elsify v2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf965a8-ae89-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648466498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466498, "uuid": "8d3c3359-d946-4b56-abdc-6c3b34775b91", "comment": "Malware payload (AgentTesla)", "value": "ccae88ffdff622202e89492e795313f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466498, "uuid": "e549c384-e6b2-4d0a-81fb-c2e07c293205", "comment": "Malware payload (AgentTesla)", "value": "b7e65ff787480e41ed7c19f6cf356963d2fc80681c52ba966d17c79b3a9d5f73", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466498, "uuid": "2057b15b-ab9c-4fb9-abec-c548eeec0530", "comment": "Malware payload (AgentTesla)", "value": "ae6383ef0a8de1626924278f4ed0cdd7562a49d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466498, "uuid": "12fa485c-d279-4cc2-9161-adbe8997cf01", "comment": "Malware payload (AgentTesla)", "value": "f76a825542f80b80031339a10cd86c85c7a19832395079e4af7598e7da24207b7b3c528b38b95fc0a25014bf1ce7ad40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466498, "uuid": "737d3631-2177-43b1-b316-c0e4f560ad31", "value": "T1DBE4C5ADB2F075EEC86BC175DA981C68BA907C67930B4103D02731AD9A7D987DF143B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466498, "uuid": "607e12dc-c347-458f-b9e4-d7389374cef7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466498, "uuid": "31b7ce65-a4f0-4729-8727-45c282f425ea", "value": "12288:teXtSQxLONokRNpMSlFMP19XJsRDqUjURQuy0xW+hry6bOHLxInkYsU+ZVTvsIGe:teXtiWku75s1qUmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648466498, "uuid": "6b4ee0f9-7d23-42bc-8a55-2558c05b1d46", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648466498, "uuid": "36914687-a402-4801-aa01-98bda298d801", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466498, "uuid": "a8919e91-0d0c-4bbf-a265-5d689bc06aec", "value": "UPDATED SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95815efe-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648448180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448180, "uuid": "8616a88f-440b-4778-bbf3-5e1402a42f02", "comment": "Malware payload", "value": "031234ab97430ebeafebfca2e74c0ba9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448180, "uuid": "5c0eadc8-3d0a-4623-a2b5-a860a3f49cce", "comment": "Malware payload", "value": "b8087b863f2ab6e76704dda40d0b6a753993b235d317d5eb4b0e2e536f73437e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448180, "uuid": "5698fd55-e835-47db-80bf-48323aa2aa44", "comment": "Malware payload", "value": "3fd5106ff1bf7e62e35d3ec4d7e6f49050ad5aba", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448180, "uuid": "dbf8ee93-87b0-44c9-86cb-a40d49727afb", "comment": "Malware payload", "value": "17e3989e587df4a4c35880428eb755f77da1077c78c11c8a32d023d6f8cd1d6ec1c3b75e793f6110df87ced5e88affab", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448180, "uuid": "283125d6-2ab8-4f94-b27b-cfd235543c2d", "value": "T16256F187AF88D89BC4F60673C977112731535E28078346BA5B9CF23819739C25F96BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448180, "uuid": "0cca8b1f-fda4-4d8c-a0b4-67b65c8b0483", "value": "98304:P2b5NpMKbWLx6KBFHJ+Ug+NMoaESmXp+NzMutmlljaphMJZh1c7w8EET2LIskDfx:OFUsWLI4pJ+7oN0N7tmlljjhsw7ICp9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448180, "uuid": "dc0cb25e-a0e8-427b-919d-1f3709360064", "value": 5884295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448180, "uuid": "d1329046-73da-4b07-b818-d039ea44625b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448180, "uuid": "bd1f00a6-b26a-41bf-994a-0151b0a6300a", "value": "My Blood Pressure.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecdcfdac-aed5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648499436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648499436, "uuid": "5ad71534-60e5-49b5-ada3-9868f39be8d9", "comment": "Malware payload", "value": "ba95520376cad4b233a3008c286fa432", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648499436, "uuid": "edbeebb6-2381-4c2c-b5a7-2e76499852a9", "comment": "Malware payload", "value": "b88d4de14992c52190ada96ff9d5f03a59fea2d90295ec5c1a27182127d26e19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648499436, "uuid": "a4b65dc5-26bb-45f9-a8e7-1bf0ed698a80", "comment": "Malware payload", "value": "86109a9bc598901afc7e8bfafba2bf084df33dae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648499436, "uuid": "8fa6f75c-6596-4b83-abab-656c6b782248", "comment": "Malware payload", "value": "9848d245168fac7f6718876e644f14eb3216de976eda6126f4227313a1788ca548ba27fbd10a5ab5515e9a586c6a159a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648499436, "uuid": "13e94067-084d-4ab7-96b2-825d4e07e8de", "value": "T148E35A62B2C08876E1630E7C9D4BD26C6DBE7E153E3C646BB6F50E4E4E756C02168393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648499436, "uuid": "3b360a74-10f6-46ba-948c-cf545c5f9be8", "value": "832993a75af820cdb37a700d25fb302d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648499436, "uuid": "58b5ddb6-933d-4471-b209-6f0d7ef1f381", "value": "3072:6ix5XnHSNwVR6vW6nNQAUrTrogAaU/eTQyBnykmNsNl0viuxzO/c5ukU:6iTXuKUn2X5A2tyfDv58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648499436, "uuid": "3926716e-5397-4d38-aec6-a0aaa9329cf8", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648499436, "uuid": "0ad50ec0-d636-4bbb-b12a-5b72704ff9ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648499436, "uuid": "f23dd0e6-e4a6-4a25-9749-192b75925c01", "value": "server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0466363-aeed-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1648509723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509723, "uuid": "2ed9031c-bd48-4b88-8d6c-b011cab21f3c", "comment": "Malware payload (NetWire)", "value": "be129a1b521f0e4d1677256aba6459f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509723, "uuid": "38bacd0c-4d8d-40d0-82ac-ed9922152b74", "comment": "Malware payload (NetWire)", "value": "b8d3ac4edae25bc8d8b7713ba9181b9dd1e21e28851d4350fb1af624625ca07f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509723, "uuid": "a91632d1-a63b-45cf-8776-8603ce2f6130", "comment": "Malware payload (NetWire)", "value": "45ca7bd7c9c2c9a7fe31a71eb754ff21601ae499", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509723, "uuid": "f2688d12-fee4-42c4-b8ef-22123873fc50", "comment": "Malware payload (NetWire)", "value": "eef3d24bdcc43949021ddc1402fe00992ab4094c14b64298c7f67fccdb3553085908bbd7fadb7a78450fcf457935ef45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509723, "uuid": "36efcc2b-75df-40d9-b7dd-405fe9e0ed35", "value": "T1DEB24E1566A8C665D9EAC67D6CF236FC4263BE03CC36A65BD4C8FF0EB9322400A51625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509723, "uuid": "a1285e83-c818-4a20-af39-f680914e4833", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509723, "uuid": "ef74867b-ded2-4bc8-98cb-d1b6196c82ce", "value": "96:M9spJaNdMPJxsJRmjxy+xQSB5wyDcYJqZ0SVLAx92P+hzNt:KNOxsJRmdyiQMwyNJqZHAx922j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648509723, "uuid": "4b3f1e65-f518-4c6b-aabc-303a92a9e271", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648509723, "uuid": "b7a28923-4a35-4bfa-80d0-5f4e036e296a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509723, "uuid": "d2182cee-cff0-4ef5-886c-7f744b48b028", "value": "QTL0507000205166.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e4b8ac-ae88-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648466306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466306, "uuid": "4c8921fa-99aa-40c7-b889-cfe55149ad94", "comment": "Malware payload (Formbook)", "value": "45aad050f7b61c0c6835be193f6d573b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466306, "uuid": "eaa671af-c3b9-45c8-ac40-2697a9b7b118", "comment": "Malware payload (Formbook)", "value": "b904ef4f3dc7faabaedcb0481c9f0a3a86e8c4146cd51540c90378e5a197b9af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466306, "uuid": "00d40f58-e793-4c3c-b237-d8e9ef8fec53", "comment": "Malware payload (Formbook)", "value": "4a5c2e881d862c3b06839a5bfe6fcb316c700f97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466306, "uuid": "86fa72a1-06c8-480d-815a-bbb9484ed4e7", "comment": "Malware payload (Formbook)", "value": "702b112bcca86b9f7c7f1d16765cee7701ca25470400a87eb122f6062b710aece0d66b9359700140ec921ec47e5fc7ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466306, "uuid": "7be515f7-99a2-4bc9-9687-77a4b3481889", "value": "T1D8D4BE37D6F8AF1AD57A82F45020C47A3AF18C42B900C416EDF635ABF9F6B924D51782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466306, "uuid": "41ead5fa-3e91-4b77-983c-ffcc9b2cb5b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466306, "uuid": "d3b24762-9afe-4dcd-bc51-5038614c642f", "value": "12288:jkDdPqXtcjbOuKdqW4GaOJ1U+dOcXwdvcoPbcAgdVmB1F:jKyXtuOTDJdSr6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648466306, "uuid": "07484c26-f9fa-4b59-a9b5-b06c91c3af26", "value": 609280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648466306, "uuid": "e6eb6e28-ed81-430c-bb82-2a8a8dbf895a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466306, "uuid": "2c42bbe5-3f56-4de9-b050-5dac6ef494bf", "value": "Remittance Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0645e2f6-ae92-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648470273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648470273, "uuid": "d1106060-383e-4ae0-8286-d20968e869a9", "comment": "Malware payload (Formbook)", "value": "f52c173b6fdada52ef179b03d601c355", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648470273, "uuid": "8fccf478-b45d-47ce-b93c-96e08d41df19", "comment": "Malware payload (Formbook)", "value": "b97666dbdee0fbccd8d4a0474cdc3037ef5cd01daa41506975a99ab7302cfc4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648470273, "uuid": "04f7e1df-ad8d-4fb1-8dd1-695482e7a483", "comment": "Malware payload (Formbook)", "value": "01abaab4b30fdcf00028bf04efd4f237b89d07fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648470273, "uuid": "e2c11099-f770-4db5-9865-6e82496b9d65", "comment": "Malware payload (Formbook)", "value": "49cda0c796d0a574824e6d4defde413b0c4e09e86ce28572d9d34e05a94104a2d78e5dbd3f08d07816fcde3c3febb937", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648470273, "uuid": "758eff2a-8af3-4466-ac03-93581930f42f", "value": "T1F9E4D5ADB2F076DFC86BC175DA681C68BA907C67930B4103902731AD9A7D987DF143B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648470273, "uuid": "164d6784-bd21-491c-a2b2-344a048d4357", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648470273, "uuid": "0b0305f0-4f00-4f09-98ff-d59601d15c23", "value": "12288:kDXtlypUxezM1LeWll5JkJigrTfzhQSSo3hLhwGnYYF7qMErw8A6fw4InUxl1IO1:kDXtlyiwAzlUJi4Lh13hle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648470273, "uuid": "663bb2d5-1e23-40bc-a399-7567d11acc67", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648470273, "uuid": "420c25e6-b82c-4677-8adb-ea0f6a775c0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648470273, "uuid": "0e9393c3-c241-482a-bfa1-e921a19749ef", "value": "RFQ 2022-03-28 5000002905 to AEDG CORP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332f9697-aef2-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648511580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648511580, "uuid": "762dc4ba-df21-4d34-b4f2-9163360ef097", "comment": "Malware payload (AgentTesla)", "value": "4dcab2d7a209218a878bf14d47f2705c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648511580, "uuid": "951d686f-2a09-419c-b074-e15d19382ec2", "comment": "Malware payload (AgentTesla)", "value": "b9df9ab21a22a4062b3b28af27c8cd8012dfc52e6dc329cea9f60ff8f9106574", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648511580, "uuid": "b69c0535-e8c7-41ab-8ebe-32e62ffdd5f2", "comment": "Malware payload (AgentTesla)", "value": "ad0b5cccbcce9cc11ffeefa2d4a1c13940d0b039", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648511580, "uuid": "93443f2b-b6f3-4c50-8a3e-b501724b7d2f", "comment": "Malware payload (AgentTesla)", "value": "30242f142b1b90ffbc8afbbd3b075b49a25f7d8568efbb56822c6c9ee7fcb4d5560c82558304130a016feb02b59bfdb3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648511580, "uuid": "4bbcf886-d5f1-4485-a60a-595915e0e571", "value": "T1A01509A9B2F075EFC857C4729D58DC74BA507CAA930A4113A0D73D9FA97D893CF102A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648511580, "uuid": "a00fd981-41b6-411f-9eec-22821d913382", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648511580, "uuid": "097d62f7-c90b-4ac3-8596-d717196d2c54", "value": "24576:LfXtdxY6ue1haSdXc5STVmhD/MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM+MMMT:LPtL6edUD/MMMMMMMMMMMMMMMMMMMMMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648511580, "uuid": "a14403da-f402-417f-8337-b4a366afe0d7", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648511580, "uuid": "5c027630-6ea2-48ac-9a58-ff2586e6eb59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648511580, "uuid": "3897f3d3-906b-48a9-824c-27041e76fcaa", "value": "Image 0002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6179ff-aecf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648496588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496588, "uuid": "f56e7843-9f84-44f6-ba7c-2d2cc1d642ea", "comment": "Malware payload (Mirai)", "value": "f41df5d67650e43178223bd1eaaddf89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496588, "uuid": "db4fa25a-925c-4e6c-9e79-378822150fc1", "comment": "Malware payload (Mirai)", "value": "ba642e0d9966803e26cd150031703fc69cc1f428da806fda9382a7a2f18cab0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496588, "uuid": "5ae6086a-7d38-4733-a8f6-3d708206cc23", "comment": "Malware payload (Mirai)", "value": "f776849492cffbd3af93131b033cd5b3553c896b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496588, "uuid": "e51063b7-c9e8-427b-a0e1-97b97361a248", "comment": "Malware payload (Mirai)", "value": "43214056b09bc2048e3477aed70df48d176f79e712c940c9aae437a0dbb419bf9eaae1098581cb81b0cd01a617efb5c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496588, "uuid": "9e8da512-acdf-47d8-b884-6828691aa4ee", "value": "T175C2E1DFF48A7985CC0C5CBC219D5AE115B9A2C3234B9F0837203DCDA5B645EB89C8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496588, "uuid": "86da4a2c-8885-41a2-9fa8-a48b0ffef4e4", "value": "768:McCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdBrDKW6:3CrJgHiOJrfwmQrctjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648496588, "uuid": "cc37fa5d-20c4-400f-b6f3-3eac1fd9f04c", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648496588, "uuid": "99d8b6ae-5108-4e3b-832c-2b06642282e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496588, "uuid": "d3de3aa6-474a-48b7-b97c-92c3ad3de921", "value": "f41df5d67650e43178223bd1eaaddf89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3194c0fa-aedf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648503417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503417, "uuid": "6d473d5d-baa2-4d04-8391-05c507bb27f2", "comment": "Malware payload (Heodo)", "value": "e35058a6aa4ea0f1f2c7976a11fb6ad4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503417, "uuid": "6d3d9f21-cd5d-4d20-bcb2-04e397da3302", "comment": "Malware payload (Heodo)", "value": "bb4d07dbcd4224963e5727ccdb009f68037f8eb6a4909909ee120ca37ad86da5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503417, "uuid": "4a3659a9-2d31-4184-a6fa-5738ea6b3c1e", "comment": "Malware payload (Heodo)", "value": "ba9f81c0a1058926cb0fd100a202cde5f84791b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648503417, "uuid": "baf17a08-3377-4efe-b2db-8bae24d54f03", "comment": "Malware payload (Heodo)", "value": "3bc744a5503805d2f8db6874e2fb8b66d559aa0958424733c93656b521dcb3bf3c53ab3510a0e319a574fa87fb196c6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503417, "uuid": "d02f8821-1a77-478b-8fb7-340bf1bc4749", "value": "T111E48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93FBFCD302514D7432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503417, "uuid": "3d86cff9-9743-4654-a9d5-97e1b3062c45", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503417, "uuid": "8351562d-5194-476a-a737-2cb24d196063", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7BvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zTCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648503417, "uuid": "cebca4b2-5362-4914-90eb-47faad1a0ab1", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648503417, "uuid": "9e2c0468-0958-4cc3-8bdf-ad3589a5384b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648503417, "uuid": "5eab3940-a8d4-49b7-896a-84079f71574b", "value": "e35058a6aa4ea0f1f2c7976a11fb6ad4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2736709f-aec0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648490085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490085, "uuid": "40a24dd9-ab90-46e4-b69a-d87eb3df2a95", "comment": "Malware payload", "value": "db995bcbc1b1ffe95cbde7f316b577bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490085, "uuid": "b07cc379-4250-4da3-bfa8-bd50081bae64", "comment": "Malware payload", "value": "bb95fa20a55260f729584b7932c7dba208dcc5b0a7597be447a72e481e0dcb09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490085, "uuid": "573b68d5-6f14-4843-b14a-cfd9a41d48ba", "comment": "Malware payload", "value": "95049e53f64a1b5050d697d88ccc8bf62d58e3f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490085, "uuid": "3b3899c2-c7e6-4e51-a6a7-dd12208dd58a", "comment": "Malware payload", "value": "cc008b3a1cb1e115964da0f4be7cd4a52e95a3a10528df80c88a459f4a99a844cf37d15dc5c80fea5636502c79ea254b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490085, "uuid": "1ca61acb-26c2-4fb6-8eaa-5832d1232e43", "value": "T1FBC51810B3A12104F9F767FE66F946A4887E3C814B6DA1CF49C50ADAC6296F47C346E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490085, "uuid": "b6c65cc3-4a5c-46e9-ad5d-8b91238f02e3", "value": "05bdc6a6adf04eca38d0953caca5e0fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490085, "uuid": "b61bb4bc-8e00-40cd-847c-354cf61d7ff2", "value": "12288:3BEnRe1ljhm1xvNkPJziiPuumDNWnr3Q5WOVI6L4qj7neunRxHfk7D4pa7+oJb:+o1ld8r2JUNJ5WOVI6L7jr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648490085, "uuid": "c67787d3-15e4-4b40-a5b1-401b84fd4688", "value": 2554880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648490085, "uuid": "81dfab1c-924e-401e-895a-20fe48ebdc24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490085, "uuid": "ff90956f-c224-48fe-a74b-82362da5b93b", "value": "SHIPMENTDOCUMENTSPDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f21930a-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448169, "uuid": "f33ec3ca-dff8-450a-b6c3-f5817ad4f081", "comment": "Malware payload (Stop)", "value": "fed7f6897324c0ca20ae8315e74ca432", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448169, "uuid": "b71a3125-a1d1-4b9a-8e04-aee1d2f1eee5", "comment": "Malware payload (Stop)", "value": "bb98e1a383024c9c13dadeab0b3b162b4e4c718b17cb5e3c7d08c1a547245ee1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448169, "uuid": "d0bd4c1e-48b5-41b0-9262-57ec67145a79", "comment": "Malware payload (Stop)", "value": "386297f04adb997c989ac4160a953bec35747fd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448169, "uuid": "1dc7cee8-521a-48e8-bbdc-813ad6f39040", "comment": "Malware payload (Stop)", "value": "0ef8216331603a6f4fdaf64eabc285170acdfa8f8bd4344c0775f6c68eaca85c4874271a68ea8f99a772d9f52a857416", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448169, "uuid": "7ae62fe2-b2a3-47f0-be08-704293eb3aae", "value": "T12E05F1506BA0D039E1F716F43976C3BCA52EBDA1AB2454CB62D53ADE46346D0ECB430B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448169, "uuid": "68c7f4e6-5104-485a-9300-2d0252522032", "value": "ed673bb78007b5e69407cd48f247d0f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448169, "uuid": "7d4f4b6a-07d1-4fd6-b15e-79cc2923618f", "value": "24576:um7mnrkoIbPpA5y6n5G5KDn/fiCh50ueaSb:uHHIbRg5Ge/6CD0u5Sb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448169, "uuid": "02db9f10-0eaa-425c-8c41-5c3f79bbe196", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448169, "uuid": "a0a77f7e-9f9e-47e0-b16f-890428a56a7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448169, "uuid": "a56aa3ab-aec3-452f-8b90-8345e7efa704", "value": "bb98e1a383024c9c13dadeab0b3b162b4e4c718b17cb5e3c7d08c1a547245ee1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f7523f-ae68-11ec-8e58-42010a9c0032", "comment": "Malware payload (BitRAT)", "timestamp": 1648452561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452561, "uuid": "89a08a66-54b2-4364-9187-4dc18694ee6b", "comment": "Malware payload (BitRAT)", "value": "7ab1687bdfc6bb2151548c2dd7bedee6", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452561, "uuid": "12b54bfe-07e1-4ca7-9742-dea474570884", "comment": "Malware payload (BitRAT)", "value": "bba6a529c00a612cf379e46740b2ab0fe6dcdb6953cb9249b56d7e3590833e37", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452561, "uuid": "b9b33869-6749-4ab0-a523-69804a522122", "comment": "Malware payload (BitRAT)", "value": "389b2cfca3bf9bbf09d4e17d742a7c65ef04e4d4", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452561, "uuid": "25fa9fbe-42dc-48d8-bb2e-f64a89aed5e2", "comment": "Malware payload (BitRAT)", "value": "f3ff7278949ec98cd60cd4dbaa22f782f202b56d24df40f462da8619538eb2218df493816e7302939f1567393132dfc4", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452561, "uuid": "9c85b2bc-7c45-40df-bc63-37119a469833", "value": "T120325C6892790917CD5BC1EAC574FF3A1AE3FC6DC1CB1852736CE9B027132A3CA12958", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452561, "uuid": "c58df905-6553-4657-b4b3-b67ac63d4de1", "value": "192:8NUeSPsjWrZQxWgaUcOvGOK5YMHNJssseQo6AIrxcqe2o5pHykOOkvXq:ISPsKSbdvGOK59HgXosne2SpSpRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452561, "uuid": "4767f62d-fa11-44e3-9a52-a459aa134b10", "value": 11176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452561, "uuid": "a4c42a96-528c-4c57-8ec9-56337f8e37cd", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452561, "uuid": "8bc7ecef-eeb8-43df-a4d6-d00d116c880a", "value": "Inquiry 28 MARCH 2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790a90e3-ae75-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648458010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648458010, "uuid": "2022ad9e-256b-445d-a308-b45b149acf56", "comment": "Malware payload", "value": "a15e4531424f39f7dfc6ee421d12d428", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648458010, "uuid": "e71e4afa-88e3-4c3f-a606-6499027553c3", "comment": "Malware payload", "value": "bc038c476f99fb02e1a00075cc2f804c832bd9e0c840f279081598b869102dc7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648458010, "uuid": "8bc5bab9-df32-4c6d-b714-95e51c7aebb7", "comment": "Malware payload", "value": "147a60ea497bcdc9b710414314d6001d81ca2f92", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648458010, "uuid": "07539d6f-6a50-4274-aed5-2985c005143b", "comment": "Malware payload", "value": "2301c48d76caba932152f89c3b53b1c80b5476818421524fc61639a9af79db1eaa9afba91ef5390fc0dc29ab1c5c0510", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648458010, "uuid": "b383f9f0-1a44-4de9-8453-53fa6e02fa3d", "value": "T1E3D3F1133E47C906D56D04397EB788482F19AD3F6C45266F22B03F6E7EF42A05E9631A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648458010, "uuid": "7ccfba62-6949-4f0c-9b33-5d23c947f704", "value": "1536:1RITVlL+u6oIBXZ8ZsP1lxIQ0xAsFhGlhBKyJVc5l/UrgWzPXSvrY2:ANL6tBW00xAqUhB7DalssD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648458010, "uuid": "6a51e968-2f93-4e70-a6cd-8f3a0b5fa572", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648458010, "uuid": "9ed9eaf6-5a8e-4a94-97f9-66e75cb0049a", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648458010, "uuid": "65d6acc5-06b8-46b0-bb3c-60a9edd97f91", "value": "U.S. Recovered Funds.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27432859-aeb8-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1648486649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648486649, "uuid": "d7e6b4e4-c325-40af-9519-29a1142b1243", "comment": "Malware payload (njrat)", "value": "3f1d1043978a66366b5d22f4ac46a5d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648486649, "uuid": "330e7b54-7f0f-45b3-87fa-f85b626ef847", "comment": "Malware payload (njrat)", "value": "bc12a9f0d046b1c0e2d783f1ad825a0190669e36b00f1070d32bd55566be85ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648486649, "uuid": "5156f707-6cce-4b76-8860-f7e15dfbec5c", "comment": "Malware payload (njrat)", "value": "3827ce7b5bd266d049f3637359d4675728985e36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648486649, "uuid": "e1f07cf7-0a9e-4915-95ad-6422a3bb5822", "comment": "Malware payload (njrat)", "value": "0c8c473d24927a30290b32f890e5e2bb31201bdd60825febeedfbaadf364cafdbe28202dfae6210ac84f2608410e0a2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648486649, "uuid": "f89a62d3-b882-420d-8434-3a4bfd9fcd62", "value": "T1F1B182005BCA8BB7DD73D77AD9B38B826378B611DD528B4E34C9120A4D237144D13B24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648486649, "uuid": "b19b89d4-24f7-4230-94fc-b58d174122e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648486649, "uuid": "5e1d0001-a5e5-4e68-8991-dc3746fb2f74", "value": "48:6ya4ZDYRAdoAQNF3FmMMkHIaHCHnHClFA7G2wAo6i1trSUli1DwgjVFypfbNtmO:kkDDdoA6F+U220UE1DwUkzNtd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648486649, "uuid": "b2361a90-cd40-4dff-b3f2-aa6286a28278", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648486649, "uuid": "75e7bd4e-3c42-4c17-bd07-f70e4f7c875f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648486649, "uuid": "6113d8a5-f320-4af1-8fe6-046d0df44984", "value": "3f1d1043978a66366b5d22f4ac46a5d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abdee84f-ae84-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648464538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464538, "uuid": "d0cc33d3-4b96-4d40-a0d2-cd4c371528f8", "comment": "Malware payload (SilentBuilder)", "value": "611ee118985b0cab9cbc97b06eaf7de4", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464538, "uuid": "613240f1-268b-4d35-9718-266bd9e1602e", "comment": "Malware payload (SilentBuilder)", "value": "bce864118680f3b5b2d3c1d87a284b5c1e0fd0ed670040f7ecded45ea9011b22", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464538, "uuid": "f7d51b9c-6535-4b72-9440-99684a6a53dc", "comment": "Malware payload (SilentBuilder)", "value": "051921b9762e606aec1ab771022809e442f7c278", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464538, "uuid": "c406b2ab-6994-4108-aa77-5e5fcb1cc258", "comment": "Malware payload (SilentBuilder)", "value": "02b8bae2d4893568a7caf61f50239e7f666ef948e66d6ed07ade7073caff0b49212ef4d6de71cff785f7ed59bda6f083", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464538, "uuid": "9641053e-fd8a-4fe2-8784-f70fe8e26c42", "value": "T18F43E85BBA49989DEA14877548D743997323FC304F6B074B3669F3257FF89A04A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464538, "uuid": "f8f8f519-10c2-4bf7-b2ad-f18c39d8d9fe", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgx5G9XSZ4Xsvi:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648464538, "uuid": "87d81a5d-b753-479b-b549-447413be7d49", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648464538, "uuid": "106d9649-1e12-4be1-81ca-036bf10bc7c8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464538, "uuid": "9f1da1a9-f4f0-4097-847b-05a651446264", "value": "SecuriteInfo.com.Heur.4127.12382", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6beaa9-ae78-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648459120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648459120, "uuid": "d9cd4f5b-44a2-4937-abd4-1fcedee1369c", "comment": "Malware payload (NanoCore)", "value": "ee587207df3e0aa0a5ed46d9f28d216e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648459120, "uuid": "a218e439-db99-4a97-a811-11980a8ba522", "comment": "Malware payload (NanoCore)", "value": "bd152ed7240d6dd48ba72ab999495d7511ef14321b781b4182e5c4d9eefb74fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648459120, "uuid": "b9311f29-51bb-4966-9b97-274b6ed5ae53", "comment": "Malware payload (NanoCore)", "value": "f1c2fb93d0ff9324aaa4788c17c638b63f5c6985", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648459120, "uuid": "641eb9ee-32b9-400d-ba4b-2757ef3c6779", "comment": "Malware payload (NanoCore)", "value": "71a9f3bc64c344fa75dede069bfa6371b45046e6016f41545f5e67f93fd9b4a41811a643b3b7a4c2378cbb47f7d26a96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648459120, "uuid": "e25f5ce2-a588-46cc-a23a-330a4008e3cc", "value": "T15935F00132A05754E0BA53BADCA944EC07707E1A6D7DD65F1DC132CF1EB1B82892AF97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648459120, "uuid": "cb9885d0-51e8-48d9-beb1-5dd601cf0275", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648459120, "uuid": "780adf2b-2330-4326-b700-7edef2d9b341", "value": "24576:ppqZwQHlZG6cOEV2/iascc4raES5jkLGvXTsZZzX6CJKc:ITgI/sjgMXXIZZzX6Cv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648459120, "uuid": "6ad0e211-c3c6-44b3-9739-505d35aeb4e7", "value": 1147392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648459120, "uuid": "028543a5-74a3-47e0-9ab0-24f8488e810a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648459120, "uuid": "1b25f2b3-5ac2-4b06-a594-e3435f77f282", "value": "Qut371.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e543a5c-ae81-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648463012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463012, "uuid": "fcdae269-4c22-49a7-80cc-90878ae4a489", "comment": "Malware payload (AgentTesla)", "value": "14b12196d6955d42b1cdf00872f8a9be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463012, "uuid": "b4be2042-f621-4b76-b9ce-8ea7be2d5501", "comment": "Malware payload (AgentTesla)", "value": "be13445bfc27add23b008bd963fb87dbe131334ae4b627a97f34083fe355eae0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463012, "uuid": "bb5b89c5-486b-4ae8-b234-d8d498875666", "comment": "Malware payload (AgentTesla)", "value": "70fa1e4539d5b5f0c154e82690676b6165b1b053", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463012, "uuid": "04e5ad3c-77ad-466b-adda-592593e37f0f", "comment": "Malware payload (AgentTesla)", "value": "52b29ed455ee4ca93c26929220cb15eaeb9f3535da4bf4ed44758d7ec18db996cbbabad418c75c42e312db31554039df", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463012, "uuid": "a7d63730-6097-45cd-8b8e-5a367b91bf09", "value": "T17345011131666D57C6640076CC9599DC03B06E86ADAAD78B29C133CF1BF27C3A626EC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463012, "uuid": "935ed564-6b86-46c5-85aa-fcb1756273a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463012, "uuid": "62a8b2b4-0d62-4f3f-864f-ee3013645332", "value": "24576:zhWVgFUk9n4uItZGAqw68paNUI6wdBOwMaEG98T5uwo:zhWbxZ3qw68gNCw8Gm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648463012, "uuid": "af0ce30d-39c9-4f75-916a-efa4debbf61a", "value": 1211904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648463012, "uuid": "7921b5da-05ec-4cc2-878f-d2158cb8faa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463012, "uuid": "be3d4bd4-6855-4fa7-a3d1-58f2971bf218", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08aa07a4-ae8a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648466841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466841, "uuid": "8c789a54-afb6-47b0-a45d-aecbbaf3d1f7", "comment": "Malware payload (Formbook)", "value": "5c819ca66a223c23d85b5d76788a16ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466841, "uuid": "f4dfcde3-ffd7-4aef-80c4-206e513bb0f4", "comment": "Malware payload (Formbook)", "value": "be51d1c2d8a30045b3fa84863ef8f5073f8ebcdac3bbdbfd483ff61365a9a2c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466841, "uuid": "28dadd04-4533-4902-b973-0f31611c69e0", "comment": "Malware payload (Formbook)", "value": "71cb72613288b2b2aedbd46ea381ddd725d72b8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466841, "uuid": "dbc6b259-964b-4524-925e-9d175d086586", "comment": "Malware payload (Formbook)", "value": "1a36fe1d77a56bf24521e2b0a1269f3382fa03ba84bbff41207bf5498ac3a18cd320468fa54892faaf999dadb8412bb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466841, "uuid": "32a151b3-61f5-4282-87cf-d25413725907", "value": "T1EDE4E7ADB2F076DFC85BC076DAA81C68BA507C67931B4103D02731A99A7D997CF143B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466841, "uuid": "9fbd7dd6-6013-446f-b671-9832382ddb18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466841, "uuid": "37de0c21-1615-4811-9b70-71d1a75e5186", "value": "12288:YQXt06QhEvR0U2P5Ls4IqPkeBSfWXD6OxIgczFhvnaGwEDbIIq5WKKVDKiaXdIbo:YQXtpQhEp0LPttIcjBSWTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648466841, "uuid": "f4e4c7aa-2d08-4ad3-aeef-65e08a504e5f", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648466841, "uuid": "6bb63fee-a740-4dbc-b310-7766d9cd50a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466841, "uuid": "c5d36559-f75f-400b-9999-8213fc5553f3", "value": "2MWNKkvu8Knwdsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ee4819-ae98-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648473005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473005, "uuid": "2e69078d-b528-4a1e-bad3-9c5637826fa6", "comment": "Malware payload", "value": "74b81f86b7e6826d81ec27055b3a65c6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473005, "uuid": "e67a6d53-fd5c-4c63-9c59-ecf78870e051", "comment": "Malware payload", "value": "bec6efaa3e2c07c6478eb5121147424571f01bf9a00c465e3c62acb732ca374d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473005, "uuid": "98594d27-7091-4113-bb86-7f2edf794f60", "comment": "Malware payload", "value": "8365f3cf4bf65d394de5bcd6d54fce8105879a45", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473005, "uuid": "96816c1a-f893-4d28-acd3-9a4aabba6505", "comment": "Malware payload", "value": "5de26c1724ee86c5359c0e416b225992e83170db4fd63b16862babb768deaf703fb47e212b19e61ab6f6e264cacbbd2e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473005, "uuid": "d50559f4-1d54-4655-965f-0c700ad5fa03", "value": "T1E205AE53F3E240BAC0AF9171CA52671BEBF1B8090634D75B97D48EA62F13B62562F311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473005, "uuid": "b0bbfff3-70c8-44c3-97bb-1de0357db55d", "value": "73ea6eaaa036ca5d646bc8c1cddd95a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473005, "uuid": "24307101-0816-4494-b25b-fd8b1e1bed0f", "value": "12288:oB1eNOqVLqYgQ3fAq8r6fT30uME61LRmxq3+3jN71h4HTDZ+QeiitizcLZoWLRE:oPevLRX3ri6ZMS4O3Z7r4HToVta2ZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648473005, "uuid": "203d6bed-74c6-4572-9fe9-f6bacee922ac", "value": 828328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648473005, "uuid": "803236ec-cf9a-4c53-b532-7309932f5f56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473005, "uuid": "6ba0cada-d9cb-44db-bffa-1dd50ff94a72", "value": "119f9c58.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91cae25a-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448173, "uuid": "94ea83a6-1e78-4a5e-99d6-0a336e3d65df", "comment": "Malware payload (Stop)", "value": "1e02d53d304fdb6c2c22eb5418f1a151", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448173, "uuid": "d36b4711-884b-4f47-9443-9b0e40943532", "comment": "Malware payload (Stop)", "value": "bf8cc404ed07bc76b18996c161102766ace54b7d961931e94aca144456425caf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448173, "uuid": "0aece5d2-6aef-4111-9202-2d61a7a851ee", "comment": "Malware payload (Stop)", "value": "f7c8ee2e463709b54c550c8ff962b11fddf53427", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448173, "uuid": "ad2f3d4f-188f-466e-bba6-1a915bb50c19", "comment": "Malware payload (Stop)", "value": "5261744feb780482b0a2a2a605db2fc5373268520c836d51bd4694357093448115fe7f0f5f76f6cc3d70765fd58a4307", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448173, "uuid": "05140634-d19c-4c39-b784-a5099fcf09c8", "value": "T16C050150BBA0D039F57701F4787A93AC642E79A09B6450CF62D76BDE5A382D0EC7630B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448173, "uuid": "7b4af717-ed63-4d40-b3d6-079f3ad67d0f", "value": "6bd64b13624a27b70b577055bad87689", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448173, "uuid": "467fe30f-6544-4ce2-b867-b9903d6b5bdf", "value": "12288:bhKDNJBvvPa9HRDlnCBQ7MSv92OxncufQCSZwSkrJWG4pxtX3i8:FsJ9yDlCOIw/nbMkrJWlHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448173, "uuid": "cf2e3153-e8ef-4839-8687-0973e5937395", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448173, "uuid": "e09f5742-5703-47a8-9237-a8f4cd7cdda1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448173, "uuid": "f72363f2-8dd7-4d1b-a137-0c4ba14af67f", "value": "bf8cc404ed07bc76b18996c161102766ace54b7d961931e94aca144456425caf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94dd8b44-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448178, "uuid": "9fd09d7f-0db6-4d3e-ae2d-6a2d37d57b55", "comment": "Malware payload (Stop)", "value": "a8fffd09a3f66b8886dff9285f5201f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448178, "uuid": "df52865d-63f1-4a02-b8d9-54d09e8f6228", "comment": "Malware payload (Stop)", "value": "bf9df0d93da3c6dea48419d6166ff268f1d313ca895488d94c8aaabdf28499c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448178, "uuid": "7d26fc1f-4a24-47ea-8718-242e9e4dae85", "comment": "Malware payload (Stop)", "value": "265fed5ff6b857afde0cf0ab9d85504318b74b91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448178, "uuid": "6c84ea65-a042-415c-a66d-33cc8411190d", "comment": "Malware payload (Stop)", "value": "dfaf3856b7abaf02bb1939abe6d20b23e366e03e94d1fc4e4f3f33bdc531acf0779806d75c22687eb61cc140e8386e1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448178, "uuid": "5799ace1-2322-48f0-8214-168b270865d4", "value": "T12F050150B7A0D03DE4B342F87976C36DA82E79B19B6151CB32862BEE57346D0ECB1247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448178, "uuid": "704d6cef-a988-4a45-86be-2da1346a7e0d", "value": "31ff0fcf24c663417943c5927af948dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448178, "uuid": "82b7c1b5-fb51-4bea-8549-3118987382cf", "value": "12288:MjIUeFVSU6kVHNq1OVbLDQF4yLJFdQkdnVrJ/7BmpanZ5zuFbJxdrBZfuDmWOlHn:D7VokQSHEyoFb9X6F9nupORpcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448178, "uuid": "54812646-d435-4e40-800b-8e3996a427a8", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448178, "uuid": "8a4a9ebd-757e-4bc1-9d1c-e3fca280ed6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448178, "uuid": "4c00cef7-0c90-4158-aeee-d6079de62e2f", "value": "bf9df0d93da3c6dea48419d6166ff268f1d313ca895488d94c8aaabdf28499c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fe0daa-aeca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648494402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494402, "uuid": "b9c16f71-16f7-43cd-94f0-41e9ea5a2de8", "comment": "Malware payload (Heodo)", "value": "1c623eb14579cb13330119930f0c06e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494402, "uuid": "042a1e5c-7950-49a6-92e1-bddf228aa51a", "comment": "Malware payload (Heodo)", "value": "bfd388822a4f8bbe1c725e771f075759b3abf093bc22b9dd48192fba998fa90d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494402, "uuid": "eb5e2489-3954-4e77-83a0-7b21e53a4338", "comment": "Malware payload (Heodo)", "value": "81ad0dfb8a15344597c9eed56ee6da351021736a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648494402, "uuid": "99f6b6cb-defa-49d6-8df1-a3cb4731068a", "comment": "Malware payload (Heodo)", "value": "83c752ff62a19cb4ed0bcddb583aa3ea837659b2600c033c33715f1c689672767664543d94241c4ca5268bdd81784026", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494402, "uuid": "a8e77452-dd64-4071-aac4-056fabbd94f9", "value": "T181E48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93FBFCD302514D7432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494402, "uuid": "a8870295-8af5-4109-943c-7ff11a4639da", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494402, "uuid": "86b6ca8a-3aab-4872-ade4-60210f7f59ee", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7UvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zeCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648494402, "uuid": "6246897e-7ff2-42e8-930a-2aece6d75455", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648494402, "uuid": "00f69919-5159-4a53-a299-7021ab465a35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648494402, "uuid": "a32060af-3c61-4aaf-b036-2c8a4468b482", "value": "1c623eb14579cb13330119930f0c06e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c2d9a1a-ae69-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648452674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452674, "uuid": "7d286952-d100-451e-9d28-e9b7120a29cb", "comment": "Malware payload (Loki)", "value": "fe6301672c9d7c48888611f39a1e1a8d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452674, "uuid": "e08b74fb-8597-4848-8ded-85996067ca15", "comment": "Malware payload (Loki)", "value": "c02298946cdf30d09cbcda3cc0626718d3953aa268e8823520158fb0f9008800", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452674, "uuid": "dcb3a129-74d3-403d-a962-64830388c3b2", "comment": "Malware payload (Loki)", "value": "23f70ecc6ca7d4077d9b7fe3f92def236af4a4ce", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452674, "uuid": "cf798db0-8ec5-440b-9fca-93f38c3857b6", "comment": "Malware payload (Loki)", "value": "159f2d5d79afe87d830eedc6fa552cb8de84fbe7ef52f0c9427c62cee992de07235d3b64b10defee0f7f4bf4f15ef625", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452674, "uuid": "9ecbe2e2-8882-4cc8-8a49-51ec99721681", "value": "T120140298BA58D1E6EA2CFEF6169640040C32FF72015C1AC09566FD2CCDBE74E4E5879E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452674, "uuid": "9f25e4c2-c293-48c5-acca-d835393ef286", "value": "3072:3XOKQ8ZXgUqTypyYso8qRpUFRfXHl+mMWt6NkGhE6+XiAlv0bDszBQB:HOKQegUqZYsDqHUFj+mM9NHE6+Xijszc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452674, "uuid": "f2da4416-ff87-4597-81fc-7f50d9ae835c", "value": 192904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452674, "uuid": "9edf48b7-e59c-4514-8b61-2ddb820742b2", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452674, "uuid": "7e75fa14-c8e1-49f9-9018-0fc34ba355b2", "value": "Doc 7766884231.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4fb7e5-aebd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648488748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488748, "uuid": "eaee606d-1b4d-4c77-8c7a-e173345eafa2", "comment": "Malware payload", "value": "062ecbe50a94e953857db95fc8d13786", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488748, "uuid": "95a78dab-07c5-4648-908e-63f4886ce698", "comment": "Malware payload", "value": "c0231affc419bf3accd80fecbe35f0eb6758ba168b04f645f4c02e713cf5e699", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488748, "uuid": "e920a4f1-4529-4030-a6ac-37e8f8c2a01e", "comment": "Malware payload", "value": "a1962a4b0743335d128cd831237ca75a72b8f4cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488748, "uuid": "a3d05fba-bbdd-48d4-a92b-2f6678170822", "comment": "Malware payload", "value": "22ebadc5506b723562578f2a750a45e24c2c3d33bbf0877ada5b1b86ccf0ab45d7e49a34e333eca1bb7883f572b8c898", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488748, "uuid": "f25745e8-bc70-438d-9d1f-a4ac445d7187", "value": "T107D3FEBBD324D8DAE82795B57964243C07A86B93394C7672CC7EB110AAF7ED60803D17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488748, "uuid": "4ebb9642-73b1-4d1a-abc2-6f62291fda23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488748, "uuid": "ca16360e-dea7-43c3-b824-114063adbf46", "value": "768:HtTZskgWFjuFBwhHPnqtmK9/NZZZ0n4W9EvtnMJCDGrDGqh2O:BbFPvd2/q59ktMJWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648488748, "uuid": "8bbc8ce9-d711-47cc-a78c-aa78478742b7", "value": 142032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648488748, "uuid": "398c54b7-72fe-43f2-a76a-7e81a629e3a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488748, "uuid": "f959e841-64d2-4714-8993-5f8a7abe4e04", "value": "MV FLOURISH DIVA - PARTICULARS I.xslx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656afd73-ae58-11ec-8e58-42010a9c0032", "comment": "Malware payload (Socelars)", "timestamp": 1648445522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648445522, "uuid": "5c97f757-cfa6-4eeb-8379-6653c7e10b99", "comment": "Malware payload (Socelars)", "value": "92979f74f99efbfbe6bee66e185ff1d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648445522, "uuid": "e4e51012-3154-44e8-8d10-cfd0dcd514c0", "comment": "Malware payload (Socelars)", "value": "c078dce40d291a6f6dd723c4096102c89ea27b89c8353f57f08d2d239182e5d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648445522, "uuid": "ce4427a0-eefc-475b-975b-4458f00e5f97", "comment": "Malware payload (Socelars)", "value": "4e690232fb917674018a7ca14482ee9a2d550bd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648445522, "uuid": "e86de46c-6378-4824-b878-ba02f5684bd8", "comment": "Malware payload (Socelars)", "value": "bde57c35b15b1d593dd8bfbf69f060d758efb757bdd2db5ff45c674fbf1893abb41ba132b348684b7b18d6115265a8dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648445522, "uuid": "57e8e5e5-5d1f-4747-8df0-64085c4dc00a", "value": "T198A633AC9F1A84FFD510CE3D01B23FBF62964EF11AC1D90D18EE026C1A9B7D196B5285", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648445522, "uuid": "33d9e16f-0351-4311-9916-2aafc8eb67c6", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648445522, "uuid": "b505e8d5-21d6-41fa-863a-c7cfe71da378", "value": "196608:JypCRNnuLH7T6ta+Rom95+5M9nCJbv21KHj9IfOr8+x1r97be:J9Ryr+Rom9A5MyvLnh7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648445522, "uuid": "422e95c7-75f8-442d-a833-3117c8d4ae83", "value": 9555589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648445522, "uuid": "22033c2e-4682-46f7-a3dd-03d35f8db4ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648445522, "uuid": "15f80523-8bc8-44e9-8235-efe92565cc7b", "value": "i864x__setup__62413e9629622.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff29f884-ae2a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648426023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648426023, "uuid": "b4b53ace-686d-4800-a9e0-47c8bd762920", "comment": "Malware payload (Heodo)", "value": "7694d1a819eec8131404e0762bbd6594", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648426023, "uuid": "c2e84fba-a860-4966-bf9a-acb729ff54b0", "comment": "Malware payload (Heodo)", "value": "c08c6bf4833b00fa216c9cc8366372b9d5301b9be4af7524befd48b49797faef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648426023, "uuid": "ce1a167d-0420-4c82-af46-544b62bda2c4", "comment": "Malware payload (Heodo)", "value": "838b904c27eb65f00b9187d2270554fd87f5fa3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648426023, "uuid": "4c703106-a1b3-40ed-a5d8-421993fe329e", "comment": "Malware payload (Heodo)", "value": "9503b5ff3e0e13c732248937cd4b39b002920dcfb77a01b00973a8842a13d76dfd53e1890e1449573ec2f08d8152ecb2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648426023, "uuid": "5a5d1232-5ead-4e40-a724-0e1123980d7a", "value": "T1FAE49E1177D0C072C2BF3630551AA3B566EABC708DB9860B6FD42A7E2E745829D3871F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648426023, "uuid": "cc315e49-01e1-4a11-af05-9bf9fe3eb173", "value": "923a5ec702466ffd61b422bacc94c6f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648426023, "uuid": "e2e4001d-42f4-4116-8ee6-8be90bc2e088", "value": "12288:JSycC8Tu2EEAeClIHRFa7UdUzrAKZtI8X0oXYl2N17OP:JSDD7RDhH3dUfttj0oXYl+OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648426023, "uuid": "3552d7f9-90db-42e5-b1b4-eb2c3ecedca4", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648426023, "uuid": "51e5f22c-e000-4c8b-a327-4249c634a945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648426023, "uuid": "c448fa33-c1f3-480b-bb2a-f3e66ffdd66b", "value": "7694d1a819eec8131404e0762bbd6594", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32961769-aeeb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648508573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648508573, "uuid": "689d49fe-7f30-432c-b18b-f32d61f131c2", "comment": "Malware payload (Heodo)", "value": "877ff08f275182387792962e47997cc8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648508573, "uuid": "59002b42-49e1-47ad-ade7-2a0327b2916e", "comment": "Malware payload (Heodo)", "value": "c0b7d7316e7b0bc957af3ad1bc902c45489bf4d4c4a7af2a5f0cd29eb1ed9e00", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648508573, "uuid": "9f576aba-5a1e-48cd-9be0-e4c3056b93fb", "comment": "Malware payload (Heodo)", "value": "ea92fef8be5eb9c1d990534e0dc299c08bca62e6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648508573, "uuid": "429e2e4b-f2d0-4b70-a1ae-7656fe180e38", "comment": "Malware payload (Heodo)", "value": "2eafbd6cdd0af6d808d878375261d09ae482efd797db5c137ace7a10d561b373546269dacf4f32426d9c6963c1231dd5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648508573, "uuid": "3a51112b-9cc5-4c82-a1cb-ea0cb7582309", "value": "T14B94DF007AC6C433E1AA063949A7879467FDBD52ABF5C74FBF807E4D5E314828A35362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648508573, "uuid": "1df82ee2-133a-4f79-957c-a301b87e20a2", "value": "60acb5dbeebc778b5879492b3afca208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648508573, "uuid": "60921932-b512-4abe-a84d-04e3fad890b5", "value": "6144:aH0RW81UplEIb6hRAOf6DXyhCra8uCtS08OB8xS4GE/mFCo3QkgqbqAT:tFpMOfeihCra3uiS4zCCo3QkvqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648508573, "uuid": "949a73cc-13c9-4d2c-bd78-a6e755f835ea", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648508573, "uuid": "eeed655f-242e-4004-9547-bfb0822c6db6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648508573, "uuid": "af032249-d339-42b3-bc8c-920e1cdb018a", "value": "emotet_exe_e5_1cd0074958137fafebc88240672c50ffbbae5da8e872ce767fda0b4e043da26a_2022-03-28__230247.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51425237-aea7-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1648479418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648479418, "uuid": "145bd301-0495-4fc2-8998-114922f12395", "comment": "Malware payload (njrat)", "value": "b59b30dc75031ddf3bba1e7546b93139", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648479418, "uuid": "a9f8a193-df4c-48f6-8ac6-7751445efab3", "comment": "Malware payload (njrat)", "value": "c13dfa4eb40ee0a1841efd1fda20d1f6045d4f28ee771dda0784ada2481b569a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648479418, "uuid": "e3cd37f7-daaa-403b-b349-3e3d082bf7e2", "comment": "Malware payload (njrat)", "value": "de41d91f74fc64dfd6b040b18292bfab3addb6a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648479418, "uuid": "540cb745-43cc-4fe1-8b86-410a98a16632", "comment": "Malware payload (njrat)", "value": "68676b13b6442cd06412c8bb242a623a105150a9cf08e7985e07197fa72c865b8b6b23b0cc83cb2d4033855f308a7532", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648479418, "uuid": "52588a01-5778-4801-92c8-f3e5d5f240da", "value": "T12613D74CB694E174D5FF8BF1B4A2B2890B71A017AD02D20F99F154D94B73EC0A611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648479418, "uuid": "781094ca-39de-4109-a390-6a14b0169aff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648479418, "uuid": "20cf7455-2592-476f-a5dd-cac3878839c3", "value": "384:1ZyDKhg98NaIyrFln3usSEExi07azsIij+ZsNO3PlpJKkkjh/TzF7pWn//greT0k:ff2ywFrrn3u3dQuXQ/oq/+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648479418, "uuid": "2c0320c6-d3d8-465c-ba8c-6246e89d9f51", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648479418, "uuid": "c030fb37-85ab-4a32-a7ca-db6d87348206", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648479418, "uuid": "b5bcc142-9c2e-482f-bc77-c4e684521ace", "value": "b59b30dc75031ddf3bba1e7546b93139.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfaacff0-aedc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648502367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648502367, "uuid": "7f8503cc-6543-4775-b988-429518d0f920", "comment": "Malware payload", "value": "945fbc2bf796a24ed12c2ee680dcb8c5", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648502367, "uuid": "11022618-5f45-408b-b8ff-e2fa5a1ff238", "comment": "Malware payload", "value": "c191bc254b7f06fcedaffb6a5610396a82098de0b190e0f83383b19bbaee25da", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648502367, "uuid": "c16e3936-eb63-4676-8db7-01fdb09a336b", "comment": "Malware payload", "value": "74749ba010cc4ce892dc5ff6df89e77345392955", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648502367, "uuid": "1433d555-378a-4e55-b39f-2b11980d23bc", "comment": "Malware payload", "value": "440afaefdd852b0468ac7df40a1fbdd2c7be3cc3372cc299f3347cfd3f09a2b2defc23ac43fdb8d4bcf5b32400627a07", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648502367, "uuid": "64a03876-50cf-44d2-a7fc-19c07c0ab5d2", "value": "T1F101D0F1687541A94B78D267F5377A07A230C19520C1E3FC50CE464CA7E0068CF607D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648502367, "uuid": "77a85208-ff1a-4e26-8c1b-188b8feca955", "value": "12:x3voQByxH5QwMO76T/esFskSX7M9DgwgegGSRrF7tdgwA4qkz6gtL:x3QUyt5QwMI6TeKFk7ltbdhtWwF6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648502367, "uuid": "da766e28-583f-400c-b63e-1ec97092608e", "value": 759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648502367, "uuid": "dd556df0-17b2-4f24-ac89-0e5fa243baf2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648502367, "uuid": "f0ae7129-ad4c-4105-84ac-d0976a03f1db", "value": "VRjgey87.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed39a915-ae67-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648452192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452192, "uuid": "ccd3f7b0-22e4-4794-be97-07fb3821bd1f", "comment": "Malware payload (SnakeKeylogger)", "value": "f689ebbfbe2638eeae4d7a5489cabdca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452192, "uuid": "a2d70f52-1e6c-4a42-8ee0-08f42bdae4c1", "comment": "Malware payload (SnakeKeylogger)", "value": "c28fd20d2a92ea16e103b8d36d787b334b5809b5c04eff1a48d38464f0be5db1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452192, "uuid": "ae45b7af-8d8f-41a0-8096-e0fddbacc82e", "comment": "Malware payload (SnakeKeylogger)", "value": "0d8fd61540e3f5d8d3e385f713978483ec28e99f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452192, "uuid": "892a213d-e3a0-49ef-adea-7d67fbf01588", "comment": "Malware payload (SnakeKeylogger)", "value": "03c3c1a1457917abc49b15b453726823d60e0c26f78ac166e3ce816efc305207ee95e74de8f0c56851868cad2afea875", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452192, "uuid": "69683609-498f-4b40-a59c-28d47dc7d098", "value": "T1EB35F10232A06B54E07A93BADCA544DC43707E59AE3DE20F2DD172CF1971BC58A29F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452192, "uuid": "ab2ff91d-15d4-4d71-8b1f-c030ba0610ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452192, "uuid": "18f5a031-78be-4ae7-940a-c6092d76590d", "value": "24576:8pCOVCBUzcX2A0454HH8PwTz3lYo1JU/J9:uYXR05oyW/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452192, "uuid": "74f372dd-70d4-4cdd-9988-13941857f62c", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452192, "uuid": "9e215d4f-bcba-4e4e-ac7c-bf4ad65afa41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452192, "uuid": "5c4edaa8-1048-48ad-ae21-1f085d08287e", "value": "Payment Advice 28-03-2022 SKMBT03783930224080488904003TXT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2dd183f-aed8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648500735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500735, "uuid": "91734f2b-5fa7-4945-9967-c4f6a9f54f5c", "comment": "Malware payload", "value": "1bb33434e67c95678468b600a5696045", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500735, "uuid": "359c63e3-c998-4efb-a408-e55f6df422f7", "comment": "Malware payload", "value": "c2a55ab751f6dfb28fc2a04e89d0e3c79e0bbebab87a96695971b5d46015bb9f", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500735, "uuid": "5ed79499-c5a7-4b86-8ec2-b31ff8182941", "comment": "Malware payload", "value": "2d026fe5f8969b9600ef648a40f47f0697d9fafe", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500735, "uuid": "5b54068f-d8c4-4172-afdd-239ad06b3747", "comment": "Malware payload", "value": "eba8012e7d96bc25402b22a8eb98020c4dd7548761eb4484c76ef5d8a00e404f5f68fdb1529a43e78ed5b785f7dc6725", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500735, "uuid": "44471e1e-c292-4cb3-bbe8-1517c2138e9a", "value": "T12701CEB0687A44A84E78D267F6277A17A63081D920C2E3FC508E065DA6D14A8CA60BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500735, "uuid": "7d7363ed-3ed4-4c04-9159-9651ead1d4fa", "value": "12:x3voQByxH5QwMO76T/esFskSX7M9DgwgegGSRrF7tdgwA4qkz6gtcFCQn:x3QUyt5QwMI6TeKFk7ltbdhtWwF6TFCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648500735, "uuid": "f5b196b1-16db-4ac1-9db5-260c468008ad", "value": 823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648500735, "uuid": "3256e988-77be-41d4-9561-c2f68bf48fdc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500735, "uuid": "54ea1594-debe-4d21-ae24-0ecca1bb514e", "value": "FETbXq5c.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d64dac-ae67-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648452200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452200, "uuid": "03e1bbcf-6a0b-46ee-8731-e85ce38d93ea", "comment": "Malware payload (SnakeKeylogger)", "value": "db97c8ff10178dbab93537b8d09fc413", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452200, "uuid": "e414a658-6bbe-4762-8c20-a73bb1a6e3e8", "comment": "Malware payload (SnakeKeylogger)", "value": "c2af46184ff730426a4867787fd7fb15737a3144f999b18d7b2fe0c67c0927a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452200, "uuid": "ef9a60d8-b74f-4600-af12-2e84010bade6", "comment": "Malware payload (SnakeKeylogger)", "value": "1564a0ae208e5279ba9f109d0545f9f2dca3270f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452200, "uuid": "36759678-5e23-4560-8646-c8a7e2cd963a", "comment": "Malware payload (SnakeKeylogger)", "value": "ad39f5a581b9c83f502fa3911d128374ec171357ddb9e39e0b3d0be98f5ceedc6974dec10487963c096ad21ae8719ea7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452200, "uuid": "b6e7bf94-ecda-42c2-b8f4-c1a8af91d311", "value": "T18FB23D155698C675C9EAC63D5CF272BC0277BE03CC76A69BD8C5FF0E78322000A91A79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452200, "uuid": "a67b1012-78b3-42aa-b741-39f24f1e457c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452200, "uuid": "6752e401-e4c6-4e65-bbe7-227c6aed7689", "value": "96:0xmRsJbcP7x15FRPoeFhdpH7ywulmeZnkNiWIhSVB5x92YgzNt:0vbcPPloeFpbyBlDwiD65x92Yi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452200, "uuid": "04f4529a-3a8c-44c4-8aa0-af1d0304d714", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452200, "uuid": "0d2cbab9-a428-4f84-b731-fd412d215b99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452200, "uuid": "819db1c2-cbf7-4e2d-8dc1-0f851a5ccb17", "value": "Doc103575220687.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c576cba4-aec4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648492069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492069, "uuid": "cf79ea09-38cd-4ae9-b94b-7a77e240eae4", "comment": "Malware payload (Heodo)", "value": "f71d0de8431853d478a4a8853df67299", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492069, "uuid": "260bd592-8bc7-40ba-9cdf-cfd8bc7cd0d5", "comment": "Malware payload (Heodo)", "value": "c310c1051eff01bbf9a3374a0e29c57c62c2e48996cbbc4cdde1791d302fe6b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492069, "uuid": "ad389993-8c96-4fa4-ba8b-b8d9dd44cbd7", "comment": "Malware payload (Heodo)", "value": "0cbd5284056566e8bdfaaf34247aed2f14c40edd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492069, "uuid": "4b16c799-6df6-4799-b869-c878eea89dbe", "comment": "Malware payload (Heodo)", "value": "af14b251a43a3383c2569088a81d2d999df6317001897f29f031ffe3e8237e01c9fab30d8fc773770be5c5f36baaa0f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492069, "uuid": "f65e9b79-9304-4f5b-8770-f6aac528caf0", "value": "T13EE48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514D7432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492069, "uuid": "f6b251af-65c7-48db-b86e-9d2000d813b0", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492069, "uuid": "28dfff00-f0d0-48da-baf0-d01a3a7dc69d", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7EvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zaCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648492069, "uuid": "6623c14e-c4d8-430a-8e08-e336a6302839", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648492069, "uuid": "6a0ceb5a-64bb-4983-89df-bbe3f84519e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492069, "uuid": "f683ff39-e271-43b2-8e52-a7dd69579042", "value": "f71d0de8431853d478a4a8853df67299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742d536f-ae5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648448553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448553, "uuid": "a08f71cf-5023-4af1-9a30-f610ec6b9a1d", "comment": "Malware payload (AgentTesla)", "value": "9fbb9e75159615441bfd5a9e134260b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448553, "uuid": "4d01a936-49d8-4aeb-b96f-c0e5d3a30295", "comment": "Malware payload (AgentTesla)", "value": "c39a8dafb70b4adfb21ca557c23f3b81fc965c204bb70d515f8903f3205b72b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448553, "uuid": "56c6da94-e801-43d6-96c4-434badf06d6b", "comment": "Malware payload (AgentTesla)", "value": "6fcf2a332abc1a39f2b5388591e08011e04f0940", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448553, "uuid": "448eb137-f204-49af-b78f-29b6c862ce0f", "comment": "Malware payload (AgentTesla)", "value": "ab757d485c9942225b2766eef5372292c7558f04955ee644d501954c44874dd4c9e0f87ac5cc5ebd9a720129006faeaf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448553, "uuid": "4a9bdbe7-a51d-4f52-8a93-ae06fef040ab", "value": "T1D9242CC5E98455A0DD19AB716A36CD3542237EFDA874A42C28DE3E273FFB2D31026463", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448553, "uuid": "6d4bff09-a934-46f7-9d3b-f35264cc54aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448553, "uuid": "abe79bf4-e796-4c26-97a1-2e196d2c626c", "value": "6144:LhwBaAkzL7r9r/EDppppppppppppppppppppppppppppp0G:dP7r9r/+pppppppppppppppppppppppH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448553, "uuid": "55b19458-b854-4a28-824e-5a0a98e56f1b", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448553, "uuid": "1a50029b-e9b2-4be9-b6a1-987ba8856c8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448553, "uuid": "0ed69d63-2470-4655-875c-5d4267939435", "value": "Order confirmation 5679021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a40f82-ae6d-11ec-8e58-42010a9c0032", "comment": "Malware payload (BitRAT)", "timestamp": 1648454406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454406, "uuid": "1d4c6712-8af2-4a1a-a1c2-5b621a942b94", "comment": "Malware payload (BitRAT)", "value": "716a1f61392614685d2cc6ff0515e95c", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454406, "uuid": "1dd4e75a-02a4-4904-a65e-4fddb937a124", "comment": "Malware payload (BitRAT)", "value": "c4558d0d34144540099dcd2c4f0fa8651346c79ac99134cd18eae4e1e3cf84d8", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454406, "uuid": "baab7f4c-881e-4cdd-bf94-d3b940c7ed1f", "comment": "Malware payload (BitRAT)", "value": "62ab716975bdff33127994b24984ca3c33964557", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454406, "uuid": "925412e4-42b2-4a1e-be2c-e6a2557a1907", "comment": "Malware payload (BitRAT)", "value": "19092701b5651b57d1e6e9ac92cb9fc59c79e5fe22ab979ad5d26b336cf9193bb296317b8a36392392bc393670f00bf9", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454406, "uuid": "b32dbb2c-3f34-4bdd-99e8-38e0e9730e69", "value": "T1AEC5021F66078C4AFA84EB78DE7327550620E9B54879A303B7987929A43F6FD3B40307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454406, "uuid": "0bbdd24a-af95-4abb-b24a-fb3bd20361b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454406, "uuid": "e09d7fee-51b3-44a9-829d-35b17dc637cf", "value": "49152:xsdHQRpM/do5pCh1NowlXQ2qeVgCrjOSd500U47Y0TszhgDkPpfS:xsApMO61xVQ2rVgyxT0/i1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648454406, "uuid": "7d5ac386-a2d6-48b7-8705-b1d99a701cb4", "value": 2543104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648454406, "uuid": "c04cd403-1de4-45d0-aa28-92453eea9fae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454406, "uuid": "3a516883-9c17-4734-8c90-29910b6a1a22", "value": "716a1f61392614685d2cc6ff0515e95c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80e6e21-ae93-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648471028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471028, "uuid": "fcac8ee4-5a3f-46e8-92b3-4caeac978d02", "comment": "Malware payload (SilentBuilder)", "value": "88569981ee07f055958c91d71160e392", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471028, "uuid": "38c308de-baef-4787-9121-e05dd3a15403", "comment": "Malware payload (SilentBuilder)", "value": "c479c1806c05bd941d204fb4989ca5b79374a05d3d8ef8335d097f761d3ab040", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471028, "uuid": "e016efad-1e10-4d19-8ca9-992ede7623f8", "comment": "Malware payload (SilentBuilder)", "value": "406e5f48bc102dac9e6404361ae797523f6db7d5", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471028, "uuid": "635ad89a-eb78-4eea-aeb5-91ba7e7c54cb", "comment": "Malware payload (SilentBuilder)", "value": "2942789deb051327ecf52004abd0081785f2607e304b83347d7c213fa8d006cf19f689b3d29383318608b218bb9d8bd4", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471028, "uuid": "e2db477a-2fd7-42c3-ba09-3e7313063aa7", "value": "T17443E95BBA49985DEA14877548E743997323FC304F6B074B3269F3257FF89A05A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471028, "uuid": "e5999279-fe3e-47c7-8000-3aeaa920218f", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umvP:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648471028, "uuid": "d6a74bde-10ff-47ce-821a-f47d49eceeed", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648471028, "uuid": "72b22bee-ba41-4a47-b064-87bd301663e2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471028, "uuid": "2ef10865-9621-415e-9acf-6e338be6f70a", "value": "620641193559222362.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b3f756e-aeed-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648509392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509392, "uuid": "d719942a-702c-48c8-ad2d-d6f9678bd1d6", "comment": "Malware payload", "value": "88a5655e6fd20e0eebd43a0d9d6c192a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509392, "uuid": "d6f00338-4c7e-46b1-9068-8ffa5f323184", "comment": "Malware payload", "value": "c4d54c9c913a87aee8f0408fd1bb613b6d89b926327b71b70cd09491bfac7eeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509392, "uuid": "48106582-f3b1-4cc2-9d35-5ba630af6484", "comment": "Malware payload", "value": "0878f488648abcc5f73523fcfb4267c37f27813c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509392, "uuid": "ac5e1ed1-e6ff-4bc0-83b3-a6ffa2b3487e", "comment": "Malware payload", "value": "b126c9a2f2252c7a32d93cb5b3183004db5c5e3c71bb9291a978d395e904aec361b8ea2e33aa4444d1c0c4650606f91e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509392, "uuid": "daf7edc5-ce54-4b74-a0e0-58efaab79117", "value": "T106944947F292A0ACD16AC1788757E632F9327C0946247E7B27D0FE312F65B60A72D709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509392, "uuid": "1b975326-3112-4902-ab8c-ff101260df2b", "value": "d5c5c7ed64c5f797d22b54247657c19f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509392, "uuid": "19a9a707-ad44-47df-ae23-242f6144ca93", "value": "6144:HKGBdXQ1pAqpq9aoEAKz1OWGM/gRy/xewzNNsxHmpgnFaSf:qGB6Or9aXF//xeyJiF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648509392, "uuid": "4ee00a56-6d37-4659-8d8c-6710ec5e33f3", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648509392, "uuid": "de0a0484-23d7-4a3d-a21e-20fb0ab39eb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509392, "uuid": "a5a607a0-2bd8-4dd2-aaba-5e61ea8917b2", "value": "c4d54c9c913a87aee8f0408fd1bb613b6d89b926327b71b70cd09491bfac7eeb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa0c094-ae93-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648471040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471040, "uuid": "06769ee5-e3be-4784-a001-eb987e2b472b", "comment": "Malware payload (Heodo)", "value": "887feb2b9198251528c26e501112c492", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471040, "uuid": "c55e305e-fc0c-433e-9d69-4a05e6f23be6", "comment": "Malware payload (Heodo)", "value": "c5877720df8e06915d375a3958a90dd83edf6f28b69233c5930b141b96d6b024", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471040, "uuid": "b59cb504-61c8-4809-9495-f44d9dbacc3e", "comment": "Malware payload (Heodo)", "value": "3df00337a3b0c43bf42fc795d927826be3d48680", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471040, "uuid": "fa0961b6-189e-4c2e-b3b3-8cc17ee0b6e9", "comment": "Malware payload (Heodo)", "value": "692ba366cb06bf4abbdfa8c82387bdf36533f0a4af408181acb2160cdd7a4b4ed7c40f753ed5a87219da6c7dd87d6561", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471040, "uuid": "322d7a29-a799-46fc-b5b0-e04c03ee21a7", "value": "T10143E95BBA49985DEA14877548E743997323FC304F6B074B3269F3257FF89A05A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471040, "uuid": "24df6a88-7707-4405-9cfb-fad4f55277f9", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/5G9XSZ4umvD:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648471040, "uuid": "1133648d-6713-4c87-b2e1-9fb32133291b", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648471040, "uuid": "fedc5440-310b-4c12-a2a0-009d5cff2b71", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471040, "uuid": "63d613f9-e73c-4e9b-a79d-234596cbd789", "value": "HKR-010322 NKZO-280322.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f27b79-ae3e-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1648434336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648434336, "uuid": "ffdee7cc-714d-417b-9c2d-c31deaebe145", "comment": "Malware payload (DCRat)", "value": "7b9ffc1933f972edee7966d3b7e59456", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648434336, "uuid": "9353700d-7368-4e3e-9b22-e12a4daa68cb", "comment": "Malware payload (DCRat)", "value": "c59707855fa0cefcfbae71ab167db7b0cfcd4eb90628f984539dffc1009aa6fd", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648434336, "uuid": "ea8c26ea-81d7-463e-a8f3-488c558dd937", "comment": "Malware payload (DCRat)", "value": "a0f5e76a6ae037f8b2dd3728115106420ff89b6e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648434336, "uuid": "0770fdf4-18b6-4c1b-af04-c7c050ef17c3", "comment": "Malware payload (DCRat)", "value": "29f98280fa8199dc87880f81be153905dcb2aa2760f1ae0177dfb14fa7141143aa2addd39244fd740dd72d0d631773bd", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648434336, "uuid": "c646e29b-9c68-4268-92e8-7c7ede208c57", "value": "T1C265AD067A55CE43D0694733C4EFC12843ECAD462A66D75ABE8A33AD25013E71E8E5CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648434336, "uuid": "070597e8-82c9-48d5-ae86-10b92ae41ab0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648434336, "uuid": "d4d3455f-1399-41dd-82be-3afb6bea2f36", "value": "24576:UNNUtQhWhtqDfDXQdy+N+gfQqRsgFlDRluQ70eJiVbWpR:kzhWhCXQFN+0IEuQgyiVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648434336, "uuid": "a3dea797-8651-41c8-aa1e-ba78f0dbe279", "value": 1532928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648434336, "uuid": "c8ebb5e7-82d8-4d83-b4aa-a308e7115f38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648434336, "uuid": "d27559a5-42af-421b-82d5-c63ebc905501", "value": "7b9ffc1933f972edee7966d3b7e59456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba127a5-ae93-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648471034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471034, "uuid": "18b7eb6e-2e32-4d72-a569-2505dd9590fa", "comment": "Malware payload (AgentTesla)", "value": "92c11b7a171482052107c19b1b693ef3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471034, "uuid": "87396e47-cba8-45ac-8193-876b7dadb595", "comment": "Malware payload (AgentTesla)", "value": "c5dacb79bb5f1021b128deef833d1c45bea09c6c27a4a0da9f090509f256ec52", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471034, "uuid": "e139d2f8-1832-48e1-bbbc-6e6a2974cf05", "comment": "Malware payload (AgentTesla)", "value": "a21739dd4926377547c1b25e1829e64197e16d9c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471034, "uuid": "e9b4bdcf-f398-4cca-bfe0-83c9de9076da", "comment": "Malware payload (AgentTesla)", "value": "1e4e0512ff9190879cee4395712b6f4bcae478d5b2a250ce0893c8ca23a59cd16b78b724133a347e1c278d57285f5387", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471034, "uuid": "6a137ae7-a850-4ba7-8af5-d283c1f339fb", "value": "T13EB24011A794C265D9EACA3D5CF271FC0277BE03CC36A66BD4C5FF0E39312404652AA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471034, "uuid": "adb96ac9-b489-45a0-9b90-afed1db88a95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471034, "uuid": "47734d19-d66a-4a48-baba-fb58ba842e49", "value": "192:w3bcJsyiF+MwzepbyjYlPalcU6+x92Jp:abcJX9JepbyYlPal4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648471034, "uuid": "15b9348f-9658-4c26-b793-94969fbdfad2", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648471034, "uuid": "4bf68525-a98a-49cd-8cac-4053a4d29831", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471034, "uuid": "ecb75d89-c5d0-488a-8724-f0c91d9bd4cf", "value": "Doc51200013784.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e1ca7b-aeb0-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648483560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483560, "uuid": "b68d27b0-25e6-4ae6-9d36-f8ccf2f9b5d5", "comment": "Malware payload (RedLineStealer)", "value": "f5588229798ed2883521d26bc77b0756", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483560, "uuid": "6a5acbe2-6468-4bda-89ff-eba9bd12e657", "comment": "Malware payload (RedLineStealer)", "value": "c68962560934ff5b773428ce8a526719c78b8cbabe2e9e649a0bf832299e42a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483560, "uuid": "df78c072-5db3-4318-8b05-f6340fd0ea9a", "comment": "Malware payload (RedLineStealer)", "value": "3e0f30e4e94444390cefef4bac341f1861f48101", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648483560, "uuid": "ced3ca1f-9962-4596-96de-bb6c1725b7be", "comment": "Malware payload (RedLineStealer)", "value": "770676a36fa73c3f4d4194f52786bc00c148b4dbbbd8ae239a85429159a10b3a8fbd3bb933ed04f71845962fd9616891", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483560, "uuid": "6026a39c-d1ad-4b14-913f-3b49b41446c6", "value": "T1D584BE10B790D035F1F716F4597A8368B93EBEB09B2494CB22D92AEE56356E1EC30707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483560, "uuid": "99fab615-6328-4a08-b447-7619d43141d2", "value": "699070d0802ac292c6d967d0195e7ff3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483560, "uuid": "7cc356f1-ddbd-44e8-ad33-3a1cbea65c09", "value": "6144:ssuWi5CGTRzN6GZR8ERLlUahJjY3w7pXdQfJ9mh0RTXXU8t:ssu5CG9zN6GrZUWlXaJ9mWV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648483560, "uuid": "e9570602-ecaa-4c68-bd70-db6ae22dc180", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648483560, "uuid": "f2b033d7-c76d-49e0-b011-f98acb51209d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648483560, "uuid": "9b88bd47-7298-445a-bd3e-a21d7f22f033", "value": "f5588229798ed2883521d26bc77b0756.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2b3af3-ae68-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648452648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452648, "uuid": "469122ac-757d-4646-9ce9-3b5eb2ee0583", "comment": "Malware payload (Formbook)", "value": "dac618858b273ff789b0105759ee05d7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452648, "uuid": "85d5ea8c-260e-4fa3-b6b3-283a500a8ffe", "comment": "Malware payload (Formbook)", "value": "c6d42e65b825b78f5e3a0cc518beb540156f0008e914e17fb9a9a9f37d71cafb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452648, "uuid": "a194fe85-d85d-45e2-8a29-a43932690731", "comment": "Malware payload (Formbook)", "value": "7a4285a622d325d54cdfcc3c72b0321eca27b70f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452648, "uuid": "8a998d74-ee3d-4c6b-88d4-1ef6edc9fdb9", "comment": "Malware payload (Formbook)", "value": "0bf5c7f8c14e5a679f7c9045d1dcd336b3f52a9a8f7d15ee30f68f713fa3b09a3562826f765cfeb53555485175b1eff4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452648, "uuid": "c6da0f94-53cd-46ec-bd48-110feaee20bd", "value": "T13E141291F721DA11F99E1434E89BAD9890E4FC460A406C5FF5C1FAF604F5CA845B2E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452648, "uuid": "03ec7a22-1645-49f7-adbf-0f8a5b3ca3c1", "value": "3072:IEB8aojbJ5hIxtbZHpfrvftdWkPDEbU0IDhDAipVTmMXEbXpiLMsMlsISHHj:F8aoGxtbPbVPDEg0IDtRpV5UbZiLMsdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452648, "uuid": "e8c3ee9f-8719-4996-a6f5-0009acde38df", "value": 192344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452648, "uuid": "24fe0609-2bf4-4bb4-88d3-d388587c746d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452648, "uuid": "f7a78b4c-0f75-4358-ad9c-92549b2ffddb", "value": "PO 4109.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a47c8927-ae81-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648463237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463237, "uuid": "1ed39272-443c-4305-b082-8b2073c7aeb7", "comment": "Malware payload (Heodo)", "value": "27d9546076ec078f33ebb753f3a31617", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463237, "uuid": "6e52bfb1-8eaf-4a00-a3b0-e7eb2889133a", "comment": "Malware payload (Heodo)", "value": "c70ed5ad1accc9fef37c0a029bf35bfdaa9dcf25d1fe8dd16989c2c1cf534cbe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463237, "uuid": "520e8c2d-531d-40b4-8c77-989dd41e7630", "comment": "Malware payload (Heodo)", "value": "24049b3729747df56c375b058b576d69d1bf126b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463237, "uuid": "a5600534-010d-40d9-96e3-61dcb9642990", "comment": "Malware payload (Heodo)", "value": "5e9b6710c12380ddadc2f16e2c9ab57c291f53c275a28c080e9c4943ea19a3a8578e22b270c5b77b0ff8cff785f03c0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463237, "uuid": "759ffb00-46aa-4411-921b-da0efc943979", "value": "T15894CF0272D0C47AC6EF23785D239B5AA7F9FC208A75C647A751BF8D5E326C1893035A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463237, "uuid": "c4807aa6-f99f-4653-ad0b-5248f94d774f", "value": "8f8b1cb86c6697dd342b65a36c6ccbb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463237, "uuid": "5649a0c6-986d-4a90-9c26-52272d22c106", "value": "12288:zwn2hR3547jpDMgySgxpuCMS5AhugWarPU:DRJ47xjy7puCMSqumrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648463237, "uuid": "7501e790-8f5a-43f4-99ac-0ed4b9101ed1", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648463237, "uuid": "09eff185-8b06-4003-a518-c74a84de555b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463237, "uuid": "7e770c76-a784-4369-a63e-ca8af01a225b", "value": "27d9546076ec078f33ebb753f3a31617", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "500bef14-ae6a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1648453217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453217, "uuid": "aaa78c04-c211-4f4e-a501-9da5e3adb466", "comment": "Malware payload (Gozi)", "value": "36125e116418e73ba7dab25fe0d30f1a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453217, "uuid": "7aab31fb-83f4-4f28-9b38-f71387ce9b22", "comment": "Malware payload (Gozi)", "value": "c73e70bcabefab8d66385cb8a5fbc4a39451809dc778a19f8a177ee8254d0fde", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453217, "uuid": "521cd8a1-8fcf-45d9-929d-1ebb3cef9936", "comment": "Malware payload (Gozi)", "value": "78266b0607bce9968abdd941df997b330de6063e", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453217, "uuid": "3b35903a-0d75-4cb2-8e41-930a27c29231", "comment": "Malware payload (Gozi)", "value": "81acc018f126435164ead0d6f6f24124e1d3dcc553fec5e1828df29d4219b3679998f143c76dd4d9ba5188b75f6e016d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453217, "uuid": "781ccd30-cc5c-4291-be50-544a9526ef38", "value": "T15C630755B656D969D86907314CE7C7FB7336FC006E6B87073288B33E3FB8A948902642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453217, "uuid": "a09ace27-6def-4336-b4f5-77e146fa0dae", "value": "1536:4zLelYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0sd50qJIbnGl/j6msijOg:4zKlYkEIuPm3fNRZmbaoFhZhR0cixIHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648453217, "uuid": "497a3482-aea4-4149-a3b0-91458f396928", "value": 70144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648453217, "uuid": "24f4e920-b98e-48fc-9674-fff5e9d87e21", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453217, "uuid": "20737e8a-6707-40cf-9b39-e04936a81173", "value": "2022_marzo_FAT_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aff0fbe-aec0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648490199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490199, "uuid": "6aabe77c-e43a-41e0-a1a7-dc2130128bb1", "comment": "Malware payload", "value": "4b2a9c531b461ab518c2752138539c87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490199, "uuid": "26956ba4-71b0-47a2-9e9a-f79456534fde", "comment": "Malware payload", "value": "c76fad1f33ff3c6ef278984eb885771e7b42fcdcc88e8f3e5cd096a790f14c97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490199, "uuid": "1d63a57d-2b74-4885-83d6-6bf2bb62fdf8", "comment": "Malware payload", "value": "33946438d101f05d3fcd1bf1cda3f2ab9ef97e8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490199, "uuid": "3bfc3b5e-3874-4cc6-9d68-7b4b89d6e2ae", "comment": "Malware payload", "value": "0abd364765dc88183ff0989d5b5835f3cffb88e840e9f86ff7e83946f489e2504d1583d6212deca5311929b5cccf0000", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490199, "uuid": "6514b631-e2a6-4c94-ab7c-8a5470477a01", "value": "T16E25E61CFAE17A76FDBDC0B085918A18BB631F0736409B93178A39C87BAF1A75D148D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490199, "uuid": "8164b110-c180-4b16-bada-7b09ee5197b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490199, "uuid": "7dab36a4-edba-4740-9e7d-1ffdd932703d", "value": "12288:BdsbuTZ1+ZG+PRFZaf8ID0LdK1A8fwWh2bX2OdLfh/4giiMQ5pbHyIByy:jsKreR48IALdKJYWELp/4giihpbSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648490199, "uuid": "82c32c05-3bcc-43d8-b066-53879ff43fd6", "value": 968704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648490199, "uuid": "3c77db10-db1b-4d69-ba05-777a9ee0cba0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490199, "uuid": "ab2d467c-8685-4691-a9f0-b8a6519b95c4", "value": "MV. TAI STRENGTH - H2.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd4dc00-aeed-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648509400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509400, "uuid": "3b4ce81b-c8ab-40eb-a085-85f4e2120ce4", "comment": "Malware payload", "value": "4c1bafbfe8491c9c2e5b987209f96293", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509400, "uuid": "7c41a4cd-01a3-4173-8ced-6d5ca0d7dc9c", "comment": "Malware payload", "value": "c7c04bcd56f282bc27f160cc80ccab73485dd3123f2efb35b9726a8528b7950f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509400, "uuid": "a0d33b70-147f-4dc2-93a1-53342455bc0f", "comment": "Malware payload", "value": "ac1b2dbfe31488b9bb6f9104e1b33b78fbb51810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509400, "uuid": "dfa8ddb1-c46f-400f-8da0-db7570c7eeb7", "comment": "Malware payload", "value": "347234a9a0e7739bc4437506fc53088539ea7736a051f9cce64310d55f4fce5b4482d04565170a6062b62c4596b0dd7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509400, "uuid": "be031e3c-00fa-4fe9-9bed-7c89a22158b9", "value": "T19F943947F2A2A0BCC16AC0788757A573F932BC0946247E7B27D4BE312F65B50A72E705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509400, "uuid": "1b130dff-e52c-460f-a862-6b495d364a3b", "value": "40064c6eeb9f32dfc55bf2c7514305c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509400, "uuid": "9e247e4e-5741-4fd7-acc8-dc3ef3221571", "value": "6144:eyD39gJVd8v1934Wx/DSnsJOWGM/gRASu8ixez+AW1LmOi/4G32:eyDta4tb/2sfSunPNmOQ32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648509400, "uuid": "ff2a35eb-099b-4390-9dc2-6bc4a8073988", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648509400, "uuid": "995e32b1-aeaf-46e3-8f2f-39fe61630e9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509400, "uuid": "0ae0fb32-44d0-46e5-96d8-312d0d62a9d5", "value": "c7c04bcd56f282bc27f160cc80ccab73485dd3123f2efb35b9726a8528b7950f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8215fc-aee6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648506653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506653, "uuid": "76e24062-c8e6-4ead-a4b0-62dd7abdb4f3", "comment": "Malware payload", "value": "341610a5a0cc430f99f9f9bd694b04a9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506653, "uuid": "6f8a968f-8bd5-4252-8dec-b9282ba9267f", "comment": "Malware payload", "value": "c7dd490adb297b7f529950778b5a426e8068ea2df58be5d8fd49fe55b5331e28", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506653, "uuid": "aa6afe46-68b7-4e1f-af95-6ff67001dc3c", "comment": "Malware payload", "value": "9b520d709cee6c57fbaba38f38a667b0b0691e86", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506653, "uuid": "38b8be8a-457d-465f-a3d3-99fecd56d0d6", "comment": "Malware payload", "value": "3708686d3bbd3898ce70bebd3612c73f4bdbef4d16ddd94a3c44bfe93369fda022fb455a1e9dabd22d77c4cb4669acc6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FIN7", "colour": "#D49C5E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648506653, "uuid": "c8e22974-f50e-4df7-bfc1-fc8e1de9526d", "value": "T1C8752309FBD1D73AD8E74270015A5BE1733A8C2847948281367A752D3A72631FBAB3DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648506653, "uuid": "613aadb7-c785-4dd0-9ebe-f4aa3eda7885", "value": "24576:0Ltxfb5+PfLYk1eMavV4luzEMjor4Ln+oDSMrWRHeNDoH+sN7rUziacva0FmLZe+:0LtRbA7Yk1laewzjfCoDSM6xeNsH+Vc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648506653, "uuid": "0dddd2bf-9b6a-460e-98c6-60c771f44cfb", "value": 1563136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648506653, "uuid": "372543e1-6e6e-46a5-afb0-8b304efa359f", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648506653, "uuid": "2d54838a-73cc-4ce6-a522-9017d7e3d2e0", "value": "_______________.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9648488-aee5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648506302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506302, "uuid": "a9d1d4d9-f9b3-42d0-97f2-c44d7a14e8a0", "comment": "Malware payload", "value": "eb65145b66b6f213e41f12edae822e57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506302, "uuid": "357fa3d0-9e2e-4906-929d-19bab77272a5", "comment": "Malware payload", "value": "c8bac790b4750a7c4b0edc5642f17913c4268c4b1759ddbf7ff990ba9c0909b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506302, "uuid": "ff438dd4-e878-4c69-b974-014b6ffcf677", "comment": "Malware payload", "value": "9f89fcef4b9bd271d242ea3833ba7640240e4098", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648506302, "uuid": "5a8d3162-9c54-4db6-bfc7-c6d53952b372", "comment": "Malware payload", "value": "8561a7399ef19323232cb7422d9ad9e81ad4d6ca404f417f6e683d93d24dadba50b9787b4b67a688787aec383734a0ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648506302, "uuid": "a5e50ae3-4a38-49ae-80c9-a1528eb0834f", "value": "T1BD84CF10BB90C035E1B756F04979D3A8793EBEF19B2591CB62C46AEE5A346E4EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648506302, "uuid": "4f057f22-28c9-414c-ac59-fb3aaba80848", "value": "c5abd0d249bf5319619ab44b6b97960d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648506302, "uuid": "247513d3-2c83-4f81-b5ec-b90bab1e5dc7", "value": "6144:wM/eB9D+yR/A0SwVgTVb65DoRObi3KwJrYowdKdBTVwuL3gSU8csUjQOJjw:wM/+R+yR/A0SwCdUDQhJrYoikB3BU8Ug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648506302, "uuid": "d233837e-7635-46ec-894c-c70c58c18cb6", "value": 390144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648506302, "uuid": "304ec2b1-46c8-41d6-afdf-aac6d027cc9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648506302, "uuid": "f4ee0179-bdd2-413e-aa9a-406273387241", "value": "eb65145b66b6f213e41f12edae822e57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f95700f-ae6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648453780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453780, "uuid": "29cd6065-1fa2-483f-a3f2-9b2e95e7d6b8", "comment": "Malware payload (AgentTesla)", "value": "3e64d6718aeecd0e260f8b1e7ef16670", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453780, "uuid": "b19bc6ff-91ca-4b7b-9d62-29577888380b", "comment": "Malware payload (AgentTesla)", "value": "c8c4edf6f734ed7c7c493af95ea6ccc32b076162b3dfd4502f2fb607338f8caf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453780, "uuid": "82128966-e073-4f44-9e17-bf0032bc4d41", "comment": "Malware payload (AgentTesla)", "value": "2438d4b2ef8b79c861ee74db67e3955dad388117", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453780, "uuid": "e18daddc-b677-4de0-bf0b-ec55c1abbe85", "comment": "Malware payload (AgentTesla)", "value": "9d29a54a73e0ac91cef2431da20e9e86f96b30300e03c3d0be77bf217fe0bea6e1e6dce75e172a3e3e630084fd62fe69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453780, "uuid": "6ee86dba-9232-4d2b-910f-1b46c89c11c6", "value": "T1519423239F65934BB94AC5BA1DA82D384EBB5C53869E60F513E05C835F8B1F51EFE080", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453780, "uuid": "19cad3bb-1809-4f53-9052-bd9a14892e0a", "value": "12288:LHXIDrmkcIi1bKQFWrMD5QmMEW7uxgQhSeihsUiT:LHXYrD9xuxJNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648453780, "uuid": "16aac3e4-0b69-4371-b4bc-5e18f80e3c1e", "value": 408442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648453780, "uuid": "11d9694a-2d4c-4bdd-93d2-e4491246be43", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453780, "uuid": "03ba4e8d-c075-45b7-8730-fd662898858e", "value": "SHIPPING DOCUMENTS.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78bf9f2d-aeec-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648509120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509120, "uuid": "9d1ca6de-8e25-47a2-b420-ff290cf9b137", "comment": "Malware payload (SilentBuilder)", "value": "759c966cfdd0343c437b095a11de3233", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509120, "uuid": "77ddf08e-ac1a-4008-a2b1-26355a64942a", "comment": "Malware payload (SilentBuilder)", "value": "c9337812b9d996a71cb0b1f7dd134bc65b529f1af4cc8e54c18263af6be49a3c", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509120, "uuid": "3f21a6db-6fae-485f-be54-90ed61fe5dfd", "comment": "Malware payload (SilentBuilder)", "value": "995b3fae7b45cb32440adeb680a04e89f2852abb", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509120, "uuid": "c1cc23d4-62e1-41c8-8a33-535baa8b44b8", "comment": "Malware payload (SilentBuilder)", "value": "651fb64d193be795b775f99b98eb700984dc7151f301455749867a08f30bf6e5813aaffcaeb8411201cfc935ff4bc10d", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509120, "uuid": "f65f995c-fc50-4ec7-bc3f-bdbdeedc80e8", "value": "T1FDC3AD8BB659486DF921877488DB879A7363FC344FAB47473214F3366EB95A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509120, "uuid": "47848140-7678-47cf-8cb4-079dfd72b0a2", "value": "3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlCB:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648509120, "uuid": "a5cab76a-7c47-4f11-ad4f-f91a18ad7840", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648509120, "uuid": "115b5dec-4667-4348-82b6-1f27e3efd8ef", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509120, "uuid": "dcc3e1b5-6b71-491e-b95e-d66b667742c9", "value": "759c966cfdd0343c437b095a11de3233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7fdb581-ae74-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648457713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457713, "uuid": "c5ff7e87-bae9-4fc4-8910-acde4c9613dd", "comment": "Malware payload (Heodo)", "value": "863e031bafcb61e3bea1bf53d9aa0aef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457713, "uuid": "4bb305ec-a803-4d97-92d2-d72443a200dd", "comment": "Malware payload (Heodo)", "value": "c9507bcd9d1ed409f9605d943d22038db5e8183d44014fc0798dd8c4f8b8ea9b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457713, "uuid": "9159dbc3-b1c3-4a41-8f1d-6cd90135ee77", "comment": "Malware payload (Heodo)", "value": "054a3ded9f6747490f9704eb82c7f2130d4300d7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457713, "uuid": "d4929cf4-9264-4bab-b697-31efbca83b21", "comment": "Malware payload (Heodo)", "value": "87ac64792d29cc9094147f8cab0208d310e2ebcb5c0ec8a0455f78f8593249f2372f18e1e788fad501cb778963f5b70c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457713, "uuid": "12a3004b-73c7-4c9e-bd93-83cd8565f326", "value": "T182058D623083C8B3C3F9B37409829F589F65FA9593B31253EA90157EFE748E5A3605D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457713, "uuid": "0f2374f5-b9e8-46a4-9de2-364959dd372f", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457713, "uuid": "cf3c37ad-345c-44e8-a997-d7f65d003321", "value": "12288:Wvz1CLJyyvmMLSrBgB4ruGbPlVpqb+DlYzv:WJCLJyybLqBo4ruA9VAqDlYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648457713, "uuid": "71dc38c9-2b7e-4fd8-a522-c540bbc6fe27", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648457713, "uuid": "2874b3ac-ff7d-4aac-b0f7-56203fa4adf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457713, "uuid": "7e21627e-d258-491d-8c6c-e23a6f685e61", "value": "emotet_exe_e5_c9507bcd9d1ed409f9605d943d22038db5e8183d44014fc0798dd8c4f8b8ea9b_2022-03-28__085458.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf15f4e5-aee0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648504084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648504084, "uuid": "fa06bb17-77e4-4d72-8ed2-b153993ac070", "comment": "Malware payload", "value": "1c3b0533f20485c2a6af66a2256a35b4", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648504084, "uuid": "26b485c7-20b8-44bb-84fc-e9f012ca9a5f", "comment": "Malware payload", "value": "ca57443a311bd7b4476d7494c1774887985760f1a758847380b5f10da3bed878", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648504084, "uuid": "cfffdacd-ce04-4179-9199-b677fed3a06c", "comment": "Malware payload", "value": "97fe3417835e949665fcd6914b1150c4f3339e8b", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648504084, "uuid": "cbac83c5-f26c-44b2-9481-9a84de3917ea", "comment": "Malware payload", "value": "25c42151f3298aa0564c95d0d4819793cea993b0816a73e39a83917143bef1732e97a9c0c3f44474865a7aa3e9fc044f", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648504084, "uuid": "f1ad5af4-d504-4d45-8c2f-4499d1c6fa36", "value": "T1AF01DCB1A0A940780BB1F2BBE537A803A330D19820C1D7DC848E415CE2F05ACCB20BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648504084, "uuid": "d4cfbd91-bddf-4469-84df-2c9b75589e8f", "value": "12:x3voQByxH5QwMO76vL+esFskSX7v7SEGSRrF7tdgwA4qkz6gtL:x3QUyt5QwMI6T+eKFk7zSEdhtWwF6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648504084, "uuid": "5f5c083a-7b2e-4e54-ad42-4c80b4d6bbe4", "value": 759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648504084, "uuid": "9372549e-6c71-47d2-b9f9-6e3a288fbd9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648504084, "uuid": "9222008b-f579-468a-8fad-0fff51eda7f0", "value": "wxC8Dx9G.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a6988f-aedc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648502271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648502271, "uuid": "efe179a2-d2a0-4f1c-9d8a-3028f1a0be9d", "comment": "Malware payload (AgentTesla)", "value": "6244874e66b989744570cc0e5c6f9009", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648502271, "uuid": "bd0cd6ed-d1a0-4eb4-b83c-01690edb39f0", "comment": "Malware payload (AgentTesla)", "value": "cabb729d56cb69d7c4149ed0a6f47125fca37c6331877195e2598f236d095cc9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648502271, "uuid": "0e35ff5b-b9a5-427c-925c-ee1f69bf7eb2", "comment": "Malware payload (AgentTesla)", "value": "9a6a5f252cc24aefc5e6046657a024d140ee1d5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648502271, "uuid": "58331311-f100-47f2-b585-42f6e4feef99", "comment": "Malware payload (AgentTesla)", "value": "e1f13ea109ca757cbc1280d1ada90ea492b641d06713c8d373188322008d89bd9dc684666b1f41b588f4c0b2e8214c58", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648502271, "uuid": "ff9796fa-e1cd-469b-8e78-292b57a437fd", "value": "T18DB4BE32D3F82F5BE17A5339542094153BE6E74BB228CA45FDBA30A68572BD24172F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648502271, "uuid": "689ba3ed-ff68-42fd-b401-d134045140f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648502271, "uuid": "a736000d-7f5d-4607-b707-3a971a9cffe7", "value": "12288:aXB63Qlddc/gjjNHyOw3uSIeBz9QaOrmGOydT1rRysRlnb37O:6B63Ql3c/gjjZr2uSIKz99OrN1yYba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648502271, "uuid": "c886cde0-1cf2-4c18-a483-d2ba95d16dca", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648502271, "uuid": "ea583bbc-dc2b-4618-9406-7023683084e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648502271, "uuid": "2fbd46af-1e65-40ee-961e-7beaaeae854e", "value": "PR 11442066__S10-346-17 PROJECT__S10 (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c0673b-aecf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648496574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496574, "uuid": "bf1e14af-e147-45f9-b64a-10e6662622c8", "comment": "Malware payload (Mirai)", "value": "098198c4da964e100887c68c0620ac1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496574, "uuid": "b925b6d5-f88d-456d-9614-4ca7d17eb368", "comment": "Malware payload (Mirai)", "value": "cb0a2f56cd26485a2452b040545b445f4e3fccfdc179d12c212d913a552a66ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496574, "uuid": "86ce6c9b-6d1d-403a-afc2-172f98fce4be", "comment": "Malware payload (Mirai)", "value": "be3b1e5d2c0eac78773dc855c69d3ec732fc3b49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496574, "uuid": "6befd678-0647-4b98-ab87-89a83cc05468", "comment": "Malware payload (Mirai)", "value": "1842cd114b248975fdaffd62bb24bf210ffa229d09044a8a21b2a1fd9b17156a8742b77b073092d9b2cffec949d6892e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496574, "uuid": "ef3a3966-6e60-4c53-9106-87bc47157498", "value": "T192432925AD792E26C0D8B57E11F78724F2E2220E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496574, "uuid": "4e115b7c-ff70-4e59-81f2-ab81d0fabeaf", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDS:eL0AxvSHfymp0xgunvCkV6vTMDaud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648496574, "uuid": "ad9c0387-5722-49b1-84c5-28205296fcad", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648496574, "uuid": "4984c0a0-2793-457c-9769-5330cafb0718", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496574, "uuid": "7be0ca0e-5f44-487c-8921-ac5e8e790889", "value": "098198c4da964e100887c68c0620ac1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6b3dde-ae68-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648452409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452409, "uuid": "0c048f86-d938-4b19-b97b-76b2df9db5c2", "comment": "Malware payload", "value": "f1bee416a65b7d30e411a7815b13b920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452409, "uuid": "571ae47a-b121-42b3-8227-4dc48951940b", "comment": "Malware payload", "value": "cb85de2eb5fb145bd1201351e0932ea763cf195f1b90123cfcfa752ea45556b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452409, "uuid": "7000fd68-e83e-4975-b589-806b68cd3f8f", "comment": "Malware payload", "value": "f7540e096f8441d311e3404aeb862e13b77797fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452409, "uuid": "31a6b865-3d3b-4215-a4ee-69bfd7d653fd", "comment": "Malware payload", "value": "c71bb893eb3c1d14ae1e0aaad3fbf283cf872b144784bdd3ef77c09f6cc30fd53e520a58e34066513fb62b4cf5c268fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452409, "uuid": "844b4a44-bc28-4ed0-a878-66c56fcf5b1e", "value": "T1A15209A5BB98C6F4C8621AB96DF356122738F213E8255F0F7589730B2D2321245F2B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452409, "uuid": "b44d0985-581a-4cce-ba45-0641040da884", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452409, "uuid": "b093f60c-7e43-4668-8f3b-70cf069cb6e2", "value": "384:p8BKrmWLQnBKL9iiay9ycyrsR2vZMtYK:H7qBUycyrsR2vZMtYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452409, "uuid": "dff0b8ce-b38d-4a0b-b2f3-0aa78c6dd4af", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452409, "uuid": "5fcc5eff-f501-4a93-903b-57cbf6521fff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452409, "uuid": "08b2e072-1fee-4c76-a82e-75f00995c33f", "value": "446790000000000098656789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97036af3-ae95-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648471804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471804, "uuid": "5679ee7d-8447-4781-9ca9-4d4346a967c6", "comment": "Malware payload (Mirai)", "value": "519904da1dbbd507a5933774634b6fde", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471804, "uuid": "f90cfeb4-cab3-4c3f-8170-e10e5de8a011", "comment": "Malware payload (Mirai)", "value": "cc46d1ebf4a1478eed4c04e9d59298089d9378e3bb839f8de675485329cf377e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471804, "uuid": "34516f1f-a280-41d4-a20e-81023b4539da", "comment": "Malware payload (Mirai)", "value": "3a88beb8444d5820dae663732f14ee24445d397c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471804, "uuid": "c1c5ccd3-9f40-4061-9b40-7a399681f654", "comment": "Malware payload (Mirai)", "value": "00e5339a4ea9d743eb67af97ccebeaeb26ece7ecd4e6257376e4bf2c90e494389e885063619468d49817597ad718c34c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471804, "uuid": "86193a2c-e35d-4044-a833-a1ca921bb0d7", "value": "T168F33B46EA408A13C0D62776FB9F414A3322DB54E3E773069D28ABF43F8769D0E57609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471804, "uuid": "ff2db2c7-d772-4030-b891-95dac2a0fa76", "value": "3072:KcIcrQ1l9hMi+M92a/5xvYuDw8QdTogtLFjGEKM/9q7thr:Kcrral4Dq2a/5xvYcw959FjGFM/9ghr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648471804, "uuid": "64aec485-53d3-4a0e-86c1-43ff3cc97ed0", "value": 161192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648471804, "uuid": "bc6f2263-9331-455d-8020-30aef6b393e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471804, "uuid": "a6863c0c-04a8-45f6-a93c-0a1cfe47b3dc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec9dd2f-ae6f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648455658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455658, "uuid": "cba4023e-9d1e-4f46-899d-68f42a887281", "comment": "Malware payload (Formbook)", "value": "4651dc452d55f8ccbd753e48e2ec7c27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455658, "uuid": "a880a0c4-8ea5-48cb-83e9-e0baccdd4e8d", "comment": "Malware payload (Formbook)", "value": "cc607d75c355df2d67744ef55562438e4e117f03546999c96bc1b455b9bef7aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455658, "uuid": "140033c1-3a8f-4f6b-bd8a-6ba7d998c826", "comment": "Malware payload (Formbook)", "value": "6defeaa7582791b9dd2bcff0c5a8b452b343f624", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455658, "uuid": "31b9ff04-8ca9-4382-a794-6567ea6f707e", "comment": "Malware payload (Formbook)", "value": "2611e1a18983250a1f6cdfda4d7d3f4001544ab2cd62cbd83e0db8d27b327bba51041f8ef784e978277ef4e869288c64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455658, "uuid": "299c36bb-787c-49f6-9693-99f0eaeee1ed", "value": "T155522065F1F887A2CCAD0EB55479476C3263E31B66F2D62988EF64054F1F382C305EA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455658, "uuid": "6a303917-d692-4c04-baa6-e72944db2b8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455658, "uuid": "583a0753-dbed-4094-8ce1-52816543ab97", "value": "192:bS/0qwgfyuLPgQZV6X4t/GI88ek3TPCwLbYZ7f0iUDSVj:bS9Rz3V6X4sN8esTPCwLbYZ7FaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648455658, "uuid": "2bb4a8e1-72e4-4a9e-ad90-6b1b89a4b448", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648455658, "uuid": "a4e8b462-7e30-413e-ac0f-a786e7b3c98b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455658, "uuid": "ba3e038b-0187-47cc-8b6e-1e0beb93beb0", "value": "4651dc452d55f8ccbd753e48e2ec7c27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8b1a98-ae6c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648454283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454283, "uuid": "e2248c64-ec38-4b9b-bcd6-1207a06140df", "comment": "Malware payload (Formbook)", "value": "8d4a4c48639dc2ea5557ab5b8004b479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454283, "uuid": "51655713-d14a-4f36-9c6b-10cb85a6922a", "comment": "Malware payload (Formbook)", "value": "cc7308b7f5cd8fdd0916e83b1463f989c3aa03ef2516c6f2a24db3ebe62a41f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454283, "uuid": "e661d6cd-1dc9-4f42-959a-736220e8ac58", "comment": "Malware payload (Formbook)", "value": "35e4de534de576b02ca9e1fea5bcbba917213465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454283, "uuid": "c6dd8990-3748-4d42-af05-cf4416aedf1f", "comment": "Malware payload (Formbook)", "value": "002298d9328ac38429854809a3641326ee78375e82b2bd54fe1b9d9aaa052859983663b5efcc459efcc9a47131c8c4cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454283, "uuid": "54960ebb-6006-4ee4-967a-57258fb5b354", "value": "T16D34128346C1A977EED10EB15938BBF9D7B3D2C81386350B4B410E6A5D7226E470F6A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454283, "uuid": "4ed1df76-48a4-4c74-a24b-b041f5a80407", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454283, "uuid": "8420d2ff-6710-4b39-a09d-24b0e12395f6", "value": "6144:rGiDOq1DPctBNMzoFEtRy5C/pNn+MujUP7Ak:vOqqNMzjtRy5CxNUg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648454283, "uuid": "2e6d7edd-52d1-4c25-80c9-6439dd4abe2a", "value": 247513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648454283, "uuid": "e923d242-e294-4f37-8b9b-6b1d17748536", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454283, "uuid": "adbf1fdc-c3c6-4ec3-a458-86808c8be325", "value": "8d4a4c48639dc2ea5557ab5b8004b479.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beecb87b-ae87-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648465858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465858, "uuid": "38448304-2666-4816-be56-cd894701bcc4", "comment": "Malware payload (AveMariaRAT)", "value": "1970ee532e67cea7c426a908514f92ad", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465858, "uuid": "5ae429a2-1874-4555-b201-a5977cec4556", "comment": "Malware payload (AveMariaRAT)", "value": "ccac7d7c6ca6c4e150aecdff111e503746b0eb8a03d50a702605697616d08ab1", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465858, "uuid": "ada9f72e-d8e0-45bf-8e79-256f454ec928", "comment": "Malware payload (AveMariaRAT)", "value": "29b40ca1e98a596908e806a2b52515aad4cd7703", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648465858, "uuid": "b197f59a-0cbb-4cab-b46d-4778a0eecf58", "comment": "Malware payload (AveMariaRAT)", "value": "94a3d971701ddc2d2bc8521dbbeb4c15c35e75dbc928c949d56c54d138b51efecc575d01577305108f9dfd47df1a79b3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465858, "uuid": "d5481336-500d-4e16-8323-b19c9212cfe8", "value": "T1B2F4B5A8B1F0B19EC597D135CE54DCB8BB502C6A571B410F90E73DABBA7D583CE102A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465858, "uuid": "f66801c9-6295-40c9-992f-7f352dd672ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465858, "uuid": "d321b156-0c4c-4128-9bca-df55d60bbbb5", "value": "12288:PfXtARp0FXOlW1YDd5DY0dGj5eUlVMFqb8xs8xpQiqBbHHmOyH6vxCapK1yKpKn/:PfXt+yO814jDY0oUGLqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648465858, "uuid": "78d71336-f000-4c60-bc27-992cab2e2310", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648465858, "uuid": "834033f8-53da-406a-95e9-c873d7b9a4a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648465858, "uuid": "776ca57b-fbc9-4d1c-b803-6fda3f66db38", "value": "PORT INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5446e78d-ae3c-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648433467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433467, "uuid": "165bddc7-f53c-49a2-b37f-4bd7a9ef75c3", "comment": "Malware payload (RedLineStealer)", "value": "146c509946ff3931cb5c1c9aaf8c2993", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433467, "uuid": "92d61824-6fcf-4d61-b505-2f534d14006e", "comment": "Malware payload (RedLineStealer)", "value": "ccf934ce8ee5825e7c58744b41bdfe4d1209a4da65fda2fd10913d76d5339bae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433467, "uuid": "79ec8fd6-9ae0-4657-b50e-82e77d57482b", "comment": "Malware payload (RedLineStealer)", "value": "5b46867e860ca69da6607ac13796ff3dd4d32198", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648433467, "uuid": "49559d68-685e-4410-8c50-19816dedcb3c", "comment": "Malware payload (RedLineStealer)", "value": "e31fb5379adf46d2289d350471fbc6409132a72f3585cad3ff604a59ce87e716e76e295d7fc35329c346377ff7a63844", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433467, "uuid": "62d502b7-b453-4545-8e31-7215bb679da4", "value": "T1E9B33B6973CC5624E5FF8E7478B111D546F0E1A27C12D79F4EC5B0DA0A26B80EB12BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433467, "uuid": "47c7dd1b-6bc7-4e58-bc81-68eb4a0ed786", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433467, "uuid": "c89763e8-02d5-4c93-b2f6-7ae4ebef2ca9", "value": "1536:lRxCkCrZQ2IlApcGWhGTStL8xedLrmf8H0FvwGbuZuErIlWCL0wuei6JL3:bCrZQqqRrtKf8HInGElJLh3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648433467, "uuid": "22c557d9-30c2-484e-9f24-8adcee162607", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648433467, "uuid": "67a5c97e-baf1-413a-8de0-984435e54a05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648433467, "uuid": "04876315-89e3-47ae-ac87-4a4d734352eb", "value": "ccf934ce8ee5825e7c58744b41bdfe4d1209a4da65fda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8cb65e-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448188, "uuid": "0e9a22e0-1c7d-4a13-b21d-721f4ffd99a1", "comment": "Malware payload (Stop)", "value": "6eaf1f1b833c6a4996c48a58fbe843c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448188, "uuid": "84b79b91-11d2-40b8-917a-df05420b8404", "comment": "Malware payload (Stop)", "value": "cd3906a284a4c8b87e7fa8162a059dd893acdde7d44ee4991a43b5c3b67b7b56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448188, "uuid": "a32771fa-260d-4c39-9e89-b10d94c1d1e2", "comment": "Malware payload (Stop)", "value": "e8b430fffc41c4f75c5a455fede963ada1d80e99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448188, "uuid": "7fdaa0bf-6f4e-4e3f-80e0-3a167a57f6c0", "comment": "Malware payload (Stop)", "value": "2162effa4bccc76f55779d9746f6b273fd214651b29a1703fc0048ee0b5eef13cc3856ce584c9a233d1f4dde73a054f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448188, "uuid": "21363d2e-c533-41a1-b472-de99b73dea8c", "value": "T17FF40200B690E035F5B752F4897A9378B63E79B15B6414CF22862BEB1734AD4EC3235B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448188, "uuid": "ad6ac1bb-8cf3-4f50-957c-f2b85313fb8c", "value": "deca2b4731d9efa027759fcb7d7a6a95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448188, "uuid": "5fbacbe4-d7d4-4e47-9dfa-48243e41c8bc", "value": "12288:BTSa68KNEUEEDmDPuZZs+PD7/CRlsLHgT9h/yPnTLOQg2Xy8IqlMdxhx:969zvm7CZh/ysoT67H0hrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448188, "uuid": "295f3c96-a4a6-4b99-9be1-57691211c812", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448188, "uuid": "f01d4498-77b9-4a24-a5e5-838348a35ffd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448188, "uuid": "4e3cc159-0074-47c1-98a6-9acc15c2185f", "value": "cd3906a284a4c8b87e7fa8162a059dd893acdde7d44ee4991a43b5c3b67b7b56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1577c2d-ae6c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1648454266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454266, "uuid": "9968b907-ad13-411b-aed8-91f751849a07", "comment": "Malware payload (Quakbot)", "value": "40e27db466ac401d59685da3c9375be8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454266, "uuid": "91d34923-6893-40f7-824c-94a8d11332c3", "comment": "Malware payload (Quakbot)", "value": "cd871bba189d1f905d3258b433e2ec3a5edc2df934508eebf98a1d800359cdf6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454266, "uuid": "de8ef90c-df96-4e31-bc1f-fb4fc7cde932", "comment": "Malware payload (Quakbot)", "value": "b70c082c7ee667574b317b3732ce9f4710c3a312", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454266, "uuid": "e7e14846-5cec-46de-9756-7579a601dcc8", "comment": "Malware payload (Quakbot)", "value": "d87070180e2132d0f3c648eafadfd0c64679b8593d9f0a841beeb2675814a3971aeee2d79d76af3f428d48b85a1b31a4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454266, "uuid": "da3ac83e-99e7-4d8b-8132-b4e81d2c6ebe", "value": "T110059EB8794818F4D7DBD63649ADB8B9137332635AC75C89015DB3C20A7F362AFC1A09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454266, "uuid": "24122d3d-ee5d-4ff8-b6d7-96466c4ac25f", "value": "bca36259321c5f1206488d971142e716", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454266, "uuid": "330ce9cd-1fde-4208-9b49-2f9c72ca72b5", "value": "12288:rXVyvDn5CX/JYLL+wLg+aCsnnzxS/WZ6xyK4zxfDoN+wLvp96GvZvc/ZscKMu:DMb8vO3xsNxFm4zxILRtxvc/ZdKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648454266, "uuid": "8e117fdd-fd3b-41de-b18b-470269ac76e5", "value": 832919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648454266, "uuid": "63c8a91a-fec5-4cb6-802c-1e1ed8634e8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454266, "uuid": "29762116-9001-47cc-a690-39afb58829e7", "value": "dsuh.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ba11c6-ae5e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448183, "uuid": "8453fb1d-1ffb-475b-8470-2c2eb9dd1cc9", "comment": "Malware payload (Stop)", "value": "a458e4cce60e4ab1559a84ec4fd75609", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448183, "uuid": "e7e3e976-9736-4dd6-bbb5-426aebafd1c6", "comment": "Malware payload (Stop)", "value": "cd9a617c3e9eb28de5b4f7d449f6b052757bb92efd2811c4404ed2a83e00ebcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448183, "uuid": "312f2d15-6981-4b72-8c85-022b6ac6f25d", "comment": "Malware payload (Stop)", "value": "20a62f3473fcd86f30f479ffbd074a163f7e158a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448183, "uuid": "68b01c73-ce6d-4b51-aea3-827777330bc2", "comment": "Malware payload (Stop)", "value": "38e77c1d26a16d14e3ac12d3920a695ca865e365979b8eadb5bd3aeb151db0e1b595962ebde1f2991180da31c2f918a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448183, "uuid": "cec7fbdc-4599-4cb4-a8a7-086943fadd46", "value": "T1AFF423413A1AA833C00550BA3161C677957DDF687232A8079E1AA35D9F3A6C1CE7FF17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448183, "uuid": "62f48734-f083-463f-ac88-395535ef093f", "value": "98af1336ee9a8378f1e2c2d0d9027760", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448183, "uuid": "0ba74752-ec57-46f6-a46f-144e76c66626", "value": "12288:MpNh8m8AgXaX+dTak9oB5E9BhhQQVEBVWwLicJz/sIVAH:Mnhh5glaBm9BhaLW/wjV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448183, "uuid": "03c194e1-d56a-4d18-96f1-a6009e686b80", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448183, "uuid": "30ef5239-7cda-49ca-b9ea-58a459c23bec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448183, "uuid": "9c64eaa6-cce9-48ee-ba47-88f1f56bb01c", "value": "cd9a617c3e9eb28de5b4f7d449f6b052757bb92efd2811c4404ed2a83e00ebcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc08f431-aee9-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1648507971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648507971, "uuid": "ea1aa6c2-fc19-4f60-bf8e-1c44ca1a2f86", "comment": "Malware payload (njrat)", "value": "0e694e0d4abaa19f26a30df6af437167", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648507971, "uuid": "83e234c4-a23f-434f-ad74-4936a8110b16", "comment": "Malware payload (njrat)", "value": "cfbdb438283cbf0f560c5afe99c0a349b9bb73db651bff88be2ea928860033d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648507971, "uuid": "4d6418d6-522b-4909-9cee-a60e9cfa783c", "comment": "Malware payload (njrat)", "value": "9ed6e807634ba1200d605df3f3d47976edfd33dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648507971, "uuid": "5321715f-2bab-4774-9575-ec1e75af6cd8", "comment": "Malware payload (njrat)", "value": "d4fe44bf46a7b82b4e74ca7265c244389a3c8653942adf71e4767e16ce27588e393ab6f7a3a9ebb26b3609581bbb95ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648507971, "uuid": "50247136-ae3f-41f4-9566-29dfbe935daf", "value": "T113032B4D7FE18168D5FD067B05B2D412077AE04B6E23D90E8EF564AA37636C18B50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648507971, "uuid": "be15d8b9-b8b5-4484-86b9-5120255b1ebc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648507971, "uuid": "f9d642f5-3328-4187-9e66-520fc70d728d", "value": "384:rbSvEiTbTvpWNcZ0y8fvCv3v3dwLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epz5:3S7TZ38fvCv3Vw1c1rM+rMRa8NuK6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648507971, "uuid": "54e6c1f2-c6a3-47c9-98c5-29545759af64", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648507971, "uuid": "5067cafd-86a2-42c4-8d6f-27283e4305ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648507971, "uuid": "ed61df21-ff8d-4fc0-bc79-3bf4839665b5", "value": "0e694e0d4abaa19f26a30df6af437167.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4437129e-aebd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648488845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488845, "uuid": "b83feeb7-52c5-4170-a715-4077ebb0b85b", "comment": "Malware payload", "value": "5e4334f9e8452990f42a2aa1504a1063", "object_relation": "md5", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488845, "uuid": "fdd7628b-66a6-4f7f-b034-9f54ed826608", "comment": "Malware payload", "value": "d08430ad21c7a08c68416ad117358c281e8d66c1eed9c8a5a044af66488369c0", "object_relation": "sha256", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488845, "uuid": "8f98871c-809a-482c-8754-6ce8a58777d7", "comment": "Malware payload", "value": "5d3af21b48a0ee8a12f9b8bc2060a5f8495696e5", "object_relation": "sha1", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488845, "uuid": "84e63e97-cb0a-43e8-ab32-62a7abc171d2", "comment": "Malware payload", "value": "2bde399ba8236116d1bb7848a7dcedd32c760f6e10869269c9c2711a97a5ca8c5f8d9bf7b1bee6093939b0aa71d6cfec", "object_relation": "sha3-384", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488845, "uuid": "7501e94b-c9b8-4ba4-8b13-3c2572ec8f7e", "value": "T1C4D52A17FAB250E1D4BAC2399293233BBE7175A8433097C39651961B4F22BF4B53D788", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488845, "uuid": "5d44dda3-5390-425a-b948-df531a3859ee", "value": "3d6687061bd2ab02d113add0ae40a140", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488845, "uuid": "c81ec34b-a941-4815-a8bd-38ddd5de584b", "value": "24576:HhRA6qxLx9thcjTcK8XhQMEOihXXna3BDUH7u9MLgmrGBVzNdvrcVh79r1KPB3DA:HhGHtM8XqqB45rL8pfxZe1+JPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648488845, "uuid": "2606e43e-b764-4a7f-a6ea-1cca30eafeeb", "value": 2928128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648488845, "uuid": "0ec6213b-f392-4fc3-a865-4e2a477fa90f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488845, "uuid": "72f15239-6b61-432a-8dac-887db1a7e28b", "value": "tbpaeheacddx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d3e4aa-ae6d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648454671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454671, "uuid": "ce5dd9a2-5315-41e9-8801-f55d3c787734", "comment": "Malware payload (Heodo)", "value": "d48376092b76738861ac09fd358e0e74", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454671, "uuid": "3b4149d9-1ef6-4c39-9fb4-6ec17f391dfa", "comment": "Malware payload (Heodo)", "value": "d1600c0d1ea16d978187a1141e7bb813223320a66f8b85827b0f46461bbe10f8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454671, "uuid": "a1aa3e22-c9a7-49da-b699-12c48e105387", "comment": "Malware payload (Heodo)", "value": "b82105f441d73d9e369d8cb2b1aea72d6553e293", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454671, "uuid": "19a34d59-e7ea-4641-b651-7601c6c25bea", "comment": "Malware payload (Heodo)", "value": "e74e7400e71f20c534f679ea7e09d4f0cd7472fec24a894c8269a281efe4c43cbf7107b902711f8fc23b9ca77dfa29f2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454671, "uuid": "4908bd1f-d590-42ef-bbae-9cd5446a7b10", "value": "T147D47C0EFFD1C1B2D36B123019D5C64823ADBF2CEAA1C5B777A8BE1D69326C14512B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454671, "uuid": "9b0960d9-e62c-43f1-83c1-641db1bd880e", "value": "d63ab94f4bb6b5d2f0f6092bf07e00ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454671, "uuid": "6704383a-a4fa-4f2a-b1df-0630e5f71db4", "value": "6144:/6ZMFXzqfoSHr/mvcQYbi2HN8C8BgifO7y7ccuVqrWLWN7Ypsi6Ih9vH0/oUHahE:/8MFX47ivcQMNsrDNKJjO69cI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648454671, "uuid": "273e9039-1148-46f6-a4dc-b3ef4e3650e4", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648454671, "uuid": "6a581fdd-218a-4d0e-b328-44c72074a4d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454671, "uuid": "ecfa00a8-a282-4a30-916c-b61c4e26c32b", "value": "emotet_exe_e4_d1600c0d1ea16d978187a1141e7bb813223320a66f8b85827b0f46461bbe10f8_2022-03-28__080425.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a593eab4-aed8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648500605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500605, "uuid": "d7c6bd83-d189-40a3-8a7f-3a331e814fb6", "comment": "Malware payload (Mirai)", "value": "b18e4d3c5a15216c7791a3c017e85d25", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500605, "uuid": "087c68c2-2460-4912-af12-bef6115fde41", "comment": "Malware payload (Mirai)", "value": "d162e0dbf4a4f58daeb9ead3fb75faf84fc37f48a4b73408062d71749683ae17", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500605, "uuid": "b7622628-b3a1-491b-9016-20885718f936", "comment": "Malware payload (Mirai)", "value": "aa4e42eb887024ac81eee068b13fad22499e771a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500605, "uuid": "d1c0338d-3510-4a3c-86ba-5a5311a238c6", "comment": "Malware payload (Mirai)", "value": "c251d7175941a3e4df115a068f221c4befa3efd46e51738ebf528106b2bf13aba22967ab18e539a2cb6b3f6300428e7f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500605, "uuid": "de27ae5d-51ff-4dbb-9965-49cf0a59cf61", "value": "T1BF930885B8819761C6C566B7FA9F0A4D3321D3DCE2DA32039D311FE173C682B1D6B94A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500605, "uuid": "d72c5eea-070c-4534-b5aa-6141e2f00aa8", "value": "1536:9RLYtWQ7hV2AtqZPxcaMmbU9Z1QuiS5FUBWkoPJC/SI6QfPB4ZB4IPb15zOhuC9j:9RlQ1V3t+caML/23/0e3NFaAWYAXUQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648500605, "uuid": "f3cc26b2-702b-4551-8d94-f734443afc2e", "value": 95452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648500605, "uuid": "c2bafca2-ccdd-433f-a442-6ac57f686c92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500605, "uuid": "57b333d6-8f9f-45d4-91a1-0a8c5f04d542", "value": "garm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf60f5b-ae6b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648453747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453747, "uuid": "5169b244-8668-4886-8d77-d3e1871bad51", "comment": "Malware payload (AgentTesla)", "value": "a0c615b59392c1424130d354cec8f3e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453747, "uuid": "c78a66ba-91cf-4f75-a760-971dcbe86e24", "comment": "Malware payload (AgentTesla)", "value": "d2b5a800ef14bda02a5848dbcc3850f1866e589b8ddd3ab55411edb8af2f359e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453747, "uuid": "57942c80-5d3d-4434-b67b-5d89a5c1f6d5", "comment": "Malware payload (AgentTesla)", "value": "84b863761676238854938b6bab7a0e4590e85296", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648453747, "uuid": "0f0cef05-2aa3-414c-9977-6ecfd691ded2", "comment": "Malware payload (AgentTesla)", "value": "1ee8f72b58e3b1fb2e3339dd98632185a8cd5ebac3360d4227374b0f676990d830383e98726851145530524d4a6044be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453747, "uuid": "d5c9eae3-d1da-4bc8-b260-21382b1ae889", "value": "T188E4D6ADB2F075EFC86BC176D9681C68BA907C67930B4103D02731A99A3D997DF143B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453747, "uuid": "28212a70-bd27-4e80-abbc-69b2328a71e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453747, "uuid": "f41f28c2-e2f8-42d7-a529-14c6267dc69a", "value": "12288:3fXtHY5KWzwVtLGO3iHHFUUjXxN2xonaPv6kCeT529TV3KIgDzrMF/kMfUeV6EH3:3fXt457zw3Z3UHFUUjXr2xVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648453747, "uuid": "95c193b3-8f61-4f8a-92be-0cecfa0eb077", "value": 693248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648453747, "uuid": "f6a58288-1a34-4970-825f-2c2efb128dcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648453747, "uuid": "8649da4d-0103-4a2c-9ea7-e2c7399553e1", "value": "DHL Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b17be9-ae54-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648444014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444014, "uuid": "79d17b1f-9b5d-49e1-b7af-724d2af09740", "comment": "Malware payload", "value": "92603454d54069ebc44b896687aa418c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444014, "uuid": "a4747fe3-767e-4a63-892e-4afb0cd3273d", "comment": "Malware payload", "value": "d31a7ba5347a5606631dc3f26c55e253110aec0ef5c605f08fcad3b776546618", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444014, "uuid": "4f1ace01-e495-47a3-8f8e-43c79e512793", "comment": "Malware payload", "value": "fa34be1f8a946a3fa3deb442ed6cc52110de8cab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444014, "uuid": "16da7354-54a2-4a25-9c9f-3c4e0f6725c4", "comment": "Malware payload", "value": "5cc80e64a0bff1508d9f4d8df3513d5a63eb8c29eee3f302c881cf3df6e5b9d92403bf7c76e82f70dde19ddccbd7fad1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444014, "uuid": "4c803530-c207-4c17-ad24-fe8acb3d29cc", "value": "T1CD03F232534F5FA0EBBEFE7A40C753E01788A5876BE4D55A0B04E75108C27D743869E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444014, "uuid": "81766ac3-b0e8-4966-b39c-66c5fb92dd03", "value": "768:hhECa/Zo6pR6emposCTBu1ZhqVYLB/MZt75vP4uVcqgw02NWXvsCqpVk2zHVf:PEzZo6nKovtu13BLy5n4u+qgw06WXm0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648444014, "uuid": "037d08c3-e7dd-430e-a9bb-d47265fc9121", "value": 38348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648444014, "uuid": "009d22d5-adae-4aa5-b245-c238b309b3df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444014, "uuid": "bf907357-09ed-40cd-8cab-ee051b158e52", "value": "92603454d54069ebc44b896687aa418c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a6c9cc7-ae31-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648428699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428699, "uuid": "4a8da752-74f5-46ee-b00c-85d3fee1ad05", "comment": "Malware payload (Heodo)", "value": "3ebec5f7e1bf22701ad2d5c78df970a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428699, "uuid": "730bcd4f-69a9-42c1-befd-7ef04b951cd9", "comment": "Malware payload (Heodo)", "value": "d3a893f6e76cffef44f388c1610e706535022ce0c50033e1b80044d5e792d151", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428699, "uuid": "7a940c55-8a3c-4d1a-8e88-0f6a082f46f6", "comment": "Malware payload (Heodo)", "value": "97a912bd3c16991aaefc50911c03180f5b390ea4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428699, "uuid": "92d1341a-5522-4022-a80e-29dfddae6f86", "comment": "Malware payload (Heodo)", "value": "32427ed710a9ad1d0c5af27652b790c8eba4728ab244c71e100d22031ea875ecbf75292e9745258a5b2de7f9d779e6d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428699, "uuid": "5caa23c8-0a08-4b6e-a22c-eb18131fabdc", "value": "T1F8E49E1177D0C072C2BF3630551AA3B566EABC708DB9860B6FD42A7E2E745829D3871F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428699, "uuid": "23da238c-b83c-4a3c-903f-2de40a6ba43c", "value": "923a5ec702466ffd61b422bacc94c6f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428699, "uuid": "412a61e0-55de-4614-b153-04ef7320e85a", "value": "12288:JSycC8Tu2EEAeClIHRFa7UdUzrAKotI8X0oXYl2N17OP:JSDD7RDhH3dUfstj0oXYl+OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648428699, "uuid": "2a1b384c-0c19-462a-9078-90f4362ddac9", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648428699, "uuid": "e53dd379-699a-4351-b7b0-ad8447d0a554", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428699, "uuid": "f5cbe014-8eca-42e4-a463-23ed9d72d863", "value": "3ebec5f7e1bf22701ad2d5c78df970a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf97b01f-ae98-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648473188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473188, "uuid": "e0406d38-057e-49da-a6db-ad8aa65f99f6", "comment": "Malware payload (Formbook)", "value": "30ebff524e03eeb8b9848987d2ed6749", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473188, "uuid": "6abffa4e-4fd9-412d-af2e-3fb5a059ab04", "comment": "Malware payload (Formbook)", "value": "d3bc2b767f795b5fc0859a8a5d3efacb8150a9c272d89701c164d3f703e15ba1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473188, "uuid": "7cfb1342-dfda-4275-9e75-e713b3320000", "comment": "Malware payload (Formbook)", "value": "486c1e21455dcd046847d6ecf54baf8ecb922da3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473188, "uuid": "0ed4dfa8-adbd-4fcd-9cb3-31c77da3c389", "comment": "Malware payload (Formbook)", "value": "1fc6a411bc1562a3ebfc5b26af0e455c5e2bcb4849c651d9ed2e1fabb43a29cf05fd68e220ae65d6cc00005af816d4f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473188, "uuid": "7d8671d6-ab81-45e6-a0f1-a18378816be5", "value": "T17C057D2EB6914477D0721B784D1BA3B9AD36BE002E14B94767F92DCC8E3B34178252F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473188, "uuid": "03d0bc01-ee9e-4442-ba4f-95e086b0fea7", "value": "050411d35bbff71bc05083b3cfc98bc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473188, "uuid": "6460d750-9605-4e9d-a983-0259c4415fda", "value": "24576:K01V/cee2U63yS26THrITr7Ruy/dpjZOlPdCLHOmS:K01Ve2dyqql78PdCLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648473188, "uuid": "ddbc27be-5bb1-4033-8a10-d34d6e93255b", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648473188, "uuid": "282e4186-8b29-4eee-8c4c-db40fd15deb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473188, "uuid": "23a6c736-9e5c-491e-b9ee-8a271560a911", "value": "P.O.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b4e57a2-ae7b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648460564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460564, "uuid": "fc9a63f9-1afc-4250-8ae6-d3d5d2664157", "comment": "Malware payload (AgentTesla)", "value": "e8fbc389610fbaad5eb1817a2405b129", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460564, "uuid": "54eda29e-c031-4c00-a380-be2e794059df", "comment": "Malware payload (AgentTesla)", "value": "d42b9dce41c10f64d68376a4ae0fb0b3128c7a51973de529b7e97313d702ff22", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460564, "uuid": "a2ae8eb7-789e-4bf0-81d9-ca9ab7082f2b", "comment": "Malware payload (AgentTesla)", "value": "05a25bcdb97db07728391e0d811764a62eb3455b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460564, "uuid": "74466e3a-6258-4ece-9b9b-c6d623e6a3f3", "comment": "Malware payload (AgentTesla)", "value": "47f4278dd46c2199a582096199572971e02cd3e2dd05e8db247c2f343f7cd104f20c3cc228ab26259d822803d2453f61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460564, "uuid": "6843f62c-bbda-4825-8db5-d7c4453db3f7", "value": "T1D1657B98325071AEC467C972CDA81CECEA207C665F1FC207A053369D9A7DA97CF146B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460564, "uuid": "d17b15dd-ffe7-458c-a8b2-f37df42adcd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460564, "uuid": "52038952-35bb-4ebe-a7d8-5ab98509de04", "value": "24576:Bw7HFFTNJWlgHEIQDcicbzCQpffHMcCydqbXPbmSKgoX4xVEKNj:CFvJW6EIQDhcn5f/D/IXPbmk/EK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648460564, "uuid": "1d11529e-6345-4ae5-bd02-58100b1f5b77", "value": 1433088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648460564, "uuid": "c1edfe7d-3569-45fc-b60e-5a91c5f5ae0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460564, "uuid": "0ea54902-1a14-49dc-bc43-eace5a75ff02", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "298f520c-ae69-11ec-8e58-42010a9c0032", "comment": "Malware payload (STRRAT)", "timestamp": 1648452723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452723, "uuid": "2939732f-b89c-4406-b36c-133d5e171279", "comment": "Malware payload (STRRAT)", "value": "d35bedec5e83fc5f669883601cef63d5", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452723, "uuid": "c587b480-554a-4160-ac3a-f8877f789c6c", "comment": "Malware payload (STRRAT)", "value": "d437ba1754f873bcf5e25c9aa7d7efbce3a806142387b66e532caf2e52266a56", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452723, "uuid": "693041b6-f1b1-4ea7-b479-c2279e80d849", "comment": "Malware payload (STRRAT)", "value": "df2dd9a965988db857bdd4d951a6ce6248d8ad40", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452723, "uuid": "67f1e0ba-88f0-4022-836b-dc535e5c555c", "comment": "Malware payload (STRRAT)", "value": "b222d35c5ffb5fb788115eb390ff7a9b10daaf813a004fa623db3ce2fa93f62f8da608eaeb71b953efb17cec9639076e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452723, "uuid": "380b5834-4c82-4db2-b819-96ce40a15818", "value": "T11BF3F15EBA9AC1B8C45790731420D7A2AA0DD26CD148A15B31FC1DDA1CFBD580B2AEDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452723, "uuid": "537143c6-6c42-497a-84e9-de5da5bb6263", "value": "3072:GNgLi8jHxUFjfwY8MOh+FXNU34gulSr//7O+TOU0BcQxGkMwcS9Jvdz029fztz/:GNSisxUoMOhw9jgES77O+a/1c8vdrBz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452723, "uuid": "78e81988-e9af-4d20-83e5-8ae460369a66", "value": 167699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452723, "uuid": "f62bcb23-2f0b-4843-890f-672b0d22439a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452723, "uuid": "525538f5-734c-4085-aa33-eefe752f6d9e", "value": "DRAFT CONTRACT DOCUMENT#0105DOC.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94775425-ae5a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648446460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446460, "uuid": "76a9de91-8063-4ef7-ac9c-4daf013f2223", "comment": "Malware payload (AgentTesla)", "value": "4d5b4655bdeb636a26e95e1d2c400760", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446460, "uuid": "489f0c07-838e-40b2-9ea5-5ebbad90c2dc", "comment": "Malware payload (AgentTesla)", "value": "d4e8b3fcd91c2953bb5dae6d0f4ff805ea44956aad5810f8f4a2c61cb42ad874", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446460, "uuid": "698c6458-eaa4-4365-ada2-538a1184b282", "comment": "Malware payload (AgentTesla)", "value": "04da7e3d713204aac9d37186d2046e431182e7ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648446460, "uuid": "0b8ee56d-9ff3-47cd-aa5e-90a764d130a5", "comment": "Malware payload (AgentTesla)", "value": "604679f0b6f4fca413fed0afeb2836e8ab2f01f471734e0447e50137ce0dec804d5f9e217e287cce4a3813ee19227b90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446460, "uuid": "284c6af3-738f-4c40-bbc1-0304fff24d77", "value": "T1C8D4DF2367455B51D87AF37941D2983113F8FCDF12E1DB0E3E9AB89861632811A7FA32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446460, "uuid": "531f1d9d-04f9-4adb-a6d1-853c35d52dc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446460, "uuid": "ba0e8965-9c70-41d2-928e-66c23f652457", "value": "12288:DMb6IcJ3UoibrpUyc15YLgdo1VxAvoLmBxPuZFSge:DU6rOJNc0nrTLkPuZFSge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648446460, "uuid": "ea5f9b1b-8639-498a-9a1f-048bcf7de0fd", "value": 654336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648446460, "uuid": "c00cc7ca-1332-451b-98be-1918f532fb24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648446460, "uuid": "5da0c33e-56f3-441d-a2be-233a93e208b8", "value": "4d5b4655bdeb636a26e95e1d2c400760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8761187-aebe-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648489550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489550, "uuid": "475de98c-2271-4b20-8f9c-98bb2fc9a3f2", "comment": "Malware payload (Heodo)", "value": "cd6cb542f292aee3de1418c7acedcd17", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489550, "uuid": "b410948a-18f5-46d7-91ba-eabc84327770", "comment": "Malware payload (Heodo)", "value": "d60e8baa8a0a37f1fd0807824f05c4f439be5df1d46037313a5774c0892f362b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489550, "uuid": "a438eb50-ca71-4383-bf90-c5d34fdf7281", "comment": "Malware payload (Heodo)", "value": "76fe20ed4bd097a432575ddd93ec5211b044a068", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489550, "uuid": "89232ff1-f584-45b7-927f-857a0553d52c", "comment": "Malware payload (Heodo)", "value": "bf61b510fab0799814bc3196173d23eb15f52119a3cfa8d4548b704e0d4975225721e2f93bf878c6e1ed00320855385c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489550, "uuid": "fadf1d1a-8cfe-4d78-878a-2a71ae5d6a9b", "value": "T109E48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93FBFCD302514D7432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489550, "uuid": "7f7673f6-50be-4a13-96ba-38096bb10aa5", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489550, "uuid": "0c3fa276-da5e-4eb2-9db2-7b2cc48da209", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7jvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zVCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648489550, "uuid": "0b4a5ea9-7270-4442-9597-b25233320af5", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648489550, "uuid": "4a0a0b46-a58e-408c-b9bd-46039d1ea0e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489550, "uuid": "cef45410-42f8-4321-a645-517a8f099b53", "value": "ABD82uq0ecoLDPkWP2gxP0cA8K0idaf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71d2db8-ae84-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648464530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464530, "uuid": "5dcc315d-1600-4818-83c8-8626e6742a75", "comment": "Malware payload (Formbook)", "value": "d86f092a1a11fd4158cfba5ba1768e2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464530, "uuid": "1bcde3f4-3a67-4af5-83c4-093b381af601", "comment": "Malware payload (Formbook)", "value": "d61835164215f1881467e717012874796721d02a9995733190b7d831733754c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464530, "uuid": "c49747fc-58df-4a69-8790-35444b20d918", "comment": "Malware payload (Formbook)", "value": "580fb4e18f18c3f3ff3eae7d8b3f8369aa3fb350", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464530, "uuid": "501ac53e-d7cf-4b84-be5c-79f1b77b3e5d", "comment": "Malware payload (Formbook)", "value": "2d4b293ee0e4327f97953063b92d8faef1369e3874557cc47d5224fa272698ec2d2d0b88ea741b3a3855488ed52da0b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464530, "uuid": "4e9af195-d126-401e-9cb3-c1fa681d36b6", "value": "T10E556B99325071DEC467C932CDA81CECEA607C669F1BC207A053329D9A7DA97CF146B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464530, "uuid": "753600ee-54ae-4eb0-aa3d-e175148b052f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464530, "uuid": "a9601837-0f53-47df-9e48-e86b651e3382", "value": "24576:H+SaHwLCH5HVy+YF+lX5e2dTD2hqC5mmCoVhrUJD:etSCZ1KuX9T6hqYmg7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648464530, "uuid": "a6e008e3-da7e-4f7d-80b6-da600456297f", "value": 1395200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648464530, "uuid": "414ee633-9329-467d-99bf-1fe64fc8323c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464530, "uuid": "1a917dad-4f5f-470b-b65c-0668f2eabe6d", "value": "SecuriteInfo.com.Scr.Malcodegdn30.13601.18452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b685b9c9-ae81-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648463267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463267, "uuid": "18b0cb40-7fc8-4015-8a07-65c778293679", "comment": "Malware payload", "value": "13d2eff8301c0d22a338cf5b0ffbcb05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463267, "uuid": "d98992b0-49c1-4dbb-a989-79481f5e921f", "comment": "Malware payload", "value": "d61a4bc8bd10bd0a839396e3483ba5ea8f2d604c6df38e467de5b5bbd1725c83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463267, "uuid": "1e282d8d-ec01-4891-bc6f-367a9e0ec0b2", "comment": "Malware payload", "value": "626ab24585b815e77949e4dd2c6bfdfd93f50c3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463267, "uuid": "2efe2538-05f6-4926-8d32-1f7bd28b65c8", "comment": "Malware payload", "value": "aab47b1df5ddf0fbb75665feca3dd8482a4f24450b09f8969802d7a5caaad1929c4d25283ee5f4331ccb764a6908db91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463267, "uuid": "7bc8d682-fa52-4c3b-871c-99e2bbc22bc9", "value": "T180C2C03E13066BDFD551A8BF95D613019D712BF72033D94BC660A48AED0A5263892FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463267, "uuid": "b5bd418f-1061-4ddf-abd3-a3c7fdc30f20", "value": "768:MQYcL5Iv1CvVho++tvV8YJgGlzDpxYslXWPJF+Mh24:HYk5eYoXtvnVrYwGxF+MhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648463267, "uuid": "43d1fa7c-8817-47bd-a418-945ab44f9b7e", "value": 27616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648463267, "uuid": "1b716c8d-7a5b-4d69-a33a-6bdb76245014", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463267, "uuid": "c019c330-52ed-4701-98ad-ad31c6db65eb", "value": "13d2eff8301c0d22a338cf5b0ffbcb05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440d1275-ae85-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648464793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464793, "uuid": "d562ec82-d4c9-4b93-a5b4-5140746230b5", "comment": "Malware payload (Formbook)", "value": "a5b523d9105d83c4eaa863f63d1ad07e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464793, "uuid": "6ee92be6-e570-49cd-9c6a-ae869e9ea748", "comment": "Malware payload (Formbook)", "value": "d687241aac17bdc6a5bf379759e0422c1e46e6776b13c5c5eea0268d41f16f54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464793, "uuid": "67c9665d-09d5-4826-8a56-499a2bafc88d", "comment": "Malware payload (Formbook)", "value": "4cd211e8ca4387f3dd50259060109bb7ce90fedf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464793, "uuid": "ee41d7c3-c9c9-4d6c-81e8-4641eea917f3", "comment": "Malware payload (Formbook)", "value": "63f76dcc924c9b5d3f7851e928ddf5778c34772ca08669a5594a93123d2c917bd0db2fedef19f93c6b963ae1a83d1a8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464793, "uuid": "90c40983-62bb-43bf-81c0-0a4a9aa74ec8", "value": "T153557B993250719EC867C932CDA85CECEA207C665F1BC207A053329D9A7DA97CF146F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464793, "uuid": "bcb90323-fd10-4c40-a25c-0d5007327997", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464793, "uuid": "ef2ae793-fb0b-4d28-b82e-29bd85b89aa4", "value": "24576:YAKKBUXYLi4LbkXqQZqP9tKAXuo/I/rLx4PKOqHImL8:XjUXYDL4XqQamAojLxeuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648464793, "uuid": "2981110b-66b3-4cb6-98b7-fb8c32ae7a35", "value": 1401856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648464793, "uuid": "ec514f4f-6225-44fa-ba38-ae40806df8c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464793, "uuid": "36574fd3-1d91-4d21-9dee-707adb6caeaa", "value": "URGENTN\u00cd OBJEDN\u00c1VKA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db993c1d-ae4e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648441425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648441425, "uuid": "66217c1c-d5d1-4970-90a0-7b0e531b8a84", "comment": "Malware payload (Formbook)", "value": "ad5504d9dbb476d447e419e422d756e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648441425, "uuid": "ab988e2b-097c-4c4c-99c9-4735bc4d7ab7", "comment": "Malware payload (Formbook)", "value": "d6e96fd4a8960b01d5a03e2d0fc3c0e502e7e5d0b4648eb53aa6e7eae42d2c7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648441425, "uuid": "c79a8eaf-4cb2-4e8e-b25d-c55c2547284e", "comment": "Malware payload (Formbook)", "value": "17ac48763bffe4afb0b1275aac07a31f6d24eac4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648441425, "uuid": "c96899ef-fb47-4786-9b34-fe4a4290d4f2", "comment": "Malware payload (Formbook)", "value": "1a7b562251edb2c8cddba051a1f952d192972d515f932ba2cd4667ad0181a82c3eefa39d93a73f9e99855e4d2205f5fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648441425, "uuid": "ff74326b-895e-4a3b-b996-7dd49bceab39", "value": "T1C235F01126A15B55E03A93B5DCA480EC13743E49AD7DE21F1DD272CF0EB1BC28A2AF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648441425, "uuid": "bbd21e26-ac60-40fa-9c99-81e8f45a8500", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648441425, "uuid": "acd4ff00-9b9f-4fd7-958f-e6aab2724687", "value": "24576:WpM5stUC/bq3HbrlHSnL63gyrweTWyj3khdGeY3KvnToJ:GtUC/e37rlH4L2gyDkdRYavM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648441425, "uuid": "33cb0699-d70d-43c5-a607-01dc5417a4d0", "value": 1141248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648441425, "uuid": "ab14e5ab-3d93-45ae-ba5d-33856f8076af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648441425, "uuid": "3e8f050f-f533-40e1-8980-798bc4dec87c", "value": "SWIFT MT103 28032022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2acff440-ae5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448430, "uuid": "78e93a66-1b4f-48a8-871b-b5f63e57e355", "comment": "Malware payload (Stop)", "value": "a90f7f665c0e275ed08075804b25c692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448430, "uuid": "90a1234f-136e-4a15-b9fa-712cd66e9e38", "comment": "Malware payload (Stop)", "value": "d796df8e7ea24a1076fcb5ec457e0b0c14219905fd34bf8d8761a6d2b1c546f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448430, "uuid": "3cadbc54-cd3e-411f-85ef-049de2b593a5", "comment": "Malware payload (Stop)", "value": "a0271a33063a27b903c9565bbd6c26d2767416ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448430, "uuid": "64125979-1a57-45e4-a6fe-53c58d9d455e", "comment": "Malware payload (Stop)", "value": "c357a9a47721cddd25dab5a52cd91db7315cdf48b21c20d9d40483013c8d04e686403f7972176446c136a13048e7da3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448430, "uuid": "64081e7b-dc5a-4152-9cb5-de6623145ca5", "value": "T1B00523027483C471EB5B52315816C6745A4BB478297B5BCB2B99162E6FB32F3EE3034E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448430, "uuid": "b3cea0aa-ac3e-41c4-85ac-95a26634449d", "value": "159dcaa804632f606b007a362cfb6cc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448430, "uuid": "6b182881-4d28-43a3-a94d-b691f640194e", "value": "12288:2vyjioNjFClI+jprNq1lYDWxo85BHzFzfcZQHFDJwlB/sQzBVpFU4:ufohYlI+jrqbQsBTduQHxJKZNG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448430, "uuid": "20d1e65d-0547-4faf-9fbb-dc5504bed49c", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448430, "uuid": "8d338154-9c27-49e5-9174-2201bb226280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448430, "uuid": "8d0672f6-b5a9-43ab-a3b8-b4d7b7654eaa", "value": "d796df8e7ea24a1076fcb5ec457e0b0c14219905fd34bf8d8761a6d2b1c546f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043048eb-ae69-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648452660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452660, "uuid": "6abf74a3-78c1-48b4-94f0-8f4795f01b70", "comment": "Malware payload (Loki)", "value": "2a5e4c44e91fd14b70117dcfb9544282", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452660, "uuid": "f61e811e-ea8e-48bf-bbeb-84163d65ee51", "comment": "Malware payload (Loki)", "value": "d7b644c8e04c27cf9743be3a2b01c53572d392c394ceb4376ad52d4ed391e20c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452660, "uuid": "d3ac571e-9ce3-433c-8069-2750e8ebdd25", "comment": "Malware payload (Loki)", "value": "5fe819de2bd796c62604238d61fa52130d42ae83", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452660, "uuid": "acd68676-0883-4095-b5f7-e24b921f0d27", "comment": "Malware payload (Loki)", "value": "27da895e391425ca34e2bb88e284ff83539c8a8888b3b93993239018a7bcb6971419c9c5f5e323e08a411d6c8c0c525c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452660, "uuid": "ef2ce2f3-0859-4fd9-8ba7-250f912df23e", "value": "T134140289653A23BFD3546EF298305A50B72EFF513802400258ED3F3A2B7D93955E7A72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452660, "uuid": "248f889d-788f-4ba6-972d-847977c239ca", "value": "3072:PnJVLqW/MEhdCau6bU5VSbnLJdiemDFZhA3M4CEQieF462kvTiK:XDLhdCj6OVSbnGemD/hU9CEQieskv+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452660, "uuid": "619d61f0-6df8-4c14-99c5-51bde43d8e23", "value": 192440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452660, "uuid": "493e3de2-1105-4143-8bb8-2b7ccd04b962", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452660, "uuid": "dbc44e6a-a119-40ef-9614-21054121a2ba", "value": "V-20-181-063-E03.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8ce046-aebb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648488140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488140, "uuid": "f8369975-78f0-442d-b6fb-1e3b21ec4fef", "comment": "Malware payload (Formbook)", "value": "a9df4380d0d04533a61accffe0d5eefe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488140, "uuid": "0b6ad337-ea41-43d2-96bd-19b48a038e24", "comment": "Malware payload (Formbook)", "value": "d7e61a797f06ffccc8107b01d621197d674beb04dc0021c4a38675f6e7ff5680", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488140, "uuid": "71ddd087-ac43-4720-b283-8b01f19cd92b", "comment": "Malware payload (Formbook)", "value": "519cd222209530e7c67df91433c9399ae0036740", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488140, "uuid": "d54376e9-5e01-44f5-8039-7231159cf73f", "comment": "Malware payload (Formbook)", "value": "eaae2ddccd6521c9135985382e811c42095dc7bfb68ae5b660b2d955d85f3563792d5593776f04fb73d6bdbbc4a186d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488140, "uuid": "fdb02a04-8a44-4ff9-b9c4-805a912ee13d", "value": "T14F45F12376698A55C13583B2CCAAC4CC07B47E8A6D67C60F3DC577CF09713875A1AA8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488140, "uuid": "e45f4b2d-bce0-4372-9ebb-15e9fbe08f32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488140, "uuid": "9fd80f0e-8c1a-45d2-aea3-784f2c8e992f", "value": "24576:fztc4qVWeSx7LPSXXnkP6Y6ojoTg3tPamOZOOl:7WVdYLPSHk6ojok3IVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648488140, "uuid": "b9fcdebc-ea74-49ff-b16b-aec4b122b7fa", "value": 1180672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648488140, "uuid": "c63c10a7-b047-451f-a9ed-767e47888170", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488140, "uuid": "8e51dc76-6922-40d7-864e-d9dbdcc5ac69", "value": "Remittance_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc0783f-aeb3-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648484731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648484731, "uuid": "a6174b20-39b4-4717-9b44-25b5a9ce2980", "comment": "Malware payload (NanoCore)", "value": "34796749977d59cfcbc434740472d76d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648484731, "uuid": "4eec691f-e6fd-49fe-9be3-9ebbf43d7553", "comment": "Malware payload (NanoCore)", "value": "d813644d9387e23efe566919a08f4d43ec3ea7347c7042c0ce5c6703d2afdbd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648484731, "uuid": "43ede202-6a47-4d89-92c1-3802d2032445", "comment": "Malware payload (NanoCore)", "value": "3075bbe9442fa6da3c25d2366ee58f5fafd638d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648484731, "uuid": "3fd083bf-2399-43e6-90b0-4d6275a28947", "comment": "Malware payload (NanoCore)", "value": "994439cf240aff5fdfe4aeaa7ab1abf9a9feb1a8ec42b3ca41e69bf73cba1131b07c10bffdb1648e06583e8f2ffe38b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648484731, "uuid": "3177cc0e-185f-4edb-a579-84506e1d8d42", "value": "T14AF4E0EC29BA01F9F3268EFE5EDCF5B0CB79E2212104F4B978D91B025741B4099D2679", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648484731, "uuid": "53e69156-3041-4c8a-8430-432c6bacc400", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648484731, "uuid": "297125aa-6d33-47f3-a24b-d8b68f6cfc2c", "value": "24576:BbHchFHNI+4Ki3Z6LiuZGrb7zjopMiNeb6CD+:BbHchlNih6LiuZkb7H0Nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648484731, "uuid": "664a3aba-8bee-4123-b41d-7886f6af16a1", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648484731, "uuid": "003906c8-e9fd-4c0c-8503-ca558e90ef9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648484731, "uuid": "cbe8fab8-b2b0-4824-8de5-138627211618", "value": "34796749977d59cfcbc434740472d76d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa10177-ae6e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648455042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455042, "uuid": "01324c00-1bb7-407d-a2de-01fb5d625395", "comment": "Malware payload", "value": "4abde3f8031734ab9450dd5b22311b10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455042, "uuid": "a9ad54c4-a6a6-4b43-94b8-300fa9118e9d", "comment": "Malware payload", "value": "d8f6c57540a0dd345fa3bc0f07df6ba0ceedaa0dcc4afcf847da81091c816768", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455042, "uuid": "415a5053-1dd8-4b7e-b63a-47ee9399e595", "comment": "Malware payload", "value": "9709a30009e7b44d08a2dac3d8eae6111e727c04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455042, "uuid": "1caa7fd7-4960-49b8-b0b0-14dd3c5f1dd8", "comment": "Malware payload", "value": "6590623b7f854ff4c18f8c0206e532e92bdc460326540fd8eb84d6b30fab91edd8b3ff68aef933fea5bfaa98b68a305c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455042, "uuid": "c6e3b731-626b-4b16-b526-74bdf1a6914b", "value": "T1EB4633208F6A2D7E46E8433EA0BF8E1D7BA01F85A48DF2D745F165CB168EF840167479", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455042, "uuid": "45835048-afd5-4170-b190-5cb5ed162896", "value": "49152:QCUxv58wM45xKu7ASw2GssidvqUz6XW58254t3h9QBvpK0H/i0N2Yi9PpILdpT3X:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648455042, "uuid": "1426b3f2-2d82-4e1f-9836-4e77aa9620d4", "value": 5470116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648455042, "uuid": "c9ab5946-1684-42e7-b373-bcb4d3cfb496", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455042, "uuid": "dc740bb3-1147-44a2-b23f-5023752247e8", "value": "4abde3f8031734ab9450dd5b22311b10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e1c45a-ae6f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1648455378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455378, "uuid": "0690398f-49b2-4bea-a179-203fb3bdfda5", "comment": "Malware payload (Smoke Loader)", "value": "19c980ee3eaf8d9704e7e6f630934082", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455378, "uuid": "1d047065-1f83-4b99-8af2-2f6766616096", "comment": "Malware payload (Smoke Loader)", "value": "d941de99b4f1c476c39a4d5679f945710161d76e3920dbca3000b7fa83870d0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455378, "uuid": "0b4d595d-b55a-4c6e-a089-4135bcee2a61", "comment": "Malware payload (Smoke Loader)", "value": "8bb6735ff8bcd3e5f2111912c0964ca5ac26c265", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455378, "uuid": "514df5fd-dd82-42b5-9f78-2da2eb19ecd9", "comment": "Malware payload (Smoke Loader)", "value": "36f0b7fce7c931f974a5fb24bd15752632b22b98ec37d3a8ab04808c5599b6344a5f4162517b16679acfdf46aac77cd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455378, "uuid": "1507ec5b-ab14-45bc-b1ea-91d9501516a1", "value": "T1CA54BE1235C5C832F512E2B66876C6B65ABBB83115319A8B3BC4066D8F343E3DF7534A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455378, "uuid": "f0d17215-77c6-46fa-8542-d0a84dd93363", "value": "4dfbd068d509e65cfeadeb4a32c65fed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455378, "uuid": "3e416bd0-6e3e-4225-8f37-d2eae16cff95", "value": "3072:cRUVF0xAcz4y2phy/hcNlm/nAjaxq8Efb24MivWq3YTUL3vYBroCtX2l:cUzmlQhy5cNl9g4zvWq3C832roCtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648455378, "uuid": "eecc49da-10a7-4ae7-92c5-5faed99fcd2c", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648455378, "uuid": "68f5d09a-de64-49c6-942e-403622a3f3e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455378, "uuid": "16be2ba1-8166-4745-93bf-86717e96b771", "value": "19c980ee3eaf8d9704e7e6f630934082.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d61cc50-ae5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448434, "uuid": "2eb65087-e804-4373-96a7-657d923c5f3a", "comment": "Malware payload (Stop)", "value": "cd67ddba73a3d6c00cbc1fa3f0de393b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448434, "uuid": "5545afde-a2cb-42a0-bfc7-668628b73f88", "comment": "Malware payload (Stop)", "value": "d9534e23cf49ed2f9d14b220f4cea2b8fd6e47cece85ddf28b90fbc2d9297b5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448434, "uuid": "d530aad0-1e3e-4ab7-8245-22ac0c126f53", "comment": "Malware payload (Stop)", "value": "82fbe36d0504d4268dd1bbc552f1362ad4b160e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448434, "uuid": "16c1d0d0-9278-4768-a073-6175577990fe", "comment": "Malware payload (Stop)", "value": "cf13c3445a56cd136e784b67d476230bab9753dc41fbc2d72920a41de0ec8a3f9d221822bec263667f998aa2cb43747b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448434, "uuid": "91231860-a794-41da-9944-1b44ae5a568d", "value": "T13CF42372FA50FA70D0760075B4A586438D42D87321E42693334A4BFFBB35AD563AE3E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448434, "uuid": "20bc0bba-fce5-4c77-a731-3b903137b1a1", "value": "f3e2f2b52a9345b2bd8582942ee5c776", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448434, "uuid": "89b6154e-3039-4e59-a97e-3a4d43e9dce6", "value": "12288:BNGrRKaXp5rowq3GxLChRCVmsDbtozJ7jwiME/:BIXpK12x6imsnGE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448434, "uuid": "87513913-9a3d-4d6a-b8fe-e031f28cd267", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448434, "uuid": "de6c4874-f39c-408e-9dba-38293044ab7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448434, "uuid": "0a1c6fea-84f3-4f1a-aa25-9dc3fb896af2", "value": "d9534e23cf49ed2f9d14b220f4cea2b8fd6e47cece85ddf28b90fbc2d9297b5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8fb15ff-aec4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648492075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492075, "uuid": "4b3ce98f-7b5a-4a63-8ca6-e429d001684d", "comment": "Malware payload (Heodo)", "value": "7bbf6fc1f920ee1488b29b3eb9f8d757", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492075, "uuid": "803cb82b-f45f-4247-abff-d506a51982a6", "comment": "Malware payload (Heodo)", "value": "d9aaf83c5acd74904c31611834ded2e22a055626d6fdc8c1df260b5cf67327a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492075, "uuid": "51a2136e-9c22-486b-9326-f252c6bd3d8e", "comment": "Malware payload (Heodo)", "value": "3e003766e60cf949067aa3e96912961c9529c06e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492075, "uuid": "8e0eb828-f7ff-414e-96ce-02044e249a54", "comment": "Malware payload (Heodo)", "value": "dea0c05f2e62d2eeb075598471856c4d8a8af18f98b6f13b131b0e32ab405ec47229e9a73164f1235871c6b1f98295fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492075, "uuid": "d1ff15f8-e843-4146-8485-f7f43eacb059", "value": "T15EE48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514DB432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492075, "uuid": "ab2a880c-a4c7-4ebb-b908-fc3c6ac2b914", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492075, "uuid": "1db2c432-87a1-40bf-a89d-25b89124e642", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7kvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zSCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648492075, "uuid": "2612da3c-2d23-47f9-ae10-cded6cb164e2", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648492075, "uuid": "bbb60a9c-fa54-48a5-b038-8d4271062569", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492075, "uuid": "02bedf99-8637-4413-98fe-cfb2130cd2bd", "value": "7bbf6fc1f920ee1488b29b3eb9f8d757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e27301-ae7f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gozi)", "timestamp": 1648462275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648462275, "uuid": "0d8bbc99-246f-4733-88b7-590bb0b165bc", "comment": "Malware payload (Gozi)", "value": "bb9dc919d8be2b646f5e7625b92876fc", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648462275, "uuid": "d53fa6e5-586f-4a37-9632-c638e8f2f2aa", "comment": "Malware payload (Gozi)", "value": "da266d429a932be228984ed5b0a0b030e5c33493bd6ef6a90bce9502eec38473", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648462275, "uuid": "67f21d7c-47e1-4a63-9f37-4dc7c310d756", "comment": "Malware payload (Gozi)", "value": "e2b555b256a9f827f68dc6e71942a09d0d7e69ff", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648462275, "uuid": "0c2f0070-aa0d-429d-817e-74915c26ab2c", "comment": "Malware payload (Gozi)", "value": "196cf858ed9f36995f0562390c78c87449ce0a9b404961c8ca29ba1909ea8d1fe744feeeae8b8eb7062bac351b83cd3c", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648462275, "uuid": "35009f42-5e58-43b1-9787-923714c35dfe", "value": "T1ABB4BF614470EAFAD9400F3752F9DB2B996CBE72BB9140C775C06CA3734B6E0943C9A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648462275, "uuid": "b4668c76-cb50-4498-b717-34df9ac234ae", "value": "991b656ad4a61bf404a50b480f3ae7dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648462275, "uuid": "e277eb29-f54f-479e-b3e5-db85c8feec7e", "value": "6144:32jxphrpWmbGhqto/ENzkZPK0zxhafnpewXVuJghQabuFGGGGGGGGHGGGGGGGGG6:3k7h9TbVtSEak0tmpFuJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648462275, "uuid": "f8446b7d-dccb-4d85-a1b3-db2977114f76", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648462275, "uuid": "39bcc175-bc20-4a90-b76e-9f756401a4c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648462275, "uuid": "7b58719a-95d9-4393-a927-5fe194fbb8c7", "value": "62418993a4f7f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595f8342-ae72-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648456669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456669, "uuid": "b8831a6c-acc5-4fe3-b62a-59768a8079e1", "comment": "Malware payload (AgentTesla)", "value": "9e9f9eb55feac5ddce944ab62e624b6b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456669, "uuid": "2b5e2e8c-0577-48e4-8551-2e2a8905a84d", "comment": "Malware payload (AgentTesla)", "value": "daccbf3e92f815bd13879719e94f480403229bc50337fd51a8afac490420c45c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456669, "uuid": "a4b4dcd5-9aeb-492b-a287-71cc9493d52f", "comment": "Malware payload (AgentTesla)", "value": "5499a69d9f366098eaee5df623b6bfbc3ace5aa1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648456669, "uuid": "6b502769-8b48-4e33-a135-29234c91c540", "comment": "Malware payload (AgentTesla)", "value": "a245b2dd75819f773cf29ce206b0ea904826637878eef52fab348c652a4881fbe15878f2f38d83f3fb94255896a0e401", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456669, "uuid": "f753d583-a3bb-40d8-86d5-dfdad303095d", "value": "T12925332F111C1279FA73A08D85DE5C3A7796D4ABECD1C8B41A34ED2D67425CE1883D36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456669, "uuid": "aa997c97-d6b1-4366-840f-a4953f95f778", "value": "24576:hhOfSjvKnF5eaYJXfQq16TGXILc/gEUiDt/29qJ1jynseS:CaSnFoJoq11xYEUiJ+IJ1jynC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648456669, "uuid": "a574dc2c-5d0d-4f0d-8074-334c8510620f", "value": 1052061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648456669, "uuid": "ea21add3-9df6-472c-8b90-65e4955d63b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648456669, "uuid": "ba2bd927-442f-4181-bcf0-82b9d6c63900", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8631252f-ae47-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648438275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648438275, "uuid": "c7eac477-0e60-49f2-81e5-012a90d76ac7", "comment": "Malware payload (Loki)", "value": "d19947e8a12f844fdf322cd8080a5dbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648438275, "uuid": "b2bacbea-c629-4943-9bb4-20237a8a5783", "comment": "Malware payload (Loki)", "value": "db59f2e1e2d02abe7820e73098d1f7b46f54233011423920b873c2c430f61a9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648438275, "uuid": "ece5c4fe-7187-43b7-b5f3-710137e04c16", "comment": "Malware payload (Loki)", "value": "1626a0d70a9e27af00ff3a20bf95153063a2afbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648438275, "uuid": "dc054452-bf45-414d-8152-5f4fedc2bd77", "comment": "Malware payload (Loki)", "value": "fb3b5e1f392356675d68dc2d96deb73ff94c885ac946923f9aedf4c2c67a0acdc9ddc50c8f755cefc69b9f2a5c648be3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648438275, "uuid": "d7399067-8dd2-4c6b-b98f-396f800ae6c4", "value": "T12435F11132A06B95E07643B9CC6980DC47743E4A6EBDE61F2DD272CF1DB17828A29F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648438275, "uuid": "ba495d37-a70b-427d-95f9-38a344be1aff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648438275, "uuid": "1e8ecfc5-29b9-4157-90e0-e926bf65a5ea", "value": "24576:0pPFTbdH70ed1lK42YB2A7ZVJQZ647Wsl8bUs/IqIGlL:mFbY4LEA7KZ61sJqIGlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648438275, "uuid": "620d69b9-8f38-44c7-b707-b1e09992580f", "value": 1067008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648438275, "uuid": "61b2fe69-7858-4b2c-b9b3-629c5382b3e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648438275, "uuid": "9e74f0ee-847a-4a0d-bde3-25576471f7f8", "value": "PEGASUS TERAPDA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d141d925-ae93-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648471043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471043, "uuid": "2cdb4835-0f71-47c7-a031-30bac40be13b", "comment": "Malware payload (NanoCore)", "value": "695b076cf0966243a52e6eaf2e297539", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471043, "uuid": "08ca8640-8627-47b7-bd04-5641d7845269", "comment": "Malware payload (NanoCore)", "value": "dba2b4f8a17650e49dfa817fa19e2277b3c214f66b3c87530f94e6716e9d485f", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471043, "uuid": "542b0fd6-391f-4756-ab35-f467254d2a9a", "comment": "Malware payload (NanoCore)", "value": "037b41f73408a95575670fe088492108f5e172d2", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471043, "uuid": "2ac65b3b-924f-41f0-b71a-d6ffc4f443dd", "comment": "Malware payload (NanoCore)", "value": "80bb2df78b5c405b7313aef0cf2f12f60ee03bb8c7190cce125b1c80f966d5e5b245c8452f15ecab2714fecc1109ef33", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471043, "uuid": "7bed3e57-9314-425c-ac90-1dcc8c023f7f", "value": "T13A95333C417DE01BC06070B6D8E801809B29BAEDEF777D23A1EEB7D7A568646F8449D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471043, "uuid": "0f657982-a1fd-4efb-b7dd-c29616b85166", "value": "49152:ULFO+HNVZHdp38CebiqOK5mUq0GX80j7UVuzdgscnE+Vb3:ULFO+HvpseqV5Tq0GX3suzdg5nE+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648471043, "uuid": "7d2c3c64-ad35-4a69-8b89-5775025a0721", "value": 1956795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648471043, "uuid": "5f37941c-f707-4e9c-88b5-45c8e82dc345", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471043, "uuid": "55c17f88-9094-4d43-a7ee-dce097182f62", "value": "invoice copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fbb647-aece-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648496235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496235, "uuid": "0fb5bf17-9ecd-4bfb-9c64-5a54df3eab92", "comment": "Malware payload", "value": "f90efb3dd7f9866b14e9bd520a9701e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496235, "uuid": "383d5a51-60c3-456f-868e-99dc940713cd", "comment": "Malware payload", "value": "dc3d32b45e2a3ff1ff5e722741c6229c5f62b397a23dbc02990a6be7bb7bc718", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496235, "uuid": "bbfe2ff8-ea8d-452f-9129-88798551e186", "comment": "Malware payload", "value": "f1182246270ba8de565d5bf54d912d02cabbbe39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496235, "uuid": "39e8aa85-26ea-40c7-a93a-f8dbbbedc66e", "comment": "Malware payload", "value": "d92bc7051b0c6767286de297ee3e0ce17ebd0c6196a6103b87beb54bbcb1a8724a4fb49a5a87f7d526e967ef9be1db06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496235, "uuid": "4dd2b630-9835-4e23-9707-2be8bdb0df7d", "value": "T102351210B390C034F1B71AF58D7A82A8B53EBDA1AB2851C762D56BDF9A316E4DC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496235, "uuid": "e1e7d5bb-10ee-4b89-83a1-9aa744df07ed", "value": "9dc95cd500d9b0e61eeb42c26e483caf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496235, "uuid": "877898ea-4148-41a2-8e64-4b1ae92acce6", "value": "12288:tXwgA5s/UBk7bc5Yvd4kCYTGyYzk9kQVpai+uwY1VPIJb+ZfvcP7TkGoiy+E//Eq:d8CrbhvYg99DoEPIB+mPMbEPXOZRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648496235, "uuid": "ee7a59e6-b7db-4abc-b59c-ca43140da12c", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648496235, "uuid": "5e979a50-4c1a-4fab-bfa4-aac85379ec01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496235, "uuid": "22f189b2-2355-4631-9a3f-80e94a8994be", "value": "root.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5667c442-aecf-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648496607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496607, "uuid": "4531b694-f801-4bd0-b6a4-69359e6e1749", "comment": "Malware payload", "value": "181257a9a48b6d3ba1b58ca7cd857916", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496607, "uuid": "14983bb3-da65-4d81-a3c1-7ae87ccfe59d", "comment": "Malware payload", "value": "dca84ac7fbc6543a8ff0d1bca89362221b2eb91a3004c6feda2f1a50a85d19d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496607, "uuid": "34ce5028-9161-4e42-8e52-e6ba065681c2", "comment": "Malware payload", "value": "7d0498ad287929a7ca0fd15ab22c6ac866997309", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496607, "uuid": "bc9bb5aa-1803-483d-803b-3955c3c29572", "comment": "Malware payload", "value": "cb93f62b1cba5fd1d9f93673a3061ccf7e17ab06c6ab0d0e5076e9b860978b43f32b7837054c11d80151b29212cefe0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496607, "uuid": "aaf0c17a-6f11-46fc-978a-04a2ffc03d93", "value": "T1B417017721511CEC79768F1EFCB8E66BE905A96B5E10D85CC047C362AC91392CE2C1BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496607, "uuid": "dc3d9193-2a7a-4706-83d8-39c1351e7f55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496607, "uuid": "a77c4889-17ef-401a-9dd8-aef0123488d9", "value": "393216:qVu9Ff7LOAs4JvFdy3EUzhZYAlXsYKOqQO4t1:Q+f7L9JXsdZYAlXsNQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648496607, "uuid": "fbd85b96-7cf3-4e59-ae33-9ba8e10cb9a3", "value": 19437568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648496607, "uuid": "169c1ad1-7601-4c67-8924-90b29210754f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496607, "uuid": "4b71d93f-8ad8-4f12-b164-6fd9ad1a0015", "value": "181257a9a48b6d3ba1b58ca7cd857916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c48e4d26-ae8d-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648468445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468445, "uuid": "23e865f0-5277-4da0-95b5-246eb79e9f63", "comment": "Malware payload (RedLineStealer)", "value": "28328d711953d3436eb0e9f836e1beb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468445, "uuid": "5941507e-fcdf-40be-8019-ad05679bf07d", "comment": "Malware payload (RedLineStealer)", "value": "dcc028b3f9cf27ce82f5c4aff114e0b664cbdc39a65bd81c234f111bbfd9429e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468445, "uuid": "063bbcb2-c27d-433c-a2c8-786e24bbe4ba", "comment": "Malware payload (RedLineStealer)", "value": "1c0eac591f8cbfa1d8d86ba2512b2619a07673dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468445, "uuid": "943d57a9-28e8-44fd-8867-16ab0a4db349", "comment": "Malware payload (RedLineStealer)", "value": "55af9ec05e162c647802c2d61fa8a030366b1b5e836173a32756aacf33570f394c501091c771bd46ebc4bdc6bb53dfcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468445, "uuid": "64467eca-5cc7-44dc-8c91-f58e3c3b7840", "value": "T14DD423B67784FC0DC39D14B06CA22E96024F7C29EDCA7792A35C478DAA8414AD35D8F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468445, "uuid": "55269019-06b9-4fc7-99a1-73485acf2c0d", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468445, "uuid": "0897e2cc-7d8e-4acf-b4d2-f79988378f27", "value": "12288:aHTxTeU0VnvCAcz/dwNJluW0ap9QS03ULaHNqrxlKIQNo3BsC5S+IB7buTvIp:UhDKvCAczGNZ0ap9kEaHNYK3TgSF7bw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648468445, "uuid": "b6af2887-0d97-40ee-9b41-8b3155f371c5", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648468445, "uuid": "c02194d9-3a36-4f47-81ea-c32b749b68ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468445, "uuid": "7bee489e-f146-41c5-ac27-c53924d0733c", "value": "Set-up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e26856c-ae31-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648428706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428706, "uuid": "ef030344-53c4-41c2-a7fb-e06294b7c8d7", "comment": "Malware payload (Heodo)", "value": "0b94a2d304e8d4f1598a1333ad48cec6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428706, "uuid": "c1118461-fe85-43cc-aa91-b4a8e4af2175", "comment": "Malware payload (Heodo)", "value": "dce7d43c9673ff506c61cb78ff8ad20c36b385ecb5ade2ca40a83a8812cd8870", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428706, "uuid": "a3b3ff34-e57b-4f6f-8582-548f1d38ab6b", "comment": "Malware payload (Heodo)", "value": "d619aa68dd455c5e839f7bf4cc491d16877a9a33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648428706, "uuid": "29ad1c84-93ba-4df1-b481-96125ba746a5", "comment": "Malware payload (Heodo)", "value": "6b34c8042aa7a9f849aea7313e72b829035ae5238d8557ad3bc7d377e076eda16b04c489f4bae81dc32c98ab755b6410", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428706, "uuid": "00ace619-e63d-49e7-870f-58aecfd6eec6", "value": "T174E49E1177D0C072C2BF3630551AA3B566EABC708DB9860B6FD42A7E2E745829D3871F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428706, "uuid": "38ed3e6a-703b-468b-9896-f6ef183ed559", "value": "923a5ec702466ffd61b422bacc94c6f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428706, "uuid": "af78d816-1cb7-48e0-9984-254fe34af6de", "value": "12288:JSycC8Tu2EEAeClIHRFa7UdUzrAKvtI8X0oXYl2N17OP:JSDD7RDhH3dUfLtj0oXYl+OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648428706, "uuid": "fc42966f-acd1-45e5-98b3-6d247aa2be30", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648428706, "uuid": "8b345466-eb60-4b34-abd2-1cb0f7dbc2d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648428706, "uuid": "4b629485-66d4-4172-9b23-b2dd30a7d87e", "value": "0b94a2d304e8d4f1598a1333ad48cec6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c190bdba-aec4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648492062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492062, "uuid": "5a7f1a5a-b604-47e3-897a-bb7fdb555077", "comment": "Malware payload (Heodo)", "value": "400536358f39b9daacb421a922090bba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492062, "uuid": "68e83a8c-d711-44d2-9660-b70b3c0f7a59", "comment": "Malware payload (Heodo)", "value": "dda14bb9cca6c95d953254399d6d966daa4c60eaf4895604e9191cf2a9fb70ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492062, "uuid": "1da66761-9afa-4a64-b38b-89baf7274eb0", "comment": "Malware payload (Heodo)", "value": "4d6468a3f18e4414ce7a42dfc605d2f27fbb202c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648492062, "uuid": "8f257691-ff44-4858-b2cf-e51983eb4bc7", "comment": "Malware payload (Heodo)", "value": "4ae62192692174309d090f16fd5500b65ef55100b1cb345411f070d19146db84d5ee708674d0265a3205f142f3ae8f8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492062, "uuid": "de7adea8-bab0-4e7d-8ae7-c57cc347b29d", "value": "T107E48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514D7432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492062, "uuid": "4fb4a39a-7566-42c5-868b-5a618599d732", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492062, "uuid": "eb880428-3567-498d-83b9-9f801274f6f8", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7fvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5z1CMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648492062, "uuid": "8fcd388f-df8c-47fc-985a-a410404d41a1", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648492062, "uuid": "89038584-67fa-4166-a493-d46c015e3d24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648492062, "uuid": "d0797074-f954-4cad-926d-714c2f87a129", "value": "400536358f39b9daacb421a922090bba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e604bb09-aedd-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648502861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648502861, "uuid": "56418124-37cb-4278-81c9-1b2be6afafec", "comment": "Malware payload (RedLineStealer)", "value": "540e7f8bcd6c5c0b54b37b9de1b65406", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648502861, "uuid": "4dc7f889-29a0-4616-a1db-4a7a3376900d", "comment": "Malware payload (RedLineStealer)", "value": "ddc087ef9f65b9db5875f5836b47b82cfe0af2d53cb43563033e27e7c3771f3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648502861, "uuid": "1d40599f-3b29-4bc1-85fe-df4b2e7f9469", "comment": "Malware payload (RedLineStealer)", "value": "ff9aee4beed0c7639240eef49b959970b63c8e58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648502861, "uuid": "7649e910-558f-47b2-9570-4c269e22077e", "comment": "Malware payload (RedLineStealer)", "value": "8b9228bc6c4cd90422260256895ba8f55067abbb3ad3f37d4775066429211b3d54dd95f648fbb94e8a922e0503907b1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648502861, "uuid": "9d4cf909-7af9-4e29-9f6a-5d448a6a336f", "value": "T1EC84C010BBA0C034E5B726F45DB993A8793E7DB19B2491CB32D42AEE56306E5EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648502861, "uuid": "9b6b5af7-b8fc-4781-a873-0bd5a9ca5d47", "value": "c5abd0d249bf5319619ab44b6b97960d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648502861, "uuid": "05fd45ef-ea40-45f9-b5c5-c9d45117a175", "value": "6144:mDH8DXVOpTSSvYD4eXNVbabPCK/+3/qtn/Cd4JVJ9KJvAK:mDH+EpTSSve46dar3K2d9uvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648502861, "uuid": "8ed39769-5e52-4b7c-92e3-f410623711cd", "value": 390144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648502861, "uuid": "54468c21-848c-4c85-a292-eb15188d8173", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648502861, "uuid": "f7e13b64-eb84-4be2-b9ec-1c40c8254596", "value": "540e7f8bcd6c5c0b54b37b9de1b65406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905674b9-ae9c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648474800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648474800, "uuid": "5396f4d7-60be-4df5-bd13-2ddb60289330", "comment": "Malware payload (Heodo)", "value": "bf0cffe074ecdca5089144b52619019f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648474800, "uuid": "71bb530b-622b-40d9-93a6-0cf6f74f0c65", "comment": "Malware payload (Heodo)", "value": "ddc2dc967fcdca089dc24f233a6726e55c9a8105f8d4a32646f3d13432fc8b6a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648474800, "uuid": "a033b54e-63dd-4aa9-9972-28fca469831a", "comment": "Malware payload (Heodo)", "value": "993696184ea0a54feafe5862952095b26b09d351", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648474800, "uuid": "7621daa0-d17c-4554-8eb3-8d120b437ebd", "comment": "Malware payload (Heodo)", "value": "22d402aeb4e4da7e23edb9dd438a7b19c2c33f714622c8195fa8d58df2cd76d86f13c1e42708b5967dd43d54c6e563d5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648474800, "uuid": "52add9b0-e4d4-4af9-85c5-770728c5bac2", "value": "T1F3D429AB3A8FA17DF17B017A6350FB05E0D27C1A9FBD29D70A8A758853F2D054F18A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648474800, "uuid": "cad3365a-6c3d-4d48-891c-e9edba7037a3", "value": "bf1ebe22ec6f51f906ec295a3a5c6d92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648474800, "uuid": "ecad19ee-ec87-4a8d-b5a1-ebc3126e20eb", "value": "12288:l4WjRiEKWKhqyuYzqtNoH2AyKK6cl788IO/:9KWKh/ZqtC2AJuQBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648474800, "uuid": "c0e29206-68ad-4ae3-9ed9-1a34f8f1e6a0", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648474800, "uuid": "2000f9ce-b5c4-432b-915b-bc3602a02487", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648474800, "uuid": "d68aaac1-983e-45a8-b3ea-887b09c4d6cc", "value": "emotet_exe_e5_ddc2dc967fcdca089dc24f233a6726e55c9a8105f8d4a32646f3d13432fc8b6a_2022-03-28__133951.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2229d4c-ae8b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648467662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467662, "uuid": "c87ba59c-a5ef-485a-9da5-ca05cc8f1f3d", "comment": "Malware payload (SilentBuilder)", "value": "712593229478e4d279a9dce2448fc2d8", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467662, "uuid": "dfa586e0-7f03-45c7-a3d3-92f78480a6f8", "comment": "Malware payload (SilentBuilder)", "value": "de83f556c56ef4cb818e02713ad239374be43450dae73042f5e34b388f080dba", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467662, "uuid": "29c3bd27-f745-4566-a923-1cc763f3a8df", "comment": "Malware payload (SilentBuilder)", "value": "2283c7deacfa2b8a68cf36462a7b581b09f682ec", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467662, "uuid": "9b22d77f-79cc-4318-bff9-48bebb001d74", "comment": "Malware payload (SilentBuilder)", "value": "f864fc8a87d3c941db7dfda5b4959818bdd9eeaa5a453af7341991bc8637adf68de137f067f5ea4a73fd99d5b16ae4d1", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648467662, "uuid": "d85b253c-5650-44f1-b83b-a6e6a669f4fa", "value": "T1EB43E85BBA49989DEA14877548D743997323FC304F6B074B3669F3257FF89A04A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648467662, "uuid": "72f15729-cfa5-4cb7-a46a-3050b656c1c8", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgx5G9XSZ4XsvG:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648467662, "uuid": "7a90ccb9-613e-4ea9-8ab5-2357b22d93ce", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648467662, "uuid": "601b0323-0539-4b22-bd27-f394b3092362", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648467662, "uuid": "a5d63ed2-5d01-45d5-b9b7-86a067af41e4", "value": "Invoice Attached for payment, Great Britain.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a54d7a-ae74-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648457781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457781, "uuid": "1a0486d1-02a8-4aea-9dae-987e99d9bfd5", "comment": "Malware payload (AgentTesla)", "value": "f49dd609840f120a43bc2339a258f223", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457781, "uuid": "03d725b8-457f-4f57-accc-0d472bd5c5f1", "comment": "Malware payload (AgentTesla)", "value": "defbeba113680db4e014a2b34be77a64529d1e0d5fb837e732eec92b842d364d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457781, "uuid": "35a3c0d3-3063-41a0-861f-558ff55dae9f", "comment": "Malware payload (AgentTesla)", "value": "6a86c13991dd473d2553f2b79ef3ff36be6e95f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457781, "uuid": "688e347e-bc6e-4f5f-82b7-359358d93b5d", "comment": "Malware payload (AgentTesla)", "value": "0c13d47d737069a5bfaf2679baed05093a37b613514d7700080d7d6c4da628a76e965b295fc1d705a112d22e40c78c74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457781, "uuid": "42e160d9-2307-47e2-bee4-f617e80ee893", "value": "T174A4CFBA4BAED819E2913CBE6212D3582FB9D0412B1DF752D7F11CEB6ADC74168C6043", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457781, "uuid": "c0975be4-08f0-4660-8de0-94c7906721c3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457781, "uuid": "e389304f-24f5-4465-bca5-36096658b6f5", "value": "12288:YiN4yw8unc6UIFQas/ySuFral5fxExqzIcJf:Yiaybba+yhEdrhJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648457781, "uuid": "e8ede4cb-1e78-4b99-8d53-57209a8eaacd", "value": 493625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648457781, "uuid": "d7de0918-1a79-4214-8278-b635f55cd7c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457781, "uuid": "e5b3ec71-96d9-40be-ab54-2092038fb3f2", "value": "f49dd609840f120a43bc2339a258f223", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d3b479-aebe-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648489272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489272, "uuid": "686eb43d-13b1-4dab-b4c9-eb43d364cc27", "comment": "Malware payload (AgentTesla)", "value": "9ff34a2af9784509038057aacc4a7feb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489272, "uuid": "1da6b1dc-348e-405d-ad04-eeca5bc1d065", "comment": "Malware payload (AgentTesla)", "value": "df0c4a0cad2942a1a85b594dbb8c86c5e7533ca640dd63c988223e1fdc826c08", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489272, "uuid": "fe17fbf8-79a9-4216-b25e-569f89a549cf", "comment": "Malware payload (AgentTesla)", "value": "c566a268d7b9a28be6ada4b0232aec37b271bb80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648489272, "uuid": "46791ab2-d163-49c8-88eb-8a408e6ebb1f", "comment": "Malware payload (AgentTesla)", "value": "283fedc8695187929c2c36f02fd5881b70ff617867c358cea6e313109b8b57da2035ce06d0a700ef1deef64a7a80c2f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489272, "uuid": "cb65f7c7-4900-4b7b-a12f-096431c91e64", "value": "T17ED4EC1F3A875572EE4DF332ED010964AA5E0F4F2A70A5E31F8AFDCAB75B0665C44884", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489272, "uuid": "dd7321e9-be69-4ba2-bbb1-503c70a92bf0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489272, "uuid": "144677f8-ec5e-4b22-a1b1-e98fab3423cf", "value": "6144:de1KNrx78TPYDVSfGoIIYxasSecFplLCcs3ATdIc0WGgJ4pWsoLf0EAZRFos7ANs:deQNCTPYJoII6KPFtPTdILWG84QxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648489272, "uuid": "3f024d35-4af2-445f-aece-01fdd75e2c41", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648489272, "uuid": "3bc91972-4d0b-49ef-b878-eeb82696a9de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648489272, "uuid": "bf6e0095-c38b-47f8-b519-dafb3d7ddd60", "value": "BANK SLIP MV DIONI.GR.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114b3b94-aeac-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648481458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648481458, "uuid": "d3341537-c922-4736-960b-dc17c654ccaf", "comment": "Malware payload (RedLineStealer)", "value": "8e133e33e0b441d6708800c40c688e34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648481458, "uuid": "43393e23-b2bd-4dee-803b-47626149d69f", "comment": "Malware payload (RedLineStealer)", "value": "e079e6470d66d8e234fc2f36f401047fb00159ee8ff36fa1bc71a4f9d8f0e8da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648481458, "uuid": "1ac5fa41-4cbf-4471-89d5-24c31698d2c9", "comment": "Malware payload (RedLineStealer)", "value": "ecdd502e7250663300404828fad2dd133718d68f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648481458, "uuid": "9f6215f6-750d-4f7c-a995-413aa02d1b45", "comment": "Malware payload (RedLineStealer)", "value": "0c6eb32237252b2a8ab4568c0b41a161437c84664784ab9f40983f7e393be998965e752e5f1d982e5307d04cba79d7cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648481458, "uuid": "3f6ac70f-1f3e-41e0-96fb-064352a212e7", "value": "T1EB84BF00BB90D039F1B715F5897A93A9793EBEA15B2455CB32C52AEF5630AE0EC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648481458, "uuid": "a526fcae-badd-4dee-b4c5-a36dbc3b6b25", "value": "699070d0802ac292c6d967d0195e7ff3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648481458, "uuid": "b506b1e1-8280-4f3c-ad91-7387a5b4b5b9", "value": "6144:Igx50V56eoWtv7nRbiJLlEkU/QX56twANEbCc4YNnBAMYW:IggV56ehtv7gZE3A5eNEbCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648481458, "uuid": "811961b4-a8fe-4d46-832a-181717124d36", "value": 379904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648481458, "uuid": "d7a0ed92-ff94-4188-837d-94893e32c4ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648481458, "uuid": "627489ab-44a4-4e32-b21d-4170c9a6da24", "value": "8e133e33e0b441d6708800c40c688e34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88369d47-ae8f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1648469203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469203, "uuid": "6ce6d310-d12f-495c-8373-70ff8faea754", "comment": "Malware payload (AveMariaRAT)", "value": "65fd5cc3c4d2a99e5a1298b383aa4876", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469203, "uuid": "afb4a0bd-59ca-4faf-8bdd-a12bd5996022", "comment": "Malware payload (AveMariaRAT)", "value": "e0dc301bd3c9e359b08e27fb4173fe77f5342d076a8a8327b6abbc47de8812bf", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469203, "uuid": "b35528c8-975d-4d03-a193-28b7d9d70ab4", "comment": "Malware payload (AveMariaRAT)", "value": "62c73aa12baa781f16c853951504199a502e494b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648469203, "uuid": "c67b2686-0a6b-4f70-ada2-949b1c20200b", "comment": "Malware payload (AveMariaRAT)", "value": "fab26bdc8242e1ca288734c6f9b7f3453307ac0faa1817a0447c6caa26c2df313917570e32104a022a0f75df4b7c313e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648469203, "uuid": "a5cb1910-55d6-4dc7-aa76-3a9a27d05017", "value": "T1F3C4D12B5BC61B95C0B4B77E03A4A95513F0E1DB1620EB2F2D8541E4EB977862F23393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648469203, "uuid": "c46562be-e8f2-46f1-a22b-23e2f8345897", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648469203, "uuid": "5de16e79-0dfd-4057-8c9f-2acd81180d24", "value": "6144:l4Zyn3UoiYx8HHQXDcou+3fkPL55hIX0eLDz/+JqGNhuTTb6BC5r:yZyn3UoibbouP55hI7gXhuL6BM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648469203, "uuid": "f3e3bbf8-8104-4987-a7c2-4f121074654b", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648469203, "uuid": "6ddf54b9-aefd-4ed1-8312-4b9ad134e795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648469203, "uuid": "ff3d3e69-e0c6-45e5-9888-4d59aa8bda66", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6338e9-ae6e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648454957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454957, "uuid": "05281b3a-41de-4841-9b43-3d87bbd16181", "comment": "Malware payload (Loki)", "value": "c1a9a80852abba625c95128152d311ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454957, "uuid": "6314fa02-7513-4771-a292-0322503c6622", "comment": "Malware payload (Loki)", "value": "e11e6d8b40b1a72e7f34543a43d625844ca90600fdd66f824c30abfcec654c72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454957, "uuid": "16d03108-eaf4-4005-8cbc-faf854912a2a", "comment": "Malware payload (Loki)", "value": "782bfd258d9925cbd3d01f782cc44dadf34eca11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454957, "uuid": "cb003bfd-d1b5-4844-b773-6f3e2aad8d4b", "comment": "Malware payload (Loki)", "value": "01d82f6d9766bd7529e3d11de56a978eaf11332deb223f1b772091d70c52dd7d58086736a471da9120809768dbfc4cf3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454957, "uuid": "ae7038ce-b558-44d9-8d8c-f56f10c4d6a7", "value": "T11334121A6CD390B3D122A77065F7F336E3B387CD4A62190B8BA53F7E5A601478355B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454957, "uuid": "9d0a7dd8-4a3d-4359-a012-565d2643ec33", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454957, "uuid": "8d57970a-2df1-4de1-980f-5357e93a17d1", "value": "6144:rGiBj0htry0AL0h6Cz0WJ5l4+U0wbBl6TH1wJe:RAtre0h6Cz0WXlhDwbaTH1w4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648454957, "uuid": "5e70acb9-daba-47ac-a921-fd5417fd3f49", "value": 241804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648454957, "uuid": "da39352b-9412-4eac-9f65-05ad4294a328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454957, "uuid": "8ae3473c-1544-4ec3-9c1f-c3a18684d02b", "value": "c1a9a80852abba625c95128152d311ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe0ec62-ae5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448439, "uuid": "4d33ba3b-57ae-493d-8e79-c6bbb63a6bae", "comment": "Malware payload (Stop)", "value": "f243aca7e9b6f4e2817ece6f4d3b0e9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448439, "uuid": "538212f4-4950-4763-8408-1cc954309360", "comment": "Malware payload (Stop)", "value": "e1331f18cf6e141b8659680fbbd58360597732fe21e9aa8906806d7d6de117f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448439, "uuid": "79d4a241-1276-4ed3-b143-a7a5be7ad04a", "comment": "Malware payload (Stop)", "value": "5549f4735302de46c149470b1955b7a4a97d019b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448439, "uuid": "a6c84ccf-6541-44fd-81e6-57698dff9691", "comment": "Malware payload (Stop)", "value": "e7ea1a8c0efa7070fba52344cc6211a1f379f2b7e2a788e477b91073e80034bd57a07015dbb3b95969aa8dd3d6016cf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448439, "uuid": "f6e98fae-730f-4ddd-8560-f3a8c20402ce", "value": "T1D9F40210BA90D035E5B712F44D7A83AC792E7DB1972160CB62E66AEF1635BE0DC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448439, "uuid": "27509acb-ab26-4611-8239-04ca905c2b5f", "value": "2b0cb1de227ee27eff54e94dd3b1cea8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448439, "uuid": "2fafe051-cd59-4473-a2ee-17113a3faf14", "value": "12288:Xz6PG86Fq9BHakSNNpOeJtC6fsJ4xx6PQKzN3li18ggjXsphM+ebdZX7Kzf0P4:+uFsKNIAsJ2+wy8phM+ebdhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448439, "uuid": "15e73d55-b339-470b-9647-19f2330cc73d", "value": 792064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448439, "uuid": "7ef51886-fa29-42fd-b7e2-ddcc16ce1564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448439, "uuid": "b82df036-2eb6-41c4-b776-28fd507139fb", "value": "e1331f18cf6e141b8659680fbbd58360597732fe21e9aa8906806d7d6de117f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1d5360-ae54-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyt)", "timestamp": 1648444060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444060, "uuid": "b700d56a-60f5-40ad-910c-9510bfdcb1c3", "comment": "Malware payload (Gafgyt)", "value": "6a726d4bc8359bc9d83e744ae7658814", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444060, "uuid": "31eb5cd9-9a06-4be7-ac71-b33b797f1eff", "comment": "Malware payload (Gafgyt)", "value": "e1365f65a0680423cf6354993c2c2343860c401c27f908494f5787462d3afe93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444060, "uuid": "73410cb8-56cd-4d6b-b2dd-a26baca8b582", "comment": "Malware payload (Gafgyt)", "value": "28634fd60de5893c010f226456b5eec78ff4e73d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648444060, "uuid": "dd7b37fa-f53b-48ba-9b62-4df3a808cec5", "comment": "Malware payload (Gafgyt)", "value": "8359824dd2eb60fc72ee1afb1fcee5062c59875ef7bc9183716374f05b35056523797d1651b4aadbbb16a79e14be2a39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444060, "uuid": "d88210c7-ce6d-475f-86ad-6dbf9f1571fa", "value": "T1FCB318277B274E63C0CA157112E30332A7B5DF4938BA5387A9A07DAC6F37A8434167D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444060, "uuid": "8df49305-c19c-4c38-9bbd-21f205f89777", "value": "3072:0uHrTHNPDeJeU2gRLhpmm/N5bNs1n29NH:0uHvlDEt/mm/N5bNs1n29NH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648444060, "uuid": "f18c335f-de88-4807-9401-c54df26e6be2", "value": 109920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648444060, "uuid": "99533415-3daf-4df9-80d8-06e83c923086", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648444060, "uuid": "6f30d925-ba01-4fe5-966b-e0272dd47f7d", "value": "6a726d4bc8359bc9d83e744ae7658814", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631e9f25-aebd-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648488897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488897, "uuid": "a61c387c-3713-4d81-b3fe-eb63ff51ebdb", "comment": "Malware payload", "value": "40f03344870c7bd49136e9be04c7ec79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488897, "uuid": "24625599-15d5-46bf-ab8e-ffa4fe138865", "comment": "Malware payload", "value": "e1b6e636286129b9aa44b56754270b7f954bed8b4a1db622040fa1a330cf2522", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488897, "uuid": "0fd2c094-8de4-4529-8fbd-b1287cf2240c", "comment": "Malware payload", "value": "f4eb34700454b1cf5fac850898593e578d5a7ea4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648488897, "uuid": "2a67bcd4-d47d-4522-b226-1f387a262ece", "comment": "Malware payload", "value": "ae884ce881605ccd4383faabe1ed8f287d67850afe0b96205084f4fb167f1c28b1d6fd1d0bd819c4bedd31bb0dfef87b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488897, "uuid": "7eea463c-8e60-4061-b41b-4080bda2da20", "value": "T14CB461BC7A414A72FD1D9130AD510AC4BB670F036280BA8657FB25CA876F1F76E45C8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488897, "uuid": "d3e21b5f-b42e-4073-bb5c-e7c069b1d491", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488897, "uuid": "a83d9f20-48f2-4534-982d-21e1c2fada95", "value": "6144:loitN34kOE29eFNyrb6s7kjzD5V/IPZmuPdBiYqEZBNQujQXX+KDb7uLbz7f:lo0NnOEieFNyrb6zVYZmuKY1TQucX8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648488897, "uuid": "846d2ebd-13aa-45b1-8a51-6923662b6d85", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648488897, "uuid": "1ab5afd3-371c-45b6-90be-5bc48f28f3ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648488897, "uuid": "795e4363-f4ae-438f-8c76-73cd447aefeb", "value": "MV DAEWOO TBN - PERFRORMING VESSEL.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f7d746-ae6f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648455505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455505, "uuid": "f3ed2611-033a-4528-ab62-a58dcf5a78aa", "comment": "Malware payload", "value": "8c458612c1f43370fd179412be487f3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455505, "uuid": "4e412771-0de0-46df-9fb7-725197bd4e08", "comment": "Malware payload", "value": "e22af98e560c06d8fbed31cf8df0d552bcaf3d95df61ba559f6db4515af3b7e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455505, "uuid": "0f9bdd96-1e41-45ed-af2d-00d92e925bd2", "comment": "Malware payload", "value": "47d5c8b79a5b60a473e4a763f276c97ae6833d67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455505, "uuid": "5ed94e80-f092-4ad6-a732-5bf137a8e733", "comment": "Malware payload", "value": "2d33e64dc3136040f477fce8379fdfb313531832d51ed82971686df324a59f15b92ea69d03f2adb5dc653a6a751b2ac4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455505, "uuid": "16496db6-8373-4008-b8e3-9d6f12ae1814", "value": "T16E369C395B09DD796BD70222D06B315F6480C575E6CFB08F339A0DC1AA8BDBECA8D485", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455505, "uuid": "6dd93b38-7b8c-4367-bea5-c433912dc795", "value": "98304:NZnEvN/KwZbcdjEXRBQR48DN4hIOHFGzY6PtBPdai+zg5zsV8C8syNkR3I0gzwrI:uNSB4XRBcd+4Y6P/PF+z8zs2CwNI5NrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648455505, "uuid": "7bf83527-9660-4c48-a68a-9748098c8045", "value": 4964929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648455505, "uuid": "c2c3c973-1ca5-4ca9-8186-00725873b1e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455505, "uuid": "7a45f253-6fd1-487a-aebe-93d8dbae8bdf", "value": "8c458612c1f43370fd179412be487f3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16179fb4-aed2-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648497787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648497787, "uuid": "611a5178-374c-49c6-bf95-c6d103a8d3c4", "comment": "Malware payload (SilentBuilder)", "value": "847ee64d38eb365788c9ff7eb7d3798a", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648497787, "uuid": "ce849411-8f8b-4ae2-8624-a22a4160cc02", "comment": "Malware payload (SilentBuilder)", "value": "e2cb3171d33922afd8aa4a93cae06041f248913551f4195671cf5123b6b7b1a7", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648497787, "uuid": "55b3f7ef-7c76-472a-9579-4e76355cc282", "comment": "Malware payload (SilentBuilder)", "value": "9d2292da73b1f2bec26b2bd18cea11c616898505", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648497787, "uuid": "6ac5d3f6-74fd-41fd-911b-2fe59b89c52c", "comment": "Malware payload (SilentBuilder)", "value": "1456ea3b594cb149f465185dd716c31a818df117b6ca91f09bfb03bd4d4e2e82b3bbc8a0f5ea33301b30492fdd1208be", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648497787, "uuid": "5bca1d7a-5013-4740-8bb2-abcd7256a570", "value": "T137C3AD8BB659486DF921877488DB879A7363FC344FAB47473214F3366EB95A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648497787, "uuid": "11cf568f-bfaf-4155-9936-e1a6c8b3a8f2", "value": "3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlC9:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648497787, "uuid": "48f5c201-97fa-43cb-8caa-5130c3f659c1", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648497787, "uuid": "cddaa8ae-ad3e-42fb-86af-a85584d1bde9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648497787, "uuid": "f46c4382-de37-4a95-9552-f6cb3ca23d6d", "value": "847ee64d38eb365788c9ff7eb7d3798a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3385098f-ae5c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648447156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447156, "uuid": "99d134eb-7688-4149-a0e2-9668578a72b7", "comment": "Malware payload (Heodo)", "value": "ff01cd2e72f4ebdcdd4242d6c63e6a1b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447156, "uuid": "bf021246-9937-43fb-b723-950b3c334996", "comment": "Malware payload (Heodo)", "value": "e33c6a887ef7f0e286829cae88f030f399c94fb2cc4257ae80a765d9a4d2151e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447156, "uuid": "64580cac-312a-45c5-a593-6d78db2d5cbb", "comment": "Malware payload (Heodo)", "value": "581ad03fa38a04719dd1121b5ee70cead9c3539a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648447156, "uuid": "e58ffb9a-b6f6-4fbc-91ea-840a34b10f46", "comment": "Malware payload (Heodo)", "value": "1ff623115551870ebebe18275b49ce4790e5a029d475c02dc550fac1e3ab06af44dbc3f02daa4f419b8910167a8ababa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447156, "uuid": "f52e0020-6b51-40ee-8797-7495928268b2", "value": "T1AD449351956340738BF779E2D7F512776AD59B81C33B097E02A8C43EBA28E437762E20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447156, "uuid": "c7d3fae0-8b6a-4c50-aee1-18812b87bbe9", "value": "6144:U/L5tYtXZ1BpFHyFjJmP/RbV1M2lvMOeL/p:UWBpwupxl0OeL/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648447156, "uuid": "99c41fa3-9cb3-40fb-b7bf-e575de70f52f", "value": 277998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648447156, "uuid": "318c50b3-4610-451b-b277-ac57be9a5d6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648447156, "uuid": "cb30f9fd-9e1c-4f79-b3fd-48e57d16f32f", "value": "emotet_exe_e4_e33c6a887ef7f0e286829cae88f030f399c94fb2cc4257ae80a765d9a4d2151e_2022-03-28__055912.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a69dcfc-aed9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648500908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500908, "uuid": "998a5e20-60bb-4be2-950a-9929733d5576", "comment": "Malware payload (Heodo)", "value": "32ee0887e31ed93216ad8344ea2ffab4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500908, "uuid": "b0ffdd8c-372f-470e-9885-9ecee64c3605", "comment": "Malware payload (Heodo)", "value": "e3d923429a28150da8b6ab8cfc03cb74f33d6fd13ca4897ac572b411ba62b888", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500908, "uuid": "69666c9d-3e7d-4461-96d5-ee1ad2f161f8", "comment": "Malware payload (Heodo)", "value": "5c2c27a8fa76bde2bb1f263a28fd9b6d3871582b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500908, "uuid": "24df877c-9260-49e0-8d65-b462d0e13f5e", "comment": "Malware payload (Heodo)", "value": "901f75a58aea06d189c7d11acaf79e5d32baf3f9e5cd7ed9ade9549f15c3ca1e46e2506c737a5e7edee5b4a1c4cb77fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500908, "uuid": "67fe02a5-b9ad-415c-963d-3baa19e080b2", "value": "T15DE48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514DB432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500908, "uuid": "430f92f6-2e58-4f6f-bac6-847cd8a3277e", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500908, "uuid": "a53f68f7-45b3-4ec7-971d-b62dc187ac9b", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7QvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5z6CMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648500908, "uuid": "18619dca-469a-4e00-ab03-f70cc7761c68", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648500908, "uuid": "317540d7-fcd5-42c4-b989-fd78c7fcab52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500908, "uuid": "428995a1-2679-4375-a1d7-999ba8e0b09f", "value": "32ee0887e31ed93216ad8344ea2ffab4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad41bbf-aec4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648491917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491917, "uuid": "b1fa243d-af9f-4852-a938-69aba337f74c", "comment": "Malware payload", "value": "9481725b9400c9abc59de4b854e60409", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491917, "uuid": "58b30dfe-4ff3-4bb4-98fb-9fc708c9fd02", "comment": "Malware payload", "value": "e4c0a2f7d9f9bfeea2ffabe90d82654b043efcd838e727ce5a378a12f559965f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491917, "uuid": "77ffea7c-22a8-4e41-8777-f425e279aa74", "comment": "Malware payload", "value": "1f19a979eb5c46ab28bb0ce24446e069d976ebce", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491917, "uuid": "18687f3e-c127-4a59-95d4-a369dc8cc055", "comment": "Malware payload", "value": "efee7278620453dfd028be2d6602ceed6d627196acb48a554f049833de1aef86858037f13daa351da5c608af7696f82e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491917, "uuid": "d76fe45d-003e-44db-80af-c5dfc77471ff", "value": "T1D413F27DC523797AC825AA34880612F1F22E4952E1CA76FD381F9BDDCE44D9F3325889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491917, "uuid": "da3a1e3f-acfb-4dcb-953d-644614977e37", "value": "768:FiWrLRT2UhgtkloZCXvSXi2nSLCBSdDTOF818wxoFTxoH7zV6ej:FiWpTrmtr3ehCF8oFTCH/V9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648491917, "uuid": "dcfea30a-1b09-45b6-abff-e142335a2e62", "value": 44362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648491917, "uuid": "b2d4a4b3-2db3-4394-bbc3-0a28979f3c6d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491917, "uuid": "d012246a-e5e8-4c9d-b5d2-07daae4d39b1", "value": "2022 DCCC Annual Award WINNER Breakfast PR.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71ed202-ae68-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648452558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452558, "uuid": "ac8f5487-d74f-4d27-b828-670f21e8618e", "comment": "Malware payload (AgentTesla)", "value": "cd7b1eeaf412f69e6911601434361597", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452558, "uuid": "46d4b52e-9feb-4166-bf40-38c23386db7e", "comment": "Malware payload (AgentTesla)", "value": "e53ffddd18c7018daafe0212e017a54d788e1909cf0f81a47451dfde342230a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452558, "uuid": "f0e83a1b-3017-417e-b767-9b114eb3f009", "comment": "Malware payload (AgentTesla)", "value": "d8af5ed2a61f495c5bce1113c9f94d5e9cf1d930", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452558, "uuid": "95c22bb1-9dc4-4ee9-9486-085f8e301497", "comment": "Malware payload (AgentTesla)", "value": "9a68a886dcae4739acbbc8a4e523b1ea86b48595a7799184ffcd34129ed51a79fdbbbd126d8321f44fc836e3b12dcb6b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452558, "uuid": "fc08bf27-e6f4-4664-8d5d-b38f9afd9b44", "value": "T150A567F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E5651EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452558, "uuid": "06dbaaa3-76a6-4eac-b179-7a5799e902f4", "value": "24576:gjxYwehenVW8j4odZuxNjXdoKr/uoS7Q4S:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452558, "uuid": "819f17ac-4a0e-4702-9577-a63e509a18c1", "value": 2117782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452558, "uuid": "91248dcb-2207-4449-8a04-d11dcce92de5", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452558, "uuid": "853d8631-d8ed-4d3b-8440-79715d2c811f", "value": "DHL Shipping Documents.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3540790f-ae5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448448, "uuid": "8731e55d-be9b-4763-a44b-e63290f2f61f", "comment": "Malware payload (Stop)", "value": "ae38fcc9c7e302c5ed0e60111027e544", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448448, "uuid": "f70023d1-e92d-48fd-809e-e72246ea6417", "comment": "Malware payload (Stop)", "value": "e557171e821568f59ea764731d05355e714eeb14019ea3cdfdfb7f427775ded7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448448, "uuid": "2522de62-0a9e-4aad-9ecb-2defe3217c09", "comment": "Malware payload (Stop)", "value": "5568804aa3f58fa7899f4f7fefd4e7baf8d2a37b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448448, "uuid": "8ab90dcf-7c74-4b57-8001-eb3557c0f129", "comment": "Malware payload (Stop)", "value": "e4cb0033284e6f2677f0dee6a3cc7b4b3db8fc21a1ab25e58b6bf4bcbb136b7ad0fe3a2b7953f08062be634ad15e8afd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448448, "uuid": "e85c1b3f-63f5-4aba-b766-539681d20ee0", "value": "T16FF423213E639171C953B4763835EFF16EE7E5B2024244C927985BEC2FB13D1A6BA306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448448, "uuid": "529c7471-d12a-4913-97d3-6a4dd21efba9", "value": "ed1b2792ced7a8e7bb849a84d01e5fcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448448, "uuid": "61350609-d1d9-4265-a977-ea195b0418e4", "value": "12288:op4ln7+F/CBIh8J6LJ2YjabnkHhwAwxxtCWVGeEv2YsXY3L6ariw:opE7+F/Cah8J6QYjgkOAyxx4eEQcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448448, "uuid": "8f6cae69-b7e0-45b0-bfa3-debf0d836781", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448448, "uuid": "847ac5cc-8949-42ab-8257-7e2502853a75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448448, "uuid": "90c57422-c81a-4e89-b965-d4697472c08f", "value": "e557171e821568f59ea764731d05355e714eeb14019ea3cdfdfb7f427775ded7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ea35a9-ae95-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648471809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471809, "uuid": "3b118301-1ced-46f4-80fd-3432021ce67f", "comment": "Malware payload (SilentBuilder)", "value": "1da8d6e49351e11365c9195d072a19b2", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471809, "uuid": "a3dc8f91-1747-46a7-9f98-0b39b1e3f023", "comment": "Malware payload (SilentBuilder)", "value": "e598053e9c6952a9e4e00f17944c0486c5342d6bf0d82d2a560ec98c06916a0d", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471809, "uuid": "639ed360-566b-44ef-a4e8-d98f1e777904", "comment": "Malware payload (SilentBuilder)", "value": "2e0e767ac52b6feb79e5b421d711d6cc6e73168f", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471809, "uuid": "55ab7779-c67b-4516-90d8-8c9d911276d1", "comment": "Malware payload (SilentBuilder)", "value": "2d0684ba085d52ce242e6bdb7080dea3c4479ab6431ca180c2f9e4ae6a0baccced810c960dea2daf940641e9d4a51add", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471809, "uuid": "bd8614db-23db-410d-945b-a4ad77883f71", "value": "T1D343E85BBA49989DEA14877548D743997323FC304F6B074B3669F3257FF89A04A0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471809, "uuid": "306aecc5-9de4-4125-8204-1fd8581338ec", "value": "1536:VsKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgx5G9XSZ4XsvC:aKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648471809, "uuid": "70bfe45e-4057-4d4c-8955-9226b2b23a30", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648471809, "uuid": "4a2dae3a-acec-43b6-a99f-a0fd96aacc7d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471809, "uuid": "ab50f4cf-2ed1-4875-aa9f-c7ec18efc080", "value": "Rechnungszahlung 2022.28.03_1209.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e950b828-ae67-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648452186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452186, "uuid": "857da4a5-7fc9-49c2-8d7f-f48861d7e614", "comment": "Malware payload (SnakeKeylogger)", "value": "3be05bf6ebc0b1e3a41913975eb9ba7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452186, "uuid": "5c0ee29f-3ec7-4edc-a577-4b794d66c0e5", "comment": "Malware payload (SnakeKeylogger)", "value": "e5bf515cb705a67f0eb557bcecb60346f739d85885e3cef40a5185b55e2159a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452186, "uuid": "928febe5-5011-4460-bfdb-0b69c0360533", "comment": "Malware payload (SnakeKeylogger)", "value": "f9a3ef8930d88ee5cdc6d17ca78a191fafc62d7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452186, "uuid": "7da43656-9a80-4e18-b35f-86f2d71c4c44", "comment": "Malware payload (SnakeKeylogger)", "value": "7894040813f64e8caaf848aa74e105755aaf74f5010ce000a3911fa03b6e4a00381fcb6d279f35b6f7fd07e9499167eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452186, "uuid": "ac545703-0058-4e64-b5ad-1718dac7f2fe", "value": "T10E15234DB7888302E5FE1BF4FD3506501F7A676AE783E33E4E4424EA48A37909D05D9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452186, "uuid": "7b97a35b-3a77-4bb8-951d-49d135b6a147", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452186, "uuid": "f6cbcf70-b4b6-46a2-be52-57094a34b3ff", "value": "24576:bDDA8g/AeWaVaxzYVu8ABaz/KNFUUfnShGHJ:/0YF+GzXBaLKNxnSuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452186, "uuid": "5934c1ff-75ee-44f0-8dc3-fff50f24aa17", "value": 949760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452186, "uuid": "dbc74651-201a-4dab-8d29-cdef6196ff14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452186, "uuid": "9857b936-c2e1-45e2-ac1c-4392fa0414ed", "value": "3be05bf6ebc0b1e3a41913975eb9ba7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa0df6b2-ae7d-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648461663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461663, "uuid": "1d9cc3e6-61f7-4671-a56c-d98ed055b2a6", "comment": "Malware payload (RedLineStealer)", "value": "21e583771cb43e12accdbae2214fdf25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461663, "uuid": "6764830d-529f-474c-bfb3-76402f49fca6", "comment": "Malware payload (RedLineStealer)", "value": "e67a2b81bf50cd9aebc25271deb32bf15715d3f0a384489ff383d7e63e685d56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461663, "uuid": "c7bbe7c8-6b1e-4bdb-93f5-593c64d96308", "comment": "Malware payload (RedLineStealer)", "value": "8da578ba5ab3c99a0ef3e0eaa049e8e5c7345c05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461663, "uuid": "45d913c3-4c09-4cc8-a289-341b3c43aaa4", "comment": "Malware payload (RedLineStealer)", "value": "ad458e0d7808c8441c00cac181667503d16af7b75ca7053e0a104bdf3ba6b6f138b7bc2f9d52bc8edf205424040f75d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461663, "uuid": "250e0e9b-1b69-4582-a80c-f67b11a4c6a2", "value": "T15284BE00BB90C035F5B726F4597983B8B52EBDB19B2460CB62D93AEE56356E1EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461663, "uuid": "75d17b05-9119-410d-b1af-b6b35ff5c735", "value": "62cc0f071500a34baf4b74c917ef3797", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461663, "uuid": "989ac592-0087-4e2c-be1b-318e89718e61", "value": "6144:MFpDLIq5bYMGcwzO8LxDRyEkLluH/m34od/4GBZOjV9EgvYmoqBR2vF:Op3B5bYMGnzO8W5gEdnBYJ91z1R2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648461663, "uuid": "03777d5a-b15e-4cf2-b808-728d0601096c", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648461663, "uuid": "4b3cf99d-62a9-4784-8172-ad52e814d21b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461663, "uuid": "a8f1846a-44ee-4b43-b343-725b0592006b", "value": "21e583771cb43e12accdbae2214fdf25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef786ef-ae88-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648466181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466181, "uuid": "10cc493e-1436-489a-822c-b85e87c6c505", "comment": "Malware payload (Loki)", "value": "ce62d015573294e4b480f1b5ea9479ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466181, "uuid": "d528a086-85bf-4619-a087-9e6ad9641948", "comment": "Malware payload (Loki)", "value": "e6838b0bd5f052ad73b1ceec621c1abe50b82a2434fcdeb73a555688e02b02f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466181, "uuid": "b966ce9e-7a98-425e-8142-5c51ef39da56", "comment": "Malware payload (Loki)", "value": "6178417c2821d8c910d74c035fd2cd623540423a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648466181, "uuid": "7b260ffc-80cd-4d51-9ff0-f09481900d97", "comment": "Malware payload (Loki)", "value": "836588ab8670675b4d8b945a8d40bff581394323b4494079e2812cb814c6d3ca50c17e372a0710646b8ab4565c53109c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466181, "uuid": "5bad43d6-8f72-47d9-a7a0-2b6d30eca15e", "value": "T16B35F10376998A11C475437BCC9A81CC07B57E88AD1BD60F3DD533CE1A72787AA19E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466181, "uuid": "a3efde97-2652-4764-bd4a-f5a00799afe2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466181, "uuid": "b81baa1f-07ad-4a1b-86b1-0d3859e6536b", "value": "24576:SDDtZSaRESCyxQFI/qSdWtui4sgvYUpPlYTfjAQl:+DJtCyd5ctYsgvYMYT7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648466181, "uuid": "515877d5-b6c9-472a-bc19-01c7110f76cb", "value": 1103872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648466181, "uuid": "8e9c87cb-d06f-48e2-9445-fff081e1387f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648466181, "uuid": "58e5497e-5030-4ceb-b413-e5e236a5d97e", "value": "DHL DOC 74653898.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd20358a-ae8b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648467681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467681, "uuid": "4792c424-5276-4e0c-8807-3faebef3da4b", "comment": "Malware payload (Heodo)", "value": "c74fa4b8fe717a7ff96cc2ad1f2e20d0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467681, "uuid": "b4c06bdd-a1dc-4b9f-a458-b8c68bb68ae0", "comment": "Malware payload (Heodo)", "value": "e690b6905fb7b5f3f28b93e31215fc64ff27f4fa1674699831fd36bd38e55fa8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467681, "uuid": "399e4802-c74c-4df1-825b-8ec2573b1fd5", "comment": "Malware payload (Heodo)", "value": "97fe27fae45cd57b107729dcde09a81526d4bc9b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648467681, "uuid": "465d965a-5bee-4114-ac83-1f9e01ca8630", "comment": "Malware payload (Heodo)", "value": "77ece3bd7c8795882e6e221e409733c730951666912c0c404932a44022801fb70d39472615b38e81a00a79b146918e55", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648467681, "uuid": "16c092bd-8223-49f2-8378-d7bb5b617c90", "value": "T13494CF0272D0C47AC6EF23785D239B5AA7F9FC208A75C647A751BF8D5E326C1893035A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648467681, "uuid": "e07cf4d2-a2ae-49a0-a25d-8139c87f66c5", "value": "8f8b1cb86c6697dd342b65a36c6ccbb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648467681, "uuid": "31d43b87-6f47-4893-9c05-bad4414a6ec7", "value": "12288:zwn2hR3547jpDMgyS+xpuCMS5AhugWarPU:DRJ47xjy1puCMSqumrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648467681, "uuid": "e09378d4-5a94-4147-bbf0-6cd8c3f0b0f8", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648467681, "uuid": "feaac4fd-e9d2-4bc0-b3bf-d4f454bf09ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648467681, "uuid": "a641aa85-895f-44bd-9def-6d4b196b06df", "value": "49i1xUE6WsNYVt3q0Bgi6fkO8Tzb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ddabe8-ae2a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648426009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648426009, "uuid": "7c13a4f0-ce16-4984-878b-86f85c3c6db3", "comment": "Malware payload (Heodo)", "value": "36f5f07f364712d2c3518ed6e2245296", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648426009, "uuid": "38b985e5-65fd-4ed7-964b-92376f82e7a2", "comment": "Malware payload (Heodo)", "value": "e6c97ddc99e19e116f281e9799bf096e1dc9ee5738cba7c5cc402b8df749ea67", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648426009, "uuid": "a0cbaa14-a46a-4524-9734-9bfa4134b666", "comment": "Malware payload (Heodo)", "value": "9ae92fd0c5729b610c300abb99effa399dbab7b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648426009, "uuid": "cfc60d46-02cc-4525-b82d-c21b7998fae4", "comment": "Malware payload (Heodo)", "value": "6e6d448a63abd218ee7254b78212839e2d3b9a68e18a216a8faacc3e2908ca19c5de46b85ea06a56b5a0fa390e2d98ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648426009, "uuid": "8d04730c-700c-413e-81af-457d14853f21", "value": "T175E49E1177D0C072C2BF3630551AA3B566EABC708DB9860B6FD42A7E2E745829D3871F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648426009, "uuid": "2d12bf19-af05-470a-b2cb-c0f4474c9af9", "value": "923a5ec702466ffd61b422bacc94c6f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648426009, "uuid": "4e8663a0-4005-45d5-8ad5-b4667b54a949", "value": "12288:JSycC8Tu2EEAeClIHRFa7UdUzrAKotI8X0oXYl2N17OP:JSDD7RDhH3dUfUtj0oXYl+OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648426009, "uuid": "77258ed9-82e6-44dc-90f7-983ed82584cd", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648426009, "uuid": "d716d9dc-89de-4d51-a1d7-02890bc556b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648426009, "uuid": "3fc43894-dffc-44ce-bd57-4bb6dfb3d6ef", "value": "36f5f07f364712d2c3518ed6e2245296", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e213f65-ae8e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648468729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468729, "uuid": "26534714-65c0-4735-ba90-806f22b8373b", "comment": "Malware payload (AgentTesla)", "value": "b5df76b85ac718b3ceccc4cfb81c9e2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468729, "uuid": "d2b9faad-6d29-4cb8-aa01-af8e9d89f16c", "comment": "Malware payload (AgentTesla)", "value": "e843ecf56f6ed3d0e349dc61895d04c324b61b912df02baf31ca1a75dbdb7773", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468729, "uuid": "9d009842-4785-4a9d-89fd-c11fb7a0cbd4", "comment": "Malware payload (AgentTesla)", "value": "0815f2708bdcc0aa347c50ea379160330e4645f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648468729, "uuid": "a03e2cbe-c031-453b-ba15-c821e23d2e24", "comment": "Malware payload (AgentTesla)", "value": "8a60ba4bbdb73d725b158fa54a5bb1e75062696b8b73b0dc705bb217bdbcd66ae7d2d87b54b4311f73b942dc842bb2e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468729, "uuid": "ba8bf2f3-6bd8-4285-9b3d-7eb9f9a4bc75", "value": "T1DC759D096A84896CE69E4F75FBF805491B72B4838762B34C730DE2BD5B6B345D103BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468729, "uuid": "c2c445db-7002-4d5b-8b4b-da50c70403d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468729, "uuid": "c78af1da-64eb-4319-a519-fd9cdcc828ae", "value": "24576:oglnHG4RXoPGdDfUoaIw5F3ERE6/nZ3If2C8l1BN:ounm1GFXa1FsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648468729, "uuid": "a9325dca-623d-427e-9aa3-109df4e70e58", "value": 1689600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648468729, "uuid": "4060339f-2c60-4824-abf9-893bfb0804a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648468729, "uuid": "4f38d604-9107-43df-b4eb-7884949c838a", "value": "Zahlung_28032022,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce915fa-aec8-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1648493558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648493558, "uuid": "53bb1215-81c7-4c30-920b-d9de94ce7686", "comment": "Malware payload (NanoCore)", "value": "69b411d5497a6173d58932fd893fcde8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648493558, "uuid": "70fb423f-486b-4c7e-ab71-9f16323be98b", "comment": "Malware payload (NanoCore)", "value": "e843f3f671939debffce62cfab30f151ef3b005d857bb4612f2122fa951afafb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648493558, "uuid": "aa5237b3-bf24-4a23-aa00-ae946853b92c", "comment": "Malware payload (NanoCore)", "value": "c8e4f9f21427ebf4a9f44d539d3dd76a16df40f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648493558, "uuid": "1d4b1755-a2e5-48d7-8de0-31c2985b07ac", "comment": "Malware payload (NanoCore)", "value": "310fb0aea69880d9ee8cafbb5ef54985c1d96179b9c399b87484054b4597e47c94e314e28b6ee67145be0c6f51c7168f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648493558, "uuid": "452c131a-fe40-41ec-9f82-fd55cdc50827", "value": "T191F47CAD322075DFC867CA72CE681D68EF907877830FA217905715ACA96C99BCF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648493558, "uuid": "88897a2a-b8b5-4e30-a243-42881e766a0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648493558, "uuid": "29ebde44-526f-4df0-bafd-4514882dfb48", "value": "12288:Bwevg1A/YJEEEEEEEEEEEEEEEEEholUI8s03NrK3tfapuBBH50r1GxlOByiWCuF2:Zvg1A/yEEEEEEEEEEEEEEEEEO2U09rK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648493558, "uuid": "98a684fb-7297-4ba1-a1d4-ef23c86c8531", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648493558, "uuid": "5fc8dd6c-2e1f-4fa0-8e06-e3255ca778b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648493558, "uuid": "df3edb84-4043-4bf7-a695-57257458b912", "value": "69b411d5497a6173d58932fd893fcde8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b200951b-ae67-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1648452093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452093, "uuid": "25b0072a-8353-4374-9eb7-eb417b431ef4", "comment": "Malware payload (SnakeKeylogger)", "value": "ff278e25a17e1470bfbec635797ec8ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452093, "uuid": "72f33665-3a66-483d-987a-fb7d1db7e079", "comment": "Malware payload (SnakeKeylogger)", "value": "e8dea312a09b6c4d62912126a38778be06eab9e5bc9d33cd3af7ee8938ddbe8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452093, "uuid": "0a80a230-29b4-47a1-b4d7-ade9af7898ff", "comment": "Malware payload (SnakeKeylogger)", "value": "f1e9b0036722bd5a0c69a16d1a414db4bfe9a02d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452093, "uuid": "5ed4f6e5-06ea-44ef-af12-4fc793327d30", "comment": "Malware payload (SnakeKeylogger)", "value": "03d72dff5733fbb64fa101c709e04742534e34afc2efa132306b818aa2ccb1de3741441c730cda50179bec896aa97d1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452093, "uuid": "51cbbfac-f835-4007-9e02-9be87985e1c3", "value": "T177556B99325071DEC467C972CDA81CECAA207C665F1FC207A053329E9A7DA97CF146B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452093, "uuid": "9406ee01-cab9-4319-bcbb-ad476308a710", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452093, "uuid": "28a0aa67-3e09-4334-b30c-98099955b4cc", "value": "24576:KL3WwaVhH+JZiSnbu1Av13ryMR9dF0iHnTG+:UHyhebiSnbu1AvFyMR9BHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452093, "uuid": "3e9011bc-6c72-4aad-995a-06e2960a1cd1", "value": 1346048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452093, "uuid": "1c1f4907-7155-492e-88b6-8f3ba2f6ee94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452093, "uuid": "0396d8e4-bbd6-48aa-b8fd-b9caf43b6160", "value": "Official Purchase Order No. 29823-222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba1bb08-aece-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648496132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496132, "uuid": "d154de43-e53b-42a0-826f-5b85fcc63f45", "comment": "Malware payload", "value": "4f187bae905b8749b53559266f0ef26b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496132, "uuid": "e48028ec-9b12-440b-9387-83b73d6e3cf4", "comment": "Malware payload", "value": "e91f6073dd124d2cdb193022e9c48ee468ec33f8fd1df6b1dedd4f3f58045400", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496132, "uuid": "f944b673-2676-49ec-a719-87a3e1f6f0df", "comment": "Malware payload", "value": "048fe0591126f08ba09ed10bb919fddde006e8b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648496132, "uuid": "f63bd7b3-6e7d-4397-864b-f77be3dd5512", "comment": "Malware payload", "value": "33798be3b3cbc1b80739641498e551c96fb38d56816dd333ad1bc3c7c36b51a83109415ce466fc881fb25c7e4a0786b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496132, "uuid": "f5e3ef37-5bc9-493e-93d7-59a1ccc0f630", "value": "T1E9D4239DBF1572C7F8C68A712320CEFBF6967B7D411617072BD8A862CD93A1035E8606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496132, "uuid": "e611e7de-2b5b-45ef-8132-f7b2e0893020", "value": "c165aab789e113ec6a3b8d99a6c3924c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496132, "uuid": "f1205836-ebe4-4604-b4e4-937a1efac1ef", "value": "12288:FreZZZezJIdQbi38tnlKb+bThX++QXARJ4uecgeOoXvuZrNyGfY+NR1iw:qZZezcQOCwb+VAwRJLeTFu2RMSY+NDiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648496132, "uuid": "9e3d8999-f430-4801-9b39-2b8ce4e572fd", "value": 607592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648496132, "uuid": "6c69b4e4-87fe-4bd4-af31-64800429a447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648496132, "uuid": "28a794ce-1b31-4e8b-be59-5f4f429a1cc3", "value": "data64_2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9793627e-ae95-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1648471805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471805, "uuid": "544a630d-21ad-4939-ab7f-b2efd597df8f", "comment": "Malware payload (Mirai)", "value": "672415f684ebdaa62f5f08cf4e7b5821", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471805, "uuid": "30025aea-eff1-4c45-b871-95169fe4dfb4", "comment": "Malware payload (Mirai)", "value": "e929436fdb7891f313cc6bf642b4fe7c4c248d4774f0b3e7e3956ab9fa3dfcbe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471805, "uuid": "4a45eb2f-0cba-4a5e-8340-69b74e8df86c", "comment": "Malware payload (Mirai)", "value": "5581dea0b1cfaffca32f8858feac6708d372a779", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648471805, "uuid": "b8870ffd-f8ff-4ad5-80bb-f93f44c01b1b", "comment": "Malware payload (Mirai)", "value": "9131ce6d5f6a199b8b32d17ab8ffc72b22d3f8cc550a8375631e9109075c3e78c0f516a9d0baca94f07d0ce7b1b73549", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471805, "uuid": "f7424a60-7d57-4487-9ae2-fe0226f17467", "value": "T1EF733982BC40E626CBC11677FE5F018E371597D9E1EA33039C295F607A8F85B0D6B64A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471805, "uuid": "a8e10165-dfaf-4268-aa56-01da0619c67a", "value": "1536:tns8E00MoWD4cK82sfeZtsdjcORv54ps3nb0xvD:ts8E0v8mtfwnOV5X3CD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648471805, "uuid": "f51d61c7-062c-4754-bb4c-20760d4a6dfa", "value": 80200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648471805, "uuid": "f409376e-a064-416e-bc20-7d4b07d6afca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648471805, "uuid": "a09aafc9-e934-4e3f-934e-c075d86c2837", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a864822c-ae65-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648451218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648451218, "uuid": "89297d78-7bfd-4965-8dec-d20927f17612", "comment": "Malware payload (Heodo)", "value": "fb16dea6228f0c71897550695b6aee06", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648451218, "uuid": "603504d0-8fbe-4428-ab72-54e9fa5bbe26", "comment": "Malware payload (Heodo)", "value": "e95a2fc2a8e2771b1c8a210518f959ba6dcc60649be205890600ac131074b0cf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648451218, "uuid": "893f2eef-806f-4d01-8c9a-ded6be3bb70d", "comment": "Malware payload (Heodo)", "value": "decf74282dc61bede4c24c42cf5887e5d36c56ea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648451218, "uuid": "c26f86c9-da00-4b64-af81-833471febc29", "comment": "Malware payload (Heodo)", "value": "ccb907e73c01ea46fcceb20ca4af8d205ae825ef396a92823940041983b277310bc807e72122cae75853f59c9fa0dde8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648451218, "uuid": "0318c322-7559-4381-8166-834475c650e5", "value": "T11FE49E1177D0C072C2BF3630551AA3B566EABC708DB9860B6FD42A7E2E745829D3871F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648451218, "uuid": "4f436807-4ac9-496f-bafd-3bd956e42740", "value": "923a5ec702466ffd61b422bacc94c6f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648451218, "uuid": "65bc6c0e-ca0b-4edf-aeac-e1629f8b5967", "value": "12288:JSycC8Tu2EEAeClIHRFa7UdUzrAKYtI8X0oXYl2N17OP:JSDD7RDhH3dUfUtj0oXYl+OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648451218, "uuid": "7351b062-9975-4792-ae28-1d71c92b9dc3", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648451218, "uuid": "05b864ef-41cd-4b99-af00-37329e64052a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648451218, "uuid": "74694e97-ad76-43a0-8152-a3bb968cc9e1", "value": "Z0QUrwHcHBh0iu65VNKFKM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e832b719-ae83-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648464210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464210, "uuid": "6e54243a-66b8-49dd-bfb2-6c51f03b769e", "comment": "Malware payload (AgentTesla)", "value": "5de3d1a17c3123c4010259364bfa4cb1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464210, "uuid": "00e38121-94af-4975-822b-7a38583c29cf", "comment": "Malware payload (AgentTesla)", "value": "e9acdb2053eb093c6fe36253f8f0012975cfda80ccafe090113681633da64097", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464210, "uuid": "698ff884-69e0-40de-9159-5de29dce30a3", "comment": "Malware payload (AgentTesla)", "value": "9ff568e25a7e307a701c2fff0d1b51ef54d5e557", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648464210, "uuid": "95cf2a6f-c825-463b-9758-7f893342298d", "comment": "Malware payload (AgentTesla)", "value": "8d34a97c6e3d94ae674a479492cd3498dc1201e099ee4fc89a3e83d48d58c8e6cb243ec6dc0d0256d1f72c7eda9498b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464210, "uuid": "ef28e5b5-99f6-48f2-9a38-ec5e5ff476a5", "value": "T1C9B4E059BA85D822F40048F1E9F2A9CE94713FB49FC59AA2B3AC7E3B1734541852D31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464210, "uuid": "5ea6ec93-0b6e-41ae-80cb-d7fc67e8536d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464210, "uuid": "11fc5a97-0cfc-4ff6-97b1-200a10eeb4d6", "value": "6144:jGiIPzwXAMeMbrtAUGoYmhtBpwYTxf7Mv0azIDM4c2ZKLIwkqJ6Ns0u5:oswrShAUGPcEYNf7MMaaM7LIw+E5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648464210, "uuid": "1774dd0b-2a60-46ca-a169-c5f93eec2422", "value": 507109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648464210, "uuid": "95d91f9a-c6ae-4556-9730-ca4465ffa728", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648464210, "uuid": "77337ae5-8dfc-454e-9672-1c2a47b095c1", "value": "SMH Erforderliche Spezifikation 43664.pdf(78KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1fd7816-ae6c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1648454240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454240, "uuid": "edb358e8-5f60-4f01-80a2-f3e94a2e7057", "comment": "Malware payload (Loki)", "value": "136dd716d8e2c040f7401959d9c7c4bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454240, "uuid": "f1d240c2-e9a1-45e4-b976-98a2becb7956", "comment": "Malware payload (Loki)", "value": "e9b08e534023f8927c1a201f98461bda56b4bf29231daff0668775a069b28ff0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454240, "uuid": "6a4d6f10-d2de-4524-b6fb-0189bf01e981", "comment": "Malware payload (Loki)", "value": "3145cca32e22f89432fb1c583e2cdefcd1af8f9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454240, "uuid": "cd111e84-748d-4dcb-8624-daea755793b6", "comment": "Malware payload (Loki)", "value": "ac67ecaf78a9176b3f100de2f1a552d97f32da66e0f48ba946395913e734f0b5bdf600b16e91b1998337e87a13edf8ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454240, "uuid": "52dc0e7a-5bdd-468c-9f6b-d93f7d880da3", "value": "T14C34128AD4E54EFBE18319B62AF0FE71D3BBC94512D2551323F12FBD19124A7C8185A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454240, "uuid": "714a19cc-e37b-4241-bc58-55b50cdc4f39", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454240, "uuid": "508bd1e8-6516-439d-b7c0-b73f46d4fc8b", "value": "6144:rGiiXkxX+av8swRwRbnVa0Uz0AMlwW6juMc+YMTqiKmg:eXArjwRwRj80A0wljKmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648454240, "uuid": "618d3eaa-5ef5-40af-9547-df29e570505a", "value": 244710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648454240, "uuid": "359ed459-c515-4053-a927-c5ea4946d5b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454240, "uuid": "0f1e3bef-c072-4562-9763-235628fe518d", "value": "136dd716d8e2c040f7401959d9c7c4bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1312ee28-aea5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648478455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648478455, "uuid": "952976aa-b56d-49e9-8fa4-f7dc95c2ec89", "comment": "Malware payload (Heodo)", "value": "799aa0b5bd066140710c97f30646bdb6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648478455, "uuid": "42008853-08d8-4e6a-a0a3-ad935907d4dd", "comment": "Malware payload (Heodo)", "value": "ea1acb318ca08a868a14ca037ba8d268e8f8615a86338152f373a11c8137950d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648478455, "uuid": "d0d77981-5cd8-404f-b08a-4da147657759", "comment": "Malware payload (Heodo)", "value": "202d8161b598953d0d3aac1efd27ca73b99c6850", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648478455, "uuid": "79208ab5-3574-4f02-ad94-0b2d1262510f", "comment": "Malware payload (Heodo)", "value": "a47569e9e0438cfa5650546987efc6f3f4444049023ccb6b9773152a3e2cadafc7063c3d9ab826e98c01613e4d6be310", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648478455, "uuid": "10fec3c2-c274-4759-b941-a0351bfc6683", "value": "T18264877D0FAE00A2CC621770146C0FD991ABCA25BB1255FF24992E2E2EB57D74879F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648478455, "uuid": "3f1b7b82-839b-42ec-908f-6c1e0dd8964d", "value": "3072:rA5pcWyfJCALTQMLOuw80g4SY0sjHyKilP:iKfJCALkjp1g4SbsLyKilP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648478455, "uuid": "6a0e1afd-73b2-46f5-b938-a727a3c5983b", "value": 327176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648478455, "uuid": "4b7a68cc-aeeb-497e-ad0b-c5fed621051e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648478455, "uuid": "add948e7-b077-49eb-b9dd-eb4ffd26fb91", "value": "emotet_exe_e5_ea1acb318ca08a868a14ca037ba8d268e8f8615a86338152f373a11c8137950d_2022-03-28__144049.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d44abd-ae5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448455, "uuid": "88adb435-86ca-4c4b-858e-4c01152cc3cf", "comment": "Malware payload (Stop)", "value": "99ef95eaebd836648327a4a6fe927ea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448455, "uuid": "fce3725f-85f0-4470-af7d-d27db88d752a", "comment": "Malware payload (Stop)", "value": "ea7188d459b48987f6cd7e3f23b420024748168812a084c60a8be5407344894a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448455, "uuid": "90abdb7e-2ecc-41da-9954-c26103c60ab6", "comment": "Malware payload (Stop)", "value": "646550a9d3a3d6e1cd7d6db64d6ec2ad985a1ffc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448455, "uuid": "1a0efb9b-f051-4e5b-b22e-8e0de2f18fb4", "comment": "Malware payload (Stop)", "value": "a3c3615512226158363e62f107ce724818908db46314abe7de4e3475df55e9fc343f42b9322e8e0b99a61614c78cf5bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448455, "uuid": "8148b861-fb4e-478d-911c-f157f0f26a88", "value": "T1B90522223A91C472D36642711951C674AB6FF8311D23598B3F8C5ABD3F356E29FB830A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448455, "uuid": "cb597748-9a9b-4782-8fd4-b432dd374b5b", "value": "159dcaa804632f606b007a362cfb6cc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448455, "uuid": "299afc3a-4d15-48aa-acf8-fb5079f57dbc", "value": "12288:BZd/mY+IhDXySDsC/If/pxWnPdzUOX18b01EcdAR:HoY+KiA1/In+PpLYmCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448455, "uuid": "e6d26c93-9143-45ff-b5a4-56a202863882", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448455, "uuid": "6bed582b-18a0-45af-b50c-b2c96bd4de7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448455, "uuid": "2008dcb2-7661-4c8a-a342-4011f0311aa0", "value": "ea7188d459b48987f6cd7e3f23b420024748168812a084c60a8be5407344894a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413e75cd-ae5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448468, "uuid": "0e27516f-49f5-4615-9641-b7aa90442406", "comment": "Malware payload (Stop)", "value": "0c993cd647606984dc914ed1d4aafeb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448468, "uuid": "5ac39242-402a-4951-89a1-f86d81584bfa", "comment": "Malware payload (Stop)", "value": "eaba36cd0b2f1d466f2dd6c5cfe99e169b48e830cc6a3e048fd7c97158ea834d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448468, "uuid": "1da047ee-a10d-4e99-b5ad-d51818996f08", "comment": "Malware payload (Stop)", "value": "9c1e584eec85c211812541a04308ede290cdc9e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448468, "uuid": "b1c6514b-6482-45ec-ae41-1941bce1f133", "comment": "Malware payload (Stop)", "value": "60471b6bc4bb7490214d1660b0d4968ae6594bb560260c54cfe27a194a4fe14d745e5726f24b6b3789d07025f0a12e00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448468, "uuid": "1934090a-b487-447e-895e-9ec8a8e21fce", "value": "T1D0F4230435D0AC71C8A622B050BD9FB0DAFAF476F621498B39B805DD5B30BD3B6B6716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448468, "uuid": "ab79af43-f9f9-46c9-9fc0-087cd7dbaea4", "value": "2bdd43acf181bf5b35cc83a05996f85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448468, "uuid": "9a8d2a4f-9518-4f93-b687-7110ded7d41e", "value": "12288:FI3WYL3i7oXBGVOo5zOI5OgA8i6VanGlOsE4yLpHA0AGucv824:FWWYu7oRGVOoA976EGlXE4ypg0AGHp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448468, "uuid": "85bfb392-ccfb-46d8-a20d-33bfb98c2675", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448468, "uuid": "a31fbf7f-4a87-40fa-8d62-1b25480301f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448468, "uuid": "9d90f2b3-0b2a-46ac-ba3a-cfbb1a5a9796", "value": "eaba36cd0b2f1d466f2dd6c5cfe99e169b48e830cc6a3e048fd7c97158ea834d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463eb204-ae5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448476, "uuid": "094f8a9f-6e9d-4dde-a050-40e75d5c0b60", "comment": "Malware payload (Stop)", "value": "a8418a98a4527c08f932172c71baed12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448476, "uuid": "fc521a98-c7d2-437d-9048-7bae76e4107f", "comment": "Malware payload (Stop)", "value": "eb3ab00a77c29d2846eebbb87f1837a48974d865e2d3bd0297c41c6cf118c741", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448476, "uuid": "ffe8fba8-ab74-4307-b9ab-875ad0b49627", "comment": "Malware payload (Stop)", "value": "224a8935c249f89b86092774fdc32d0bb6ecce64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448476, "uuid": "6188047b-6d46-4080-893a-049cb470a864", "comment": "Malware payload (Stop)", "value": "4749e0e134b89e6cf9bbcc7dcc8ba78f26b24db39dcd2b97e44901bc334a72baf03afbd3eae98cf86aa29511e5051933", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448476, "uuid": "3c1ccb6b-26da-40e7-997a-16a4d3cbd630", "value": "T13FF4230169E3C831FA3602B5053297A3A13EF9260B93BD0771C795766AB33C35BF215A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448476, "uuid": "44763095-4196-4b92-a53b-f846029613dc", "value": "98af1336ee9a8378f1e2c2d0d9027760", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448476, "uuid": "30e3ba30-177e-4b03-8a85-eb5e4cabd1f3", "value": "12288:tfIXUjqVB9WDjVeE8BFFTcgkr2Rf5XhQ4Te7JKh9avF2Q9MlqI:tQhBKjkE8rF4gCKdhQ4q09avEQ2qI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448476, "uuid": "35a01d46-7f37-4d65-8ba9-41661d70914f", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448476, "uuid": "f3bec640-68bc-44fb-a01d-4729409ab49a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448476, "uuid": "c6539009-c9a8-4359-a0b4-f64501044bd4", "value": "eb3ab00a77c29d2846eebbb87f1837a48974d865e2d3bd0297c41c6cf118c741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7892d3-ae92-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648470340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648470340, "uuid": "05aca07d-3e6c-4f79-ac02-b7b354379b73", "comment": "Malware payload (Heodo)", "value": "a8a4216f54de4419bfa037130d58c299", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648470340, "uuid": "2676144a-8b13-4fc2-a180-f7d529d76380", "comment": "Malware payload (Heodo)", "value": "eb9746220bd218bc54b37f4acd58331a9b34b9ade2fdb880574973b6d075e4e2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648470340, "uuid": "b5ba2dd3-65cf-419a-b48f-04430630bbfa", "comment": "Malware payload (Heodo)", "value": "66f30cdcf276725cd1b2d833e0245956e08e6c6c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648470340, "uuid": "6663bf51-d070-402a-be2b-60ce62a81333", "comment": "Malware payload (Heodo)", "value": "066b25dbfafc187a44a4e2979297620723b86419e0aa74c361b64dc5518de7aa3dd858fdb30d956bdbe054bc8f73fe16", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648470340, "uuid": "99cddf05-ac45-450a-8fb4-2acf9785c092", "value": "T1D2F4D01173D2C07BC1AE02782512B76867FDBE50DEE18293BFC06BCE5A355918B29B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648470340, "uuid": "851f6218-9f30-4653-82d6-57249626de91", "value": "36d18f8cb3bee16af0421e6a936157a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648470340, "uuid": "4ff337d8-ceb2-47bf-98d8-f579a8af3821", "value": "12288:luZ01lbelr11DkMG0rfFb/pn5iLEEgTyfEP49fepUDlBYawsoei4:69lr1Vkj0h/KLhnYpUD77oei4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648470340, "uuid": "9e6f6aaf-0b73-433e-8a42-f9bc2becbcff", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648470340, "uuid": "1d2453a4-5dda-4202-b7e1-c9a4af5f6ddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648470340, "uuid": "3d12d702-1c58-4907-9c89-685ea8d786bf", "value": "emotet_exe_e5_37e80b27fdcb17bd32139860bb05ffceb98e955063c71faa68b4135bad9390d2_2022-03-28__122531.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564eefb0-ae7d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Guildma)", "timestamp": 1648461388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461388, "uuid": "f44d0d14-a85b-4831-8689-81f0990aba76", "comment": "Malware payload (Guildma)", "value": "c85153d77d705b191fbee22e7397250e", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461388, "uuid": "12de98f5-21e7-4f02-adf5-da86ecd8a63b", "comment": "Malware payload (Guildma)", "value": "ebb8ae08dd5f3ed40356128ab16a9ae78594ee7b805141cc43c43c568afb951b", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461388, "uuid": "1aae6c8e-c264-41f9-89d1-66e5e5ee7caf", "comment": "Malware payload (Guildma)", "value": "b5cf5e6c1835af41d86060460cad78c6ebab0724", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461388, "uuid": "b21672d0-fd5d-458a-8a3c-898f0156995b", "comment": "Malware payload (Guildma)", "value": "8b95820169994df0b7665008b90218d559bce67c9b48b313f4c4a0caafd609b9b6cc758d335dad00aa753a3b07a34faf", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461388, "uuid": "56658be8-874e-413a-ad72-e555c15a558f", "value": "T1F7F0237441062AE4CCF31674C8BBCA808F1A703C473B8020E3A6949A31E7945EE0ED9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461388, "uuid": "2a651031-a0a5-46be-90df-ee71be1f60d8", "value": "12:8rfl3OB+9LyWHPchUfl5YTQRt7T3vE2APnqn7ZHFCKsQJ/:8H9LZH0hYlR7TMpqnBFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648461388, "uuid": "dbeb267e-1a20-4486-9e95-8a90fc4717a1", "value": 527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648461388, "uuid": "ba32e706-f80a-45ce-af64-2156d29d4fa5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461388, "uuid": "2ab90ddf-9e82-4ac3-a63e-14464b1b84dc", "value": "c85153d77d705b191fbee22e7397250e.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6391578f-aed9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648500924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500924, "uuid": "7e9da3be-64ae-4cfb-a50d-18443d6dc0da", "comment": "Malware payload (Heodo)", "value": "38d2ed9d8799d6ef1724afcc813ebc52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500924, "uuid": "967ba812-dbfb-4038-9512-98e3e069ab90", "comment": "Malware payload (Heodo)", "value": "ebca57638b729433cbe932f661eb16720684589c78e92961f70288a9eb349708", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500924, "uuid": "ea989d43-82eb-4332-ab9a-ea1f97eaec0f", "comment": "Malware payload (Heodo)", "value": "2fefa0b6ba962bc3efe5845556340308783f395d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648500924, "uuid": "ec75a385-a249-4386-a282-50ba9a01bf0b", "comment": "Malware payload (Heodo)", "value": "c037d219d3981904e2edf8e8b663dc0b87c8c32afbf18340089aec9720d7845af26ad18a69cf3dbe399bfdb4810849b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500924, "uuid": "54d626c2-2893-4e3c-b6ed-25d067d57ebb", "value": "T1B3E48D1276E2C07AE16E12349D16939A36E8BDA04A784177AFD93F7FCD302514DB432E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500924, "uuid": "851976c4-f9ad-47af-88ae-8a6f6832d935", "value": "ec3f01778b895fc65e0f7631cf3a5e17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500924, "uuid": "5569e9ba-7991-4e99-8555-74c52d8b268b", "value": "12288:pWL+xbWhXWjdo9GeetVDn11EtAbrf5z/Kv7LvK5RUY+K4+mHWDn/nChiSw7dmDrc:pWL+xbqOdaGeetBEwf5zBCMV0rdAMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648500924, "uuid": "694906fe-e75d-4a41-bfdd-4387b46838dd", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648500924, "uuid": "a96c01d0-ab90-48c9-a37f-577e1cb88686", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648500924, "uuid": "f81dd320-99ca-4972-9bc8-60f5bdbc85eb", "value": "38d2ed9d8799d6ef1724afcc813ebc52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56115d3d-ae6f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1648455375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455375, "uuid": "e98840ec-4502-42bf-beac-7d0b14c83074", "comment": "Malware payload (Smoke Loader)", "value": "304113c3b6c298a62b39809361cf79b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455375, "uuid": "284d4130-de9f-4e4f-baab-605e348794c1", "comment": "Malware payload (Smoke Loader)", "value": "ebf3a044246492128aa29dad0c4802f374fe32efb8179da5b9f284dc7e3579a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455375, "uuid": "86f98d52-47e3-4e01-95df-ef12cad7a0cb", "comment": "Malware payload (Smoke Loader)", "value": "1a9ac9a8a513bb799d443441a5d3ebfc411dbdd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455375, "uuid": "1ca5b9f1-3eaa-48cc-8a5b-7a0f8ee11d2e", "comment": "Malware payload (Smoke Loader)", "value": "d87b2de037f7434d0d01936e43245c6bb2e743b47c66b9fee7575c96248d63c943f4dd61db132417352720744792e772", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455375, "uuid": "2191a862-b007-4611-940b-3222d5975feb", "value": "T1BA54CE123A91C833E92352B56812EBB49ABBB83119655ACB3FD4062D9F313D3DF71346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455375, "uuid": "875a33f4-a583-4d88-95c2-164b78800a16", "value": "cd8ed96dcf990359020da5c59a04eafe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455375, "uuid": "9f5cc32d-e059-452a-9dd9-36702dc53619", "value": "3072:eVEF7olZxLacy3V6kHXGCjHqC/jwumYRYjrb2l:4oWjawkH2CDDwSYju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648455375, "uuid": "ccfd58df-a267-4938-b05f-43620a80b62d", "value": 279040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648455375, "uuid": "40d5c219-78c7-4cb6-9bd4-12fb8f8ab395", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455375, "uuid": "5f451ea4-fd86-441d-9b43-eff0eb928943", "value": "304113c3b6c298a62b39809361cf79b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb8e386-ae73-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648457134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457134, "uuid": "5a83859d-fa0b-47ce-99d8-1753f2d1f600", "comment": "Malware payload (RedLineStealer)", "value": "a9dd8b265393fa06ae5841cb38421101", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457134, "uuid": "973fe1b2-444a-4bb4-9adc-2241dbfc759d", "comment": "Malware payload (RedLineStealer)", "value": "ebfe121f28f0cde253640238d03009c79d392a6bf5adfdb9aff509787505f88d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457134, "uuid": "29008be7-2d00-4bbd-92ad-b373682a2eda", "comment": "Malware payload (RedLineStealer)", "value": "e76d6136b813c665f051c859924a53a2a7f9f8f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457134, "uuid": "13471a19-f4ba-40a1-a0f7-54a2aecd8b33", "comment": "Malware payload (RedLineStealer)", "value": "2f38f0083c4810f519204c90b5f809c9cb6c61bbac5ffb859692cb54b8ec56ed708f3f0d9aa907a58b0f6f847cab0d36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457134, "uuid": "48082044-80be-461f-91c3-fcddfb5c9f41", "value": "T1E59633313BD0D0BBEE213834DE40BF6879F4D35C4A15626F1B90D5DBAABC9A5200E6D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457134, "uuid": "ecef798f-78b2-4a27-a85e-010b495e8491", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457134, "uuid": "21f3c86a-d58e-4344-826b-ff16bb1e5f25", "value": "196608:x90cRX8ae5PdabSo9/BUAZQtVKq3f8pJ6wlmsoOrj2hoatIja:xacRXteXauc/OigKgfoJ6TwSWHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648457134, "uuid": "bb9997fb-7382-4a05-826f-d29dd9447e8a", "value": 9425120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648457134, "uuid": "b22e3369-7064-4966-8c95-fff3d6bb7d1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457134, "uuid": "e4a8f773-5137-49cf-a05a-8aa3e553b12a", "value": "a9dd8b265393fa06ae5841cb38421101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247a7f51-ae7b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648460445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460445, "uuid": "55965b2d-f8cd-48a6-8780-fe9a9cf7fee7", "comment": "Malware payload (Heodo)", "value": "a02b3f77662af07c9c626f34bc9085e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460445, "uuid": "99718064-e4c8-4906-9e93-a75b3faf5fde", "comment": "Malware payload (Heodo)", "value": "ec1a24d96f459d45452ba8c106b6b3e4dae2d057f9b6f29c4ad806905b217cf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460445, "uuid": "7f34f1de-8c9c-4e56-b64f-3399a540dbd1", "comment": "Malware payload (Heodo)", "value": "5dca669bfb622daf2c9599d253fe2d981cb870a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460445, "uuid": "0d3e45e9-694a-474f-9cd6-cca8ddc7edfd", "comment": "Malware payload (Heodo)", "value": "7d281ed2ba65b8f7af16cb1eab4de4711f302fd5c5dd346295daf90c925d8d162f09706adefdaa076f5dd229f4eed48c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460445, "uuid": "138170d8-e2a1-4d57-baa2-bfb567d06770", "value": "T17794CF0272D0C47AC6EF23785D239B5AA7F9FC208A75C647A751BF8D5E326C1893035A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460445, "uuid": "5fe5d388-b84d-4964-9771-382fadbea97f", "value": "8f8b1cb86c6697dd342b65a36c6ccbb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460445, "uuid": "b9788302-b357-4eaa-b6e5-bcf77456f8e7", "value": "12288:zwn2hR3547jpDMgyS7xpuCMS5AhugWarPU:DRJ47xjyQpuCMSqumrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648460445, "uuid": "f52d06a5-4b94-4a7a-91e6-50bdaab83153", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648460445, "uuid": "76a8ad7e-8cf4-46b2-83e6-c82bbf999970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460445, "uuid": "5ef50183-e571-44b8-9158-155526fa312e", "value": "a02b3f77662af07c9c626f34bc9085e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ed1642-aeaa-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648480824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480824, "uuid": "35de37f9-7f2c-48e0-bd1d-5abcb2d9b763", "comment": "Malware payload (AgentTesla)", "value": "427265cb23fb0976ab21390fffcada09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480824, "uuid": "16dd1675-95d1-4272-92b8-d0b256cd8ba3", "comment": "Malware payload (AgentTesla)", "value": "ec23c0eeb9eafee88c0e64673405080bf9e4fa792560f2b7342f7be4f45cb47f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480824, "uuid": "8d25a8e0-77eb-4fdc-a824-9c5220130a54", "comment": "Malware payload (AgentTesla)", "value": "d6182002ed89aff8a7a7254767ebf188afc9e261", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648480824, "uuid": "6f9bc5a7-232b-4bcd-aa85-84f491f7e45d", "comment": "Malware payload (AgentTesla)", "value": "7aaef778b21d47fad685499d000cb49616f59cc2acd5de92116c064e90563e9aea6f1a8ad947031294018c390454e1ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480824, "uuid": "b2d042cc-3550-4b6c-9a1f-c2548cb355e2", "value": "T17683D081AF988859FA2F037201074F404374DD3B7A67A67FAAA9B04559F338605F6F36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480824, "uuid": "e532d678-3d07-40b2-8fb0-67d3ac7ec8b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480824, "uuid": "eb6a63e9-542c-4ecf-ba9d-2c700fd0b087", "value": "1536:6L+nwQyeb5ozxdGVzZhq3bC2aTEW1MDEFSAY1JjAxqydqSz0tO702OI8fXW:rnLyUWddeI63MD/AY1Jjwqy/kX258e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648480824, "uuid": "b7dda8dc-1ea2-458d-97f9-927c48b49a87", "value": 83456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648480824, "uuid": "3ec9b484-b5fc-47d3-8952-eae79c23c8ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648480824, "uuid": "98321e23-75fc-41da-ab36-9d8515956dd7", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6cf7826-aec1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648490836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490836, "uuid": "87c12c43-25de-413f-b231-8c6a1c6302a8", "comment": "Malware payload", "value": "bbfac3608c1e384d6853c36ab6260d1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490836, "uuid": "05a022f0-e1bf-448c-bc06-e7aca08a05cc", "comment": "Malware payload", "value": "ec974ca6242aa652bd3072ee8bac2d1e20d538835fe98ecf67b45289c4a5c168", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490836, "uuid": "9fd62c4a-4c35-401c-a8e6-b1fdb412ef76", "comment": "Malware payload", "value": "e3cb3f9261cfaf9ad6a8add8bf428a76575f3f1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648490836, "uuid": "5e16e424-a75f-48d9-9cdd-ea4e341a0ac7", "comment": "Malware payload", "value": "87beee493883ba3a6645ec1c2a81a5410b2924bab09e1649be82576652ab5e684b699ed42dc5da0e9539d2c1474c3ff4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490836, "uuid": "4be6b25e-e4cd-4a0b-96f0-e3778c791412", "value": "T104F48D107AE48217E77B5A319AF036469B7BAD637723632624C037592D377A1CC0D2FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490836, "uuid": "b601923e-e787-4b7f-b876-64e5d756503b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490836, "uuid": "13ec0577-86a4-4e24-88b2-b6c4c25a09f5", "value": "12288:5ZyXsrr7dxtvD7qx6p9buL+sfxaVubZV3gNlrETqgWlDYabypUXz4:ZDtSOqCKQNSqHNyp+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648490836, "uuid": "213ef652-0b7e-4cf4-9db3-d98abde82897", "value": 788176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648490836, "uuid": "dd8ccde9-8baf-4b3a-83c7-7725535b5553", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648490836, "uuid": "7906917e-a142-4edf-bb50-90a5b92d9011", "value": "MV LUCHOW(Q88)VOYAGE DETAILS.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d8bb3f-ae81-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1648463243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463243, "uuid": "16228222-76c1-4086-9a13-3a0dddc4096a", "comment": "Malware payload (Heodo)", "value": "bf8177d1cb5e4860cbde549ef512227f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463243, "uuid": "616eacdb-635a-42f0-b116-339575e30cd3", "comment": "Malware payload (Heodo)", "value": "ecd3df79fb10d177bca04fdb669b3531128b55c855e78aa934a2945e25ca4c07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463243, "uuid": "fa1c8614-6332-4f33-9679-e1e4b1b64afc", "comment": "Malware payload (Heodo)", "value": "9c36317ef0c6b0a56ce8aac74350ae0c79f78fc3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648463243, "uuid": "64091b70-1ed7-47fc-bb72-0f5e8c4107c5", "comment": "Malware payload (Heodo)", "value": "a07d1fb9f3557eb21493754bfc80d843583db7896f019554a2b868a0105e5e8e270201505b1dec4a849fe1b562ebf287", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463243, "uuid": "4d1cabfe-208a-44de-b55c-2987b4f42c07", "value": "T1E594CF0272D0C47AC6EF23785D239B5AA7F9FC208A75C647A751BF8D5E326C1893035A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463243, "uuid": "274faebc-3a3c-4f50-9a58-9c2d00832385", "value": "8f8b1cb86c6697dd342b65a36c6ccbb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463243, "uuid": "1597844d-38e8-4157-9699-ab502d71a44d", "value": "12288:zwn2hR3547jpDMgySRxpuCMS5AhugWarPU:DRJ47xjympuCMSqumrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648463243, "uuid": "163d41f6-644d-4ec3-89db-544a970d0b6e", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648463243, "uuid": "767b7453-ba0c-4b23-b006-1284a205ef96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648463243, "uuid": "e9be9b21-bb71-4cfe-83e6-40321343f2fd", "value": "bf8177d1cb5e4860cbde549ef512227f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443b5369-ae7f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1648462217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648462217, "uuid": "1e79a5ea-e00b-42ce-bf1b-910c7e624515", "comment": "Malware payload (Formbook)", "value": "32d45f1bbf766220f5fd88daaa834359", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648462217, "uuid": "d18d4ae3-b218-46c9-9090-ddc3c401a22b", "comment": "Malware payload (Formbook)", "value": "ed0a30cdbd386677f07781aa1de42c12f937678130e3678b50121faa9a1101d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648462217, "uuid": "39d0d50b-6404-4054-a6db-fb56dafbe464", "comment": "Malware payload (Formbook)", "value": "05a71c5f234f00bf32382518f5d0c8e225c2eab4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648462217, "uuid": "e5173c85-133e-42de-baee-265b17a36528", "comment": "Malware payload (Formbook)", "value": "d1a4b1949be63c28ad4307b50bda48c62dfeaddd5b13c0ab3b7e91c3ee6ed83ac320b9d08576f34f1a3d6254c88709ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648462217, "uuid": "a4b82922-3caa-4eec-a332-acc0120943a4", "value": "T12A057C306F89AADAD791F279CA8938F3F5239427BE03740948067E7B7039550B997F90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648462217, "uuid": "de1ba2a2-ab65-4b1c-9f21-c97e5276912e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648462217, "uuid": "32c92986-3232-4f76-95e8-f1df65093bc4", "value": "24576:EE09RIsB9CdI6SYvuzgt6ODlyDjuvcnAo/K1cU6:YO04rZvuzgt6OIHKcnAo/K1n6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648462217, "uuid": "7a71185b-d91a-4a86-affc-160c60e143e2", "value": 853504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648462217, "uuid": "9e918298-8c42-42b0-8700-0f73242ce44e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648462217, "uuid": "286fa118-73e9-4c15-91e8-d5a81ef47dc5", "value": "$38,000_Payment_receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b3b633-aec4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648491750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491750, "uuid": "6de27693-3f28-4612-9cfc-cb9189d6e3a2", "comment": "Malware payload (AgentTesla)", "value": "57c1df4474e6cc3962b1f710c0dc2c4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491750, "uuid": "90cb7e1b-95c0-4faa-b290-3495a0583c24", "comment": "Malware payload (AgentTesla)", "value": "ee635cc5a6ce9f907bc6ebdf83021e9bc74ed6a189e9d5cb4c2056cb42297b9b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491750, "uuid": "c9a3bae8-c0ae-4624-a9ec-17043a9b75fa", "comment": "Malware payload (AgentTesla)", "value": "79343d8d33889ed848bb72350da0c677319037ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648491750, "uuid": "bfe50d37-204a-44cb-9c3b-bfb2f57457d2", "comment": "Malware payload (AgentTesla)", "value": "1d756f9e939538028c2ebbc085af8f7d88310292dd0450b7da82001eca2134214d8df1dfa700ee6b6e4367b0f7fa9e9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491750, "uuid": "9a603ba0-fe2c-401f-a68a-d4cde5cd67ef", "value": "T142C4BE32D3F82F5BE47E5379541094153BE6E786A62CCA49FDBA30AA4572BC24172F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491750, "uuid": "3660ce96-daec-4cf8-9a42-80bdd6657ae6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491750, "uuid": "86eab3f3-03b9-4f80-838d-e462ea132db5", "value": "12288:3vOW9QHhdC/gjj1K4PVho+lb9gjw3JQ6UkIcyS:/OW9QHrC/gjjfPVi+de6IW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648491750, "uuid": "8286fb3c-bf0f-44f6-9caf-00c231231112", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648491750, "uuid": "36159a41-973f-4a61-8f68-316d911c9be2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648491750, "uuid": "417907d7-6aba-4b11-97e5-8d4662e858df", "value": "COMPANY PROFILE AND PRODUCTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df6adcf-ae69-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648452730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452730, "uuid": "b63fb43d-ae71-46dd-9b87-30b583c3c397", "comment": "Malware payload", "value": "5ee0dab01501e55dde366983a5b3b55e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452730, "uuid": "12eb9ee1-b6f4-4e36-a4d3-ed45ca9cc41e", "comment": "Malware payload", "value": "ee73744c8001f280f883318dc69d5abfabc22350894b282d1d10483e9ec79117", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452730, "uuid": "a92e66e8-f038-4f55-a5e9-71be1706c239", "comment": "Malware payload", "value": "930d645d381935aebb21f6c69380dcc8c39afce4", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648452730, "uuid": "6deef0c2-1bd2-4eb8-80bb-7e67fef3b9e8", "comment": "Malware payload", "value": "12b61839b004effaba4715bb78c9615f93a1023797d6b9469282344f5bb79c8583d8d2c1e68fb31fdcc081c90f891b9b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452730, "uuid": "a79e313b-5f30-40e3-8331-3cf592e74046", "value": "T1DA165C23B284753EC46B1A3A4937A3589D3F7A7139268C5B67F4088C8F3A5417B3E647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452730, "uuid": "f1197c72-3f63-45b9-9dea-b724af003c74", "value": "49152:hr5OY7EAqZ2LqOeb0fY9BgSqLufibk7B4gW+GE+GA2Rn+Az+CT05fM:7OYwAqYqOqnR7mgWqbR+Az", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648452730, "uuid": "f8e4be86-3223-46c9-b53f-71b6af70e13f", "value": 4093952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648452730, "uuid": "5dcbb3b2-bc49-42a3-a144-075d2a55d0b4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648452730, "uuid": "2139e491-50ca-4e0a-b3d0-b728449873a5", "value": "Fact.ArchivoEndesa27032022.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3382e5ba-ae6f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648455317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455317, "uuid": "756215db-70c9-41ec-bfe3-4157b8b8af2a", "comment": "Malware payload", "value": "0e5f95405eefcc1c494c7362df537dd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455317, "uuid": "f7403a8d-136d-4b9b-9d4b-d8921b2ead17", "comment": "Malware payload", "value": "eec85cc8acd74b24238aefe7ff5ac7cbc1694e02187d76c015b515bae00a03cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455317, "uuid": "00234ec0-ff33-4cce-9e9e-eade5df082a9", "comment": "Malware payload", "value": "939fca18d99de57b9fd83335889b2ac4cb7643b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455317, "uuid": "8a1e2195-8911-485f-aab0-afae58825a02", "comment": "Malware payload", "value": "5f1141650fe92ef9434f0eb88ec1d2326fd108faf1d006d1448547b78b4e5fdacfc418f402a89f93c4aba3fdbaceef48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455317, "uuid": "7aa73005-69a1-4943-8940-f3d21eaa7ac7", "value": "T11876230277C2D031FFABE2739F26E64596787D144523962F13A82D39BE701B2127E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455317, "uuid": "23a00d32-cdd7-46c4-8075-bdb18b35dd12", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455317, "uuid": "f9449b0e-b0ef-40b0-ad4a-ff4d17e0cb42", "value": "196608:RCKTT2f1R8nqPA835dW1R9w5oKbZ1SXhUi:wCOz86AK5dWX9w5oKbZWhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648455317, "uuid": "8775efbd-83ba-49df-afe5-c09b7cf636df", "value": 7412816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648455317, "uuid": "17fad2de-3a29-4e6e-b4fb-40977474c395", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455317, "uuid": "190a91b3-d394-46ca-8560-8d64a3d86e27", "value": "0e5f95405eefcc1c494c7362df537dd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ca4023-ae73-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648457119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457119, "uuid": "80f69f6f-1db3-4ca8-8b11-34e62ca137b7", "comment": "Malware payload (AgentTesla)", "value": "146d10aeb31797f6aed1c23f39ba2803", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457119, "uuid": "005bdd5b-8df5-453a-8ff7-232ba7b20a15", "comment": "Malware payload (AgentTesla)", "value": "eed8da1f31f4e00ee7f2d9ef46b864937c1bc6d5ee501517bb8af661fafece02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457119, "uuid": "08ede0c1-7ad2-47d8-8e30-51195c0bb1e3", "comment": "Malware payload (AgentTesla)", "value": "09e379513baf73dc3aa6f7873406e8ece290a855", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648457119, "uuid": "0b929b3a-43c7-4a7c-b5fb-382602b2987d", "comment": "Malware payload (AgentTesla)", "value": "0ce78f36eadd5950b5470c1049371fdc0efad935b7d94004a95c8cd614cd928eeb9d3c49fa8cb5f04553034443cf631c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457119, "uuid": "3ae20fba-f487-46fb-bea5-5cff009772bd", "value": "T10635010232A05754E17A53BACCA844DC47753D6AAE7DE20F1DD172CF1AB0BC18A2AF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457119, "uuid": "e1d45c30-ee40-4191-ab27-b4af6d55631c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457119, "uuid": "1898e632-1b3b-4a60-a152-de07873dbc3e", "value": "24576:VpTcaIQph3BVkKfbbJycMzki2TU0QHoFKyZAUaMBiA4DnEo:AVqHMgTU0QHoFKaGMAHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648457119, "uuid": "88a45842-e7d5-4557-830e-7fe6e78ae307", "value": 1159168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648457119, "uuid": "51d6af86-3feb-4940-96bd-3bb0e80cd1a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648457119, "uuid": "74725073-a6c0-47ca-b179-40e236ba4af9", "value": "Bnak Instruction.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c8a5fd-ae5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1648448480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448480, "uuid": "a4d591a8-6160-4e12-a110-9e1765950b9a", "comment": "Malware payload (Stop)", "value": "8994b6b42a7aac42c8552b52679b7e6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448480, "uuid": "f485307f-a512-4607-adea-5415a92f022c", "comment": "Malware payload (Stop)", "value": "efffa644226568072ebabf09f621d71fb64e5a8f17d23c0586c544e1c71f7047", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448480, "uuid": "585671e8-b3a2-41cb-b1a3-42c861402232", "comment": "Malware payload (Stop)", "value": "e9272a55947c32a49ffee059b6ac74e6a6ce5af7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448480, "uuid": "fa1ed743-55a5-4033-a3ee-a99b57ae0054", "comment": "Malware payload (Stop)", "value": "fbc1a0c20180e1fafa733fe5e2e18456f86c00f668792471330362db2290329abd1c36c7f7be0b507e0faf5e5950097d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448480, "uuid": "1d8d9041-ef85-43ff-af06-988b08784954", "value": "T194F40210B751D031E1B712F048BDC3ADB92E7EA19B2450CB62D65EEE6635AE4DC3231B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448480, "uuid": "8483265e-411c-430a-aa24-b4c75664adc9", "value": "27d8a7471ee53dd07acef039b03728e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448480, "uuid": "b64f8420-a8bc-40ce-b8e0-48674ece7d61", "value": "12288:eK2bgYI5TIfhdLRzmvS9b/UJ0TqVNQ9ACEo2ECXAEQ2rFUYN4deWSAZ6z5n8h8ml:13sN/9b8eqP2CBQW4deK+82mU4xZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448480, "uuid": "bbb382d3-269d-4881-94ec-8c22b79cabc3", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448480, "uuid": "06afc032-1857-40ad-87b1-489d5efa93bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448480, "uuid": "c95f5c73-f2c7-4348-8ba1-0db7e9ae15e2", "value": "efffa644226568072ebabf09f621d71fb64e5a8f17d23c0586c544e1c71f7047", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b52d2c0-ae5f-11ec-8e58-42010a9c0032", "comment": "Malware payload (TeamBot)", "timestamp": 1648448485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448485, "uuid": "7a62ffaf-04c6-4e6e-b52c-11890d21f8b8", "comment": "Malware payload (TeamBot)", "value": "ad2836ab1793d67eae124e749b371a6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448485, "uuid": "8d0a7e46-2274-4270-9aab-7a673f60a07a", "comment": "Malware payload (TeamBot)", "value": "f02b45b579b65a1ea89f2d9443f2c1a1484dec0bc66591ff4d3ad6ce63d635aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448485, "uuid": "0ac2da23-c977-4e3f-8f5d-e3887c34cac0", "comment": "Malware payload (TeamBot)", "value": "62e80bc2c8f370e24e9a9c29d936dcafbf49990a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648448485, "uuid": "62aaf084-2a25-48b2-b18c-d239294c2366", "comment": "Malware payload (TeamBot)", "value": "ad8447cf3c98b63a304d2055598897c365cc81a5b8f2ea3f9e3030da4397354808bcd4304f1a76b440216959d45a2005", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448485, "uuid": "8baaee5c-6763-4eb7-bd73-cb12aeeb44fd", "value": "T1D5052322B354D031C4CE56383474C4E5DE6A993395A1827F37A91CFEAEB07D02ABD349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448485, "uuid": "a8d93c5d-e128-4af4-bb8c-bfcab7aa8b17", "value": "7d2f3e2df9d6e9df3acc14e0869523dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448485, "uuid": "d144a262-9f52-46bf-9693-50b6e50dc461", "value": "12288:M+rzr2P3A7XkYeF0F5n3Egg2VlFyBY0TiOkrI8Xk1vsLFthFQzVU4LNc:brzrkA7Xk5CfTUe0MrI80crcJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648448485, "uuid": "f69f29ee-93a8-40c4-9248-72e470be7350", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648448485, "uuid": "71a71cce-a6c8-4e22-bb76-362cf144eb1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648448485, "uuid": "37228797-d3e8-402c-b969-15d22f6231ab", "value": "f02b45b579b65a1ea89f2d9443f2c1a1484dec0bc66591ff4d3ad6ce63d635aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "393d335f-ae99-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1648473365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473365, "uuid": "cf86d44f-8e32-4da4-9478-3c129551517c", "comment": "Malware payload (RedLineStealer)", "value": "6a73fa3a028ee491806118edacf2864c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473365, "uuid": "9c9895b7-15f2-482b-bb8e-ab261c075fb5", "comment": "Malware payload (RedLineStealer)", "value": "f07f210bcb0f9ca5d222a89c493a6779870816e04f44f88ac5940bc44a445399", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473365, "uuid": "97091c97-b500-40f2-b933-28dd740c117d", "comment": "Malware payload (RedLineStealer)", "value": "2b6c4b0d80543c27a1fe262cc399cad037147043", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648473365, "uuid": "e178c965-6f40-4e35-a522-c965a1b0f5a4", "comment": "Malware payload (RedLineStealer)", "value": "6508a29a702f551dc00b37e92b1bc58e24ac9dd7183c75bf804a8af298a53e9ab93f49912e362fdf355d90e8becf94ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473365, "uuid": "c05073c3-e63c-4662-a29e-416b4b6d3102", "value": "T16E84BE00BB90C039F1F716F5497993A8653EBEA19B34A1CB22D42ADF5635AE0EC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473365, "uuid": "37388b14-5375-44c1-a830-e32f0805d2ed", "value": "699070d0802ac292c6d967d0195e7ff3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473365, "uuid": "95154809-941a-4bdb-9300-845d4db2989a", "value": "6144:qwuB15EzEuVW0lRiO0LloHLeSRa3avrGWjTzRnwWRetO:qw25EzRVW0uZTSRa3wlRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648473365, "uuid": "eb6c5e54-efa4-4d31-85d6-7094c95b7437", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648473365, "uuid": "fcbc11de-df04-43bb-b707-00166f2e9d64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648473365, "uuid": "e4260fba-d2a7-4f2c-bf69-38d31987e9d5", "value": "6a73fa3a028ee491806118edacf2864c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff288b27-ae6f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648455658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455658, "uuid": "9a2f9e26-cd2d-4ec7-a802-ab2e128262e6", "comment": "Malware payload (AgentTesla)", "value": "34874f8dd4a4f33dea2f18484c5ce1fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455658, "uuid": "5c40df70-4f20-40fd-977d-fa553c10855a", "comment": "Malware payload (AgentTesla)", "value": "f0ed841ef00043d7666fbda979f6f5c9fbabce70e4a68c5249374f4127741da3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455658, "uuid": "7e034ad3-1cd4-4f11-9bcc-d3229565f373", "comment": "Malware payload (AgentTesla)", "value": "5eaf27af6bd5ea93234fc31ae1db61908a2ce6c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648455658, "uuid": "ac52525f-fa6c-4ca4-a2d1-3332b16ca2c0", "comment": "Malware payload (AgentTesla)", "value": "1ee22346f66a12fc69d7e78735ac341e862e726ed05f4495c5e8f1a2581d8dfe25a09e019c3efd7114051597d5737b13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455658, "uuid": "1a730149-124f-4500-80ce-8ec5b005dd64", "value": "T18A657C983250719EC467C972CDA81CECEA207C665F1FC207A053369E9A7D99BCF146B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455658, "uuid": "630691e0-4670-41f5-99c4-d9011e4d9e82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455658, "uuid": "113cb13d-c57e-4155-857b-5f8b0055f6c1", "value": "24576:wFoWOpdByZJmwl84gw25cQrkmeCIUWbPdkcI:N6Rl84gwKc39T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648455658, "uuid": "499855c4-abbf-4d81-8fbf-df5ac7cdd3d4", "value": 1442304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648455658, "uuid": "0f0f2bad-12fc-4937-9522-953d1264804e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648455658, "uuid": "fb603908-e00a-4ed7-95a3-3871b2a63714", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717fa240-aeec-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1648509108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509108, "uuid": "e627bbb7-0f93-4f0e-baa5-76b31fecc819", "comment": "Malware payload (SilentBuilder)", "value": "9746b2830de8b87d9534af06212dfe23", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509108, "uuid": "63eb3f67-faf4-47f8-b26c-3f96c9693eab", "comment": "Malware payload (SilentBuilder)", "value": "f12905c984c2c58ec466f9e198a65aba6cdc55062e8028395957a9ac8dc38b81", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509108, "uuid": "5e4f1974-2345-4da8-8dad-509e97c59e33", "comment": "Malware payload (SilentBuilder)", "value": "1ab990e0ddd716c506c165a2141c4dcd06db2d6b", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648509108, "uuid": "2d875d1c-f281-4422-9b4e-1126c7f13fda", "comment": "Malware payload (SilentBuilder)", "value": "13e3e360f80883bd6d6c61a46004dacdbfd9f15ef8301b9ce2dd1f56a11fb98d47057123042b9ab2cd70d5f11938b122", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509108, "uuid": "4eaeb86a-7e21-42bf-977b-38b804ac7ded", "value": "T1DEC3AD8BB659486DF921877488DB879A7363FC344FAB47473214F3366EB95A04E0324B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509108, "uuid": "e1a0a8ef-dd40-4479-a49f-9bc94a578f31", "value": "3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlC9:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648509108, "uuid": "ba46cc9d-a930-41e5-b38b-954adbd8b456", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648509108, "uuid": "606aab0b-6a86-44dc-ae9c-ddb44e8e2af2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648509108, "uuid": "5f63d8ff-51d9-4445-85e5-8fb3b37b7794", "value": "9746b2830de8b87d9534af06212dfe23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54dd8ee-ae7b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648460688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460688, "uuid": "c119bb17-dbc5-482b-bf86-db5d1b8330ec", "comment": "Malware payload", "value": "f3bfd1ec59335c4c6d7492a5aa7c523d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460688, "uuid": "f0d3b990-14b7-4db4-a345-4e2ab6149dc2", "comment": "Malware payload", "value": "f207aff70b059d56cd9885608dbd8fd711b8a7287f05fb3546450eee656ae61b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460688, "uuid": "d7f0f637-8f78-4451-9046-6af246869750", "comment": "Malware payload", "value": "69e2a7bc93560223ba82342173b5753eec7f082c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648460688, "uuid": "cf6af0b7-ef86-46fc-a2bd-4adb89d76aa6", "comment": "Malware payload", "value": "24829a756cdcf08d6c1423777e1d0881b3cec7c8102d70e9d6bf0189a58c16d286ae767d7a63baf9523a50b13444ce3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460688, "uuid": "835149ab-bc35-41c6-8361-5b0da4f1a13b", "value": "T10402851EFB91DD3FCC95833588A7453033B1A8A88F2653232344F5796E02BD86F2A59D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460688, "uuid": "e816e734-1078-47df-81a8-3c977bd805d8", "value": "96:R1TDJVB+BCEj37ucMsVnvWTwOl7/1RxWMRjHcu4sw70s+uB1fBMSiV8v:R1bwQC7zqZd/1R8gcFBDqSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648460688, "uuid": "c93bd3df-0922-4283-a24a-46b35572a84c", "value": 8576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648460688, "uuid": "050bbba0-cea2-4b37-8005-5087d28f2a7a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648460688, "uuid": "b0bf5b4a-11b3-4792-bdd3-e1762ab48b63", "value": "dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a820a837-ae7d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1648461525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461525, "uuid": "62a3ad53-2f4d-42c7-a788-8744cd27ae94", "comment": "Malware payload (AsyncRAT)", "value": "b349a16e03f389a0e86e2c9661f33c15", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461525, "uuid": "55f9b407-3194-4935-b6c1-dd65908530e1", "comment": "Malware payload (AsyncRAT)", "value": "f250090168226276cfc16a4450dc7817d886ad263a977eafc7e4c0e6622f1e34", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461525, "uuid": "7b7d65be-4745-45d0-bec6-b6bb059edd6a", "comment": "Malware payload (AsyncRAT)", "value": "bbecb113f846a04d13b1922f8a926bd23f2a513a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648461525, "uuid": "0e293515-4118-46e1-94ec-98a1c20de474", "comment": "Malware payload (AsyncRAT)", "value": "20cd4e1c1b6826c81148fcbe7734f7318768a99babe7a2e3a50dbb814a79b292567437d4fc166fc4533d0ff599ad51d0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461525, "uuid": "14e7c92b-d588-42a9-90b0-79d813bc5f6d", "value": "T1A7B192116BE8577AFDB74B32AD7342000A75F795E867CBAC3884910B6D276004A63F22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461525, "uuid": "da3917ba-fc72-4545-9980-eb213b791010", "value": "48:6L/cTQXB7lDIIrwVNMfU4i0MLdn6XVY3cPv6yGWitQqcROnSDzlpaXFapfbNtm:49zrwKU4i0kLtQf7BzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648461525, "uuid": "1a46bcf3-c5bf-4988-9ee4-ff1189612a38", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648461525, "uuid": "c4050acd-06b6-41cb-9cc2-fdf4aa572770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648461525, "uuid": "37a6922b-d033-43f3-a91d-9781fb0a90e4", "value": "AGT7VfaZz8_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29df0f0d-ae6d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1648454441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454441, "uuid": "fdcd2a35-b618-4e6a-8868-3d30e3961a18", "comment": "Malware payload (AgentTesla)", "value": "13fe43dbea7dddbe5060066cf39807f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454441, "uuid": "02aa9503-665d-4823-ab4e-2eedbcdedf9a", "comment": "Malware payload (AgentTesla)", "value": "f2d87f50cf3fc57319a2b41c12bf0424be27cd79a2bf04a502e236b54aa16610", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454441, "uuid": "7c525579-d5c8-4d76-b385-a3f1c5fdec0a", "comment": "Malware payload (AgentTesla)", "value": "ba21ed0900eef2f77d22010b3addba4cb9b596f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1648454441, "uuid": "963f3b7a-bfc9-4942-bdbe-d14f0f0dc9a5", "comment": "Malware payload (AgentTesla)", "value": "c0d96a4b885586a7306179491b07146c6bc7e9c65b26a60eed6d2927d66137710b9960aa59479355a38ebca34b0f5594", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454441, "uuid": "ada6bfbf-9224-4bd6-aa2d-3a4a333abf05", "value": "T16DA4CF2F0B9AE555C01234F82AE294CE78F45E4038A9DB519B612D699FFC3437D9E0CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454441, "uuid": "0e2c176f-1d49-4491-97ca-1c52cb488c05", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454441, "uuid": "55a5882f-75aa-4bfe-972a-1544cbcb8f01", "value": "6144:BGiUlRAttixAkVJJtoLPjYba8c1w37LXBaDIe3TOsD4qggLoTHhX3oAM2ysP5sC:YxAkVJLkY+8IUXBqlTO24BgMTBHwsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1648454441, "uuid": "cf0fbc5b-a7be-4f68-b8c1-1f8dfe7f4787", "value": 454248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1648454441, "uuid": "79b1ba2c-0b7d-4766-85bd-a627c5882354", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1648454441, "uuid": "406d7f9b-1a6c-4bf7-9427-14e362758d08", "value": "13fe43dbea7dddbe5060066cf39807f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa81ba00-aeba-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1648487863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1648487863, "uuid": "96ee6600-d03c-4db6-9550-e1839606cb6a", "comment": "Malware payload", "value": "ba21917322c5248694b3621d39232dd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery",