{ "Event": { "published": true, "date": "2022-03-19", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-03-19", "timestamp": 1647734581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b0428d70-0cbb-4171-a60f-a5d966ad642f", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e975cf7f-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "a30c94de-89c7-4309-ab84-59c7b5702bb9", "comment": "Malware payload (Heodo)", "value": "b6a88689a7301b9aa99abf9e08b29aa6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "1e23bbd4-985d-4f75-bc80-4fb416c514b6", "comment": "Malware payload (Heodo)", "value": "0049b7582befe2dedd40dc30bbbd3f941c50f4270757ddb8b2726e965cd36f9f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "b581a994-f9b6-44ff-a649-6be1545c5f10", "comment": "Malware payload (Heodo)", "value": "410202c244f44a4b9a6cb6fa0692f5b444cf4663", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "7446c1c0-7f34-4a6f-9479-ee7d4e2b8a7b", "comment": "Malware payload (Heodo)", "value": "d4980d033624f18d27f2bba8da768cb2582f35fbda09e330db2b1309b90c51198b264acbf62a6acfc8936dea859057fd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "045cebf1-6d2d-4d8c-bf71-f11e60fcf9fc", "value": "T187C47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "5baa9f83-24e3-4dd6-82ac-554eaa0b5bc0", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "a15efdf9-2c95-4719-8954-ef11910a367d", "value": "12288:S54yM33d3q3Z7BogxreNmF+U/9JckIAGfUeb:SKh3831BojN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648597, "uuid": "79a62459-7465-4924-bc90-423bf270e47d", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648597, "uuid": "a80d99bb-3774-4b83-b399-69caa75251db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "a75e81d6-c33a-47dd-91b7-84cc79cc4733", "value": "emotet_exe_e5_0049b7582befe2dedd40dc30bbbd3f941c50f4270757ddb8b2726e965cd36f9f_2022-03-19__000953.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fb4974-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "ecf6023b-e952-4abd-9cd8-5d990bb48c79", "comment": "Malware payload (Heodo)", "value": "550a9a00e83272a07c7c908c94aa66c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "5b736671-df64-4f57-b746-abb6f1774fba", "comment": "Malware payload (Heodo)", "value": "0052cab6b4c5cc30319eef6f40e4d74beca0a00498ef6aa2a89d2c93e6d4f01e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "50c3df1e-0efa-4623-acea-c07f885b69ad", "comment": "Malware payload (Heodo)", "value": "a755e339ca5f5ec5b42a8716c063d5cce01ce220", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "99639b02-fdad-487a-b507-6921e1db1c71", "comment": "Malware payload (Heodo)", "value": "84ba4ca8f45cc5b50b8a5ba8fbbca927935f74e75cfd7638c62d9fcb18b534ba4804a2de4ef66a49acfda3f8c3ee2160", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "31a6ae58-d6f1-438b-97b8-91f388192184", "value": "T16AC47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "87712e09-734b-4031-a873-e32d26725cf2", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "b5e389ff-fe9f-49ad-abb1-64b5dd7a6954", "value": "12288:S54yM33d3q3Z7BogRreNmF+U/9JckIAGfUeb:SKh3831BobN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648597, "uuid": "ecc429a9-9866-47b1-b613-fd8f3d28eda7", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648597, "uuid": "dbc1d877-2566-45c9-9ad9-6940df39418b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "4d0dfe07-9776-4596-afcc-dde58aab58e8", "value": "emotet_exe_e5_0052cab6b4c5cc30319eef6f40e4d74beca0a00498ef6aa2a89d2c93e6d4f01e_2022-03-19__000950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98318b38-a743-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666929, "uuid": "411d6a16-a85f-43cc-b890-a3ad4bc7378b", "comment": "Malware payload (RedLineStealer)", "value": "28442d86197a486c1cd88767d8441f16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666929, "uuid": "88845f98-ffc1-4b86-882f-b70be29e5ed1", "comment": "Malware payload (RedLineStealer)", "value": "00f5564c900a9fc7425676a0291733b7acd1e93896cf78553ae10dd02d56f138", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666929, "uuid": "4d4eb811-49cf-4daa-8d96-b38aa3c305fe", "comment": "Malware payload (RedLineStealer)", "value": "492351c397c3141e63c3bfd3611a808d49a4f83e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666929, "uuid": "b725e430-3cec-4d17-a769-64a4f48d5adf", "comment": "Malware payload (RedLineStealer)", "value": "993f9e5eb7970b365b30ba53e849a3966fd9b9e723dac0bf37f478bdec7023d399557af5d93e1d6d72b95c13ce4d371d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666929, "uuid": "583c4631-bd53-44ac-8fed-51335770738e", "value": "T1B636339D26EDF6B1E24C23728CD7A240BBA7D34D20C9EC0F53BD53D6D63881A116895E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666929, "uuid": "4469f653-7214-49f4-a1cd-acf38231fed5", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666929, "uuid": "e65f286d-e26d-4cb3-9fb3-43edb0a5bccc", "value": "98304:V21q1oXLNcgq3aCg/5HVO6Pf3cISdHUE9qIBkv9M6HTqpkX50LkngphwV8hq4xTx:PaXZcTc5Ho6MpUE9qICF5WpkX5akOphl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666929, "uuid": "2e4571a5-1b7f-4d06-8bd0-50da144d6377", "value": 4883096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666929, "uuid": "700244f3-0fff-46f8-ade8-0a0bfe0ad986", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666929, "uuid": "a5b86d46-7800-495a-a863-189d55b5bd24", "value": "28014958.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40fc1dbf-a71c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647650033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650033, "uuid": "17bdce71-c590-401d-b963-7c5f8885273a", "comment": "Malware payload (Heodo)", "value": "f6f939c9c2f3f73c942a2c4fd192569e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650033, "uuid": "86e10bff-cf75-450f-bda6-a666591199cb", "comment": "Malware payload (Heodo)", "value": "035d1bbfa0e50dd7909cae22e7bca0b8c0c83c76f3e45eb1234e503e26991b03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650033, "uuid": "8ed49cbb-2302-4133-9182-59a0e680b9f6", "comment": "Malware payload (Heodo)", "value": "5bd6ab918353959b0a71f0ef8a39de89e3036180", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650033, "uuid": "4a6c934b-a6a4-437e-ab20-259c7c65c246", "comment": "Malware payload (Heodo)", "value": "e89f2b138353f640a52f08087ad67f08845fbda4dc6c51a72bea5416693f9b858054f81c5a640e0448f6e76791308bb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650033, "uuid": "72b46f7d-b192-4b6c-8a6f-ff79573dbec7", "value": "T1EBD45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650033, "uuid": "ed6bd725-4cce-4dff-9043-a729496f4264", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650033, "uuid": "27209035-da06-48eb-83d4-1912bac44e98", "value": "12288:UWBpwupxl0OeL/grxQGzO+r9AjCb/XKh:Psupxa/g72mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647650033, "uuid": "dc4762e4-2c2c-4731-953f-c6ea73181553", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647650033, "uuid": "e35720f7-4eb5-4349-b104-384e74e314dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650033, "uuid": "5d54403f-771e-443e-beb5-a0f85ff56726", "value": "f6f939c9c2f3f73c942a2c4fd192569e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2a2c72-a742-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647666619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666619, "uuid": "c5a88318-481b-4422-a1f1-e7007b2f7c39", "comment": "Malware payload", "value": "efebe27b2084b3efa83191bda8f730f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666619, "uuid": "0c416335-fe31-42dd-8c04-eb4ee8696ac8", "comment": "Malware payload", "value": "03932dc55f26d7fdd7060539587000bb8ede8ade250fe77d9bead3c1f9123c22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666619, "uuid": "0f15b6a4-ea78-41d1-af73-9de76d3be619", "comment": "Malware payload", "value": "62c40cb2faf95b584a0bd12b578beaa3c4b44e39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666619, "uuid": "f6065599-279b-4b1d-b740-453fd282f0fc", "comment": "Malware payload", "value": "6babe0bbc4a647a8ddf19d50137b17da5ba8ff7f461f4f4a6fb47a38a34fb79f4526bf973d190f2996b3c945b9378f64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666619, "uuid": "a1af28ff-17cd-4b90-bf37-2bb7aa636d2f", "value": "T196453310F56F5AE8E72B6F7B00A1B92D1FD17AFAA1DD2D5386D4118BEC41E721103E0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666619, "uuid": "6af07f41-8072-4b24-a456-b80ffac67c8c", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666619, "uuid": "7863ccf2-384c-4e69-8ebb-4c6d845139bb", "value": "24576:yritlPVn+sMXx5DSZYV8a+ilieflgFrjVcxoP/im6adbbr:kibVn0XxYyCa+iliQlCrjVnPm8bX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666619, "uuid": "2dd9a251-47b8-49d7-b25f-9cd3674aa348", "value": 1197568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666619, "uuid": "56f8ed58-349f-44f5-9d9b-fad7801f0459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666619, "uuid": "45f8f487-b001-45c1-9782-3766db5b96b3", "value": "25645807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ac75b3-a7a5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647708883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708883, "uuid": "1ecea0ee-6f7d-4ae6-b86f-43446a750dbd", "comment": "Malware payload", "value": "4a988071020dfd719bead0cf438d58fb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708883, "uuid": "d277dd99-44b8-4f03-b387-6f59217429f6", "comment": "Malware payload", "value": "03c76e49ec694a14ed657197b586201a30570911344199fc0a0a6d03e03c2fd8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708883, "uuid": "cbaaeaea-d8b5-4102-a705-ac21a1dd6d5a", "comment": "Malware payload", "value": "629f62e9b87cb30f96e2c8378e3dae67e44d4c27", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708883, "uuid": "e23b2c18-ceae-4124-a705-6a9991f85f19", "comment": "Malware payload", "value": "1b536de670a3480fadddea0dd3f9b59931ca16390c4e8c2b28b53dda61aaa94f6ea535d57b67e3340436d6e21db80cfa", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708883, "uuid": "eb5ddbbc-f9b3-4b6a-9088-4003d1efe182", "value": "T106A4232B03185C6BE5AD85357B68B9F453D2C6E62F6DA4B0B0802ED71FB43148EA7F05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708883, "uuid": "29b2ab4d-8cfa-43b5-bf53-4cbf07eecdba", "value": "12288:nonLafKj4ZsjJ7DLB1FjV8MIcf8SXzBuB8tETe:nbyE07R1FjVR1ESf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708883, "uuid": "441fa81a-efc9-43c1-ab08-1525ec81d62b", "value": 487389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708883, "uuid": "5bded06f-9501-45d8-93e7-8204d9e23b34", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708883, "uuid": "9b54f5da-0698-4e91-afd6-eec7e2bef80b", "value": "ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc602c44-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666668, "uuid": "9e08ddb5-f6dd-439c-85cf-4aa037a358df", "comment": "Malware payload (RedLineStealer)", "value": "7ded7803acca460cefedbdb140958aeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666668, "uuid": "742821b4-0fd3-49c8-94bb-427be33b28f5", "comment": "Malware payload (RedLineStealer)", "value": "06e1b524663bf73f1b31af2b2b7e82db7811ea596ac5abe18c8bab0aa404699d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666668, "uuid": "e1b1ff83-0764-4d71-992b-e94b22652309", "comment": "Malware payload (RedLineStealer)", "value": "fb08c846b852920a046afa79dde86280286f5bb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666668, "uuid": "7088e873-9907-4a8c-a9ce-c1a8de376a9d", "comment": "Malware payload (RedLineStealer)", "value": "c6182e645e02403413ba0f56237a0943e8721b685ad3e2b7d322ef788640b6612c73077ff5f5179d62d15d6c9e148181", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666668, "uuid": "eb5072ea-07da-400d-864e-531d39b33d53", "value": "T1A8B4B53839FB9019F2B3AF75DBD874969B9EFB633607E85D204003864A13B42DD9153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666668, "uuid": "bdf28a36-acea-468e-a511-2d2ae9e597f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666668, "uuid": "b537df01-8ee9-49e3-ab3e-ddbb21d56848", "value": "12288:pyGokHwY1ncI5r2tybyhg1JVYAE9u+57ExWVyFEX0sX/ALS:pyGokHwLIcY7iK+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666668, "uuid": "28d98c17-8895-4e26-8edf-82cabc196c3a", "value": 498688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666668, "uuid": "03b817a3-78e1-473d-81ad-2257c0ecb0ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666668, "uuid": "c2910456-bdc1-4697-acbb-8e3fd7ed48dd", "value": "26106520.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd6349e-a7a5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647709167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709167, "uuid": "b9e48655-dc19-4368-b7a0-c52d0e7040f2", "comment": "Malware payload", "value": "0604022903771a1fb31ebb54903b89c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709167, "uuid": "0e874eb9-ecd0-44dc-af97-919bdce33598", "comment": "Malware payload", "value": "0718244177a1cf69342f09c7733cc9cb4407f0145175553d591af5d818a28fef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709167, "uuid": "c55f50ac-2315-418b-9589-a12988982d6a", "comment": "Malware payload", "value": "5c3f9dc36f06048bf88165acc18b566e17545726", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709167, "uuid": "103159c2-cb76-4065-af4c-bc661e67a691", "comment": "Malware payload", "value": "600bc995fafca606694bcf3afa1168fa097892df01105d56b5204ec046a7ed526a5b030d3b3e238bb51e3fc3fc4c1cef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709167, "uuid": "08b0dbf5-324d-42ac-9df9-34fd3b6a7fb0", "value": "T1DED5F13FB368653EC4AB0B3245B39350597BBB61A81A8C2E57F0090DCF665701F3BA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709167, "uuid": "8ba38f12-2479-4680-ae86-eea20f7ffb25", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709167, "uuid": "747f0b40-92c8-49df-a7ce-3218362d9a1c", "value": "49152:Fqe3f61I4QlRhuPMba/dcSV7i2pVGx3lUBwH2LfgGMvsZydqpa1qq:USiS4CRYku1rLpox2aHtvs9pcqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647709167, "uuid": "35a0df32-75ef-4469-925e-ed2f2d5124b1", "value": 2880751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647709167, "uuid": "5497a0a5-4ab4-4822-b13d-45022970cdb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709167, "uuid": "3c095378-7674-49ed-9c22-6a2af4662ae8", "value": "0604022903771a1fb31ebb54903b89c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b7da9d-a729-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647655867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655867, "uuid": "69edceb5-ad43-4a3d-a383-2bed6b094242", "comment": "Malware payload (Heodo)", "value": "61a2540b429371035438396f5743bf48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655867, "uuid": "4805aa22-ed7a-4017-9589-b9460013bd9f", "comment": "Malware payload (Heodo)", "value": "07c0afb3081fc56a732da109c21948ac45fad937bdccd5c334c282428527dcbe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655867, "uuid": "55a230ed-dbf9-406b-8b17-e1d8659e20cd", "comment": "Malware payload (Heodo)", "value": "90bebd3a56c3a2d432a494770bcea55ff891858b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655867, "uuid": "138072fd-c51a-405f-80d2-d11ed37c14a5", "comment": "Malware payload (Heodo)", "value": "e09486be35784389dd12f4de0e1897535e773a4e80b03675419fb29dcdc5537c032774de282a8d173d4a9f7ebe83d57a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655867, "uuid": "ea60f5df-4ad6-4494-b2aa-82b27d40fcd9", "value": "T1A2D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655867, "uuid": "e80b4001-108b-474b-8518-f31e5b927379", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655867, "uuid": "3eaa05f1-1b97-413e-a8ba-f82a80c27683", "value": "12288:UWBpwupxl0OeL/grxeGzO+r9AjCb/XKh:Psupxa/gl2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647655867, "uuid": "27809318-d38c-42d0-a5fc-8b40db1b8469", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647655867, "uuid": "cb62ec7e-dc28-4843-ac9e-380a9b8c6b41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655867, "uuid": "e6dde195-96de-4120-827c-a3ef5501b255", "value": "61a2540b429371035438396f5743bf48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e81ae77-a744-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647667235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667235, "uuid": "36eadc41-b830-4036-90cb-febba1182329", "comment": "Malware payload (RedLineStealer)", "value": "56450ce0e9baeb225bb8d51dfdcad94f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667235, "uuid": "878cf4bc-fae9-42bc-8f80-429f847aeabb", "comment": "Malware payload (RedLineStealer)", "value": "08b580a8491ed80087583f52275c1a551e57d181b919d5259e43be35c2420a3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667235, "uuid": "b95b8641-0e15-44e6-92d7-09a6973e7f91", "comment": "Malware payload (RedLineStealer)", "value": "32d904b9ecbbc2cd0662a2c5fbaff67abec8deee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667235, "uuid": "c5917361-4a8a-433b-99cb-5d4dc0573696", "comment": "Malware payload (RedLineStealer)", "value": "19428ed2f51019617592a051a8d668c2b3728cdfa706ae980dce791cbe8aeb4ab782bfa8139f79a9d5e75a6ae6cb9d5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667235, "uuid": "dafaae37-7d5c-4f46-a511-e68e0dba7256", "value": "T1602633C772D67F64EB47BE79DBD193141726E738B1E53171BB0FD62A82482A62383204", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667235, "uuid": "85d7435b-8dc8-4ba5-a334-dcfa13ae2f0e", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667235, "uuid": "c4278575-79c5-4c1d-aac7-6c4c0975f6fb", "value": "98304:1SjlJV+GYibsm8cHGpiMI9Apb/IK7J1ruhoW:1olTbSdN/IK7JcoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647667235, "uuid": "300e1dbc-f87e-430b-bb0e-4721156edde8", "value": 4536832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647667235, "uuid": "fec36258-5600-4785-910f-020d13d5bcc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667235, "uuid": "c5fa4d67-6a78-4d98-b29f-255dab580b13", "value": "29499654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a992167c-a737-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647661805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647661805, "uuid": "ee3e3426-27ca-427e-bda3-875464159c80", "comment": "Malware payload (Mirai)", "value": "32db06993cb8569f58defd8398e9d591", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647661805, "uuid": "dfe920e2-7ef9-47ce-a342-e89c92f01e25", "comment": "Malware payload (Mirai)", "value": "090684278186e568d9945f94e15a0cfb27cfac3f2ddb591c29a95fa612beb4d7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647661805, "uuid": "56051b14-7ab5-4e2f-8091-2b757b1d7258", "comment": "Malware payload (Mirai)", "value": "456ab8ece4c3011cca5867dece44d47af51dd3e9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647661805, "uuid": "67f7885d-258d-44bc-9ef4-572c90b35a67", "comment": "Malware payload (Mirai)", "value": "622ad37650c597a4106ba0cb6fcd7e3cea5994dbd8138f57cee9f1227a5df1f7bbc1ab7c1c2f0099f40cfbe813977277", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647661805, "uuid": "f9a04129-ee2f-41d5-a62e-8afc5459226e", "value": "T176931AD6B143E4F0DE2304B0705EDB7A6A31D97BA212E99EDB59F523FC91202D502B4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647661805, "uuid": "bec777d6-7c6c-47e2-b4f9-7fd1fa8fdd0e", "value": "1536:duHS+0KaOHhtCG3mCKPEtmGVxKE0doWSJYUx31MeEobw7r:dmaOHhtCy8PgVQU7Kkbwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647661805, "uuid": "dbc8c2b6-470f-4e81-9300-eb972f49263a", "value": 94856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647661805, "uuid": "af5d40bb-d708-4993-9ef6-a25471cf6e54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647661805, "uuid": "076dc6f7-3d2c-4cdc-a4e1-57a23d52f975", "value": "gx86-20220319-0350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63217b7-a7af-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647713419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713419, "uuid": "3aa511ba-7887-48c6-ae18-9cec6a664efd", "comment": "Malware payload", "value": "8216144053969daba36b00e20229d9a3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713419, "uuid": "d41334a5-a247-43c9-a5d1-f37fbc1521d2", "comment": "Malware payload", "value": "093f9af7a20436c7f3908da0ebbb816fc2c7b74bd47eda9c236df2bd595e8686", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713419, "uuid": "39d631a3-1fca-4d12-b7f7-31524376c889", "comment": "Malware payload", "value": "1a77507eb3a52b2ce4b5e7c54c6210ab52742bed", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713419, "uuid": "688faff2-1c76-46dc-98f7-c6e829c0ee75", "comment": "Malware payload", "value": "79644039e1244a46bcd4acf1e38968a2a57c0cfaa4063b5102ac7a0f8fa52d13b0594a508ca4e3da4e72e2225cf78604", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713419, "uuid": "685beb83-7e9f-4aa9-a96c-64f65a584ea3", "value": "T116732A89FD515B40C0A020BAFE1E11493357D7A8E3EAB312DE247B6057CBE6B4F6B416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713419, "uuid": "127b0a23-ab13-42af-9068-883ea15ac189", "value": "1536:yCnEbOoDB0Em24H3MbkBNl+UihzyQwpUlUAXnVbC6P:oaUHm24H3MLTyQgUlUAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647713419, "uuid": "208a55db-bef6-41b4-8577-4fdec89a7c50", "value": 77252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647713419, "uuid": "9e14ea93-99ec-442c-bfa0-e1d587f0a627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713419, "uuid": "43f6d967-7736-4207-9292-7010f6f057a3", "value": "arm7-20220319-1810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf9b669-a7a5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647709109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709109, "uuid": "2b045924-4cb1-48a3-ab07-898b58d1ae69", "comment": "Malware payload (RedLineStealer)", "value": "d7fd31685f2eb757a0729e24d173d124", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709109, "uuid": "be47507d-773e-474c-bc8c-b6f189800beb", "comment": "Malware payload (RedLineStealer)", "value": "0a2b78a85ca44d6a5c8bb84bdc5530a8ec34e417ebfd68a8ab75446b233066ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709109, "uuid": "82500fec-4726-4239-9f59-440972c8fcd3", "comment": "Malware payload (RedLineStealer)", "value": "583b015d15fbdef05931a3effb76aeb6f52e03b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709109, "uuid": "8c2fb290-84f0-44a4-949c-885ed7ab7c3a", "comment": "Malware payload (RedLineStealer)", "value": "35810df32ec983c04c6057e80b404bdbf99415a0ac845e168014dd4f50fc3c78466c70e31057010d2cef6da4320834b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709109, "uuid": "ee6f8f2c-02e9-428d-8638-8577eafdd219", "value": "T1B584CF40B7A0D03DE5B712F8787AD3AC752E7DA05B2091CB62D66AEE15342E0EC7531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709109, "uuid": "0c74826b-3c83-4be9-ab74-a84090bd36f2", "value": "6dc76534a71225c5adf2ef004034f9e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709109, "uuid": "edaa386f-0af0-49a8-a53c-9e3a74b57083", "value": "6144:dtycjjONNd74DNxa+w9K/F+IflKsWCfUL6x3Kz+n3lq9f039I++PpeW:Py8ONNd74RxzwI0UqCfm83lquNIf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647709109, "uuid": "6e380c79-fb7f-4a50-aaf1-78a6a00699a1", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647709109, "uuid": "25e837e1-d4bc-41e1-8d9d-3e1c84abddcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709109, "uuid": "bc56ccea-aad8-46e1-9b79-0257073c65b3", "value": "d7fd31685f2eb757a0729e24d173d124.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f7d8bb-a79e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647705950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647705950, "uuid": "ca7c0e55-be5d-490e-82b6-953a96fa0d28", "comment": "Malware payload (RedLineStealer)", "value": "cce7b284ee76d9a54297e2237c80d90a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647705950, "uuid": "a7e5d03b-abbb-427f-b3d3-1ed031dcc8ec", "comment": "Malware payload (RedLineStealer)", "value": "0ab1b5c9c84710787e4ebc733374663078ee715696f420945805fb46d6fe9978", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647705950, "uuid": "cecd4dc0-54a6-49d5-ba2e-9b98b82cbdf6", "comment": "Malware payload (RedLineStealer)", "value": "b1ac775146736e30afefb25a4614a997676dcbac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647705950, "uuid": "84da3853-fb11-4ab6-8d2c-55d71a112227", "comment": "Malware payload (RedLineStealer)", "value": "e02b0cf6638fc67ee860c5ca3a22a300b65a76a491bdbc873d9ecf54bec8005a9593ae64bff91626222f871c9ac87ef5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647705950, "uuid": "1564e2d8-43ef-49d3-a8cc-ba0d15046b1d", "value": "T19C35334B6955ABD4CAEB5B3CCF33DA0E98DEA0E4BCF6D18312274F25B1784064D248D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647705950, "uuid": "8a270880-2f03-45df-aa3d-65174d59c6a1", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647705950, "uuid": "7bdfe1c9-3e61-43a3-9db7-2306dceccd63", "value": "24576:wX1XT0HrC1qN+eyAMZvPHeu9EtIU8ZGEkEaHNYK307oy3NVzLNc6:epTuiqN+gMZDEtd8vNaqU6NVNc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647705950, "uuid": "dcc8b55f-cbe5-43a0-8ac2-1e3ffc3de8ad", "value": 1068544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647705950, "uuid": "d35a6e38-5241-4747-b0ff-772c1e9c853a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647705950, "uuid": "120d07ea-a9b2-44fd-8c8c-6eac9f41e0e2", "value": "cce7b284ee76d9a54297e2237c80d90a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c547e0fe-a729-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647655838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655838, "uuid": "bc002f0e-6a91-4733-871e-feba6c3839d0", "comment": "Malware payload (Heodo)", "value": "09c67f040058b84b38ff02b39d678db1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655838, "uuid": "fea846f7-a700-44a6-9593-7033bc509570", "comment": "Malware payload (Heodo)", "value": "0b33e8bd7fccb59be35a5da71122128f8b0a507fe01b6cf0388e8fb792fef414", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655838, "uuid": "7b0f47ac-1278-443b-99dd-51e7a3b3e0ef", "comment": "Malware payload (Heodo)", "value": "0b7e93413edc9e850777288690932b0ab3a4b1a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655838, "uuid": "6cd994f4-287d-4d29-85cc-4c8ef185ccf9", "comment": "Malware payload (Heodo)", "value": "e8556e38409bd2234736f42890ba9aafd2c48cf19dad0950f3db3ca2007b82e38b1bb0bf71c0220630f28c9d05e33c58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655838, "uuid": "a077c96f-9061-4f5a-96fd-9cc969ccbc92", "value": "T18AC47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655838, "uuid": "563bf6b8-9e21-4ecf-87d0-2f43ea6f39ac", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655838, "uuid": "edb98eee-be97-4be8-8195-478f6bac458e", "value": "12288:S54yM33d3q3Z7BogureNmF+U/9JckIAGfUeb:SKh3831BoAN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647655838, "uuid": "8d435cdd-3e1c-4e76-bde4-c9f71444f042", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647655838, "uuid": "3fe96cdb-d03d-4839-892c-6dce46efa4e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655838, "uuid": "2be2e592-3924-439c-9497-3ca4eeea5643", "value": "09c67f040058b84b38ff02b39d678db1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d02d61-a7b6-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1647716175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716175, "uuid": "de7cee65-62c5-443e-9700-c5ff39a2f805", "comment": "Malware payload (AsyncRAT)", "value": "f4d686b658afd22e11485f9c67561277", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716175, "uuid": "6db76de4-6a37-4b01-91c1-7e7022ebbf93", "comment": "Malware payload (AsyncRAT)", "value": "0b6a9da91c9ac4f629523aa199ef138441b6ece1b36ca6430f158a9d30d87815", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716175, "uuid": "aa616c86-d228-4534-9cd2-b6e9bd81bdda", "comment": "Malware payload (AsyncRAT)", "value": "38663aefe11506c933430826b4516752f1679738", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716175, "uuid": "eefc5fcb-e53d-47ae-a693-ff5c8b586a11", "comment": "Malware payload (AsyncRAT)", "value": "8d66a8a0f38056e6239b9f2d5158ecb18706b6f7d7e9b318c4c1d980233e03c8ae80c267e171d60f54e5b46f1f5beeff", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716175, "uuid": "0ebac902-edc3-4d17-94d8-10f9e72716cc", "value": "T16812C8D5D3270BA12C584D7F1C2048F91EAD5EDB46998B72D09BC7B8DB8885A33D493C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716175, "uuid": "03cd8eab-ce10-404c-bcfb-329637987d9a", "value": "48:gYYYYYYYYYYY8Iay2SwKf8k3oAuCAKekBHIay2SwKf8k3oAuCAKekBHIay2SwKf6:kbfSWgWKW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647716175, "uuid": "399fb429-2340-40cf-af48-ee7f8c62accc", "value": 9423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647716175, "uuid": "7f736059-7738-447c-a83e-248c523ddc9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716175, "uuid": "9b399752-46e6-44cb-88a7-31c3bf1ec6f4", "value": "ReleveFR6554820002.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b9d538-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648596, "uuid": "dc85dc92-7934-4c86-a7c7-f3f4529e5241", "comment": "Malware payload (Heodo)", "value": "9634465c0a8c5191e272ebe53656c5fa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648596, "uuid": "2de0d958-7bfa-452b-9adb-0721e52b2bde", "comment": "Malware payload (Heodo)", "value": "0baa00482447a53ca7b3f8c0ad289a80848882de826eb96712ebe402b370b292", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648596, "uuid": "81ddb17b-78f8-41d7-aaca-c1c3da089e6b", "comment": "Malware payload (Heodo)", "value": "6d33a3a345e13f82c65de58c75b04178ff214680", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648596, "uuid": "da2bd11e-e407-4f2a-8901-75e07d917fd8", "comment": "Malware payload (Heodo)", "value": "3e3c135e3b31ba4a2df2b9e56dc918fd26497bc20b4ffd8f841afe4354bc33ffc5674b910385fc3d73902698d2483857", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648596, "uuid": "34f0ad26-8638-4a40-acde-4bf3d336cd56", "value": "T190C47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648596, "uuid": "5c6c7586-a401-4d51-a885-a04dc4dd1220", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648596, "uuid": "9a20e36f-026f-41df-8509-af8b5e950ab1", "value": "12288:S54yM33d3q3Z7BogWreNmF+U/9JckIAGfUeb:SKh3831BoYN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648596, "uuid": "1937ec33-e888-480f-a539-916f415a8081", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648596, "uuid": "2b6c9e61-1839-470d-897f-f8c184a4a8c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648596, "uuid": "8e8f2174-2ec7-4bb2-9f4f-8968660677e9", "value": "emotet_exe_e5_0baa00482447a53ca7b3f8c0ad289a80848882de826eb96712ebe402b370b292_2022-03-19__000950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7542bf79-a75b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647677179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647677179, "uuid": "2bd7d59c-eccb-438d-a213-3a4e8c68c270", "comment": "Malware payload (Heodo)", "value": "00e58554013a290ca9e2c14e599a2135", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647677179, "uuid": "323b8526-385b-46c0-8fa3-7182ca3ae2fc", "comment": "Malware payload (Heodo)", "value": "0c667ef0eb3b73e716115a2b4c7d6007c4fc877446a02cd9a66fb20ad5bcf358", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647677179, "uuid": "c6cbb998-c139-4587-bc4c-b3a1592a205e", "comment": "Malware payload (Heodo)", "value": "66f2e5fd02e2e03e72bcb43a9ad66ecd01c30f5e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647677179, "uuid": "0f63a60c-b74b-4c1e-b749-d8074941472d", "comment": "Malware payload (Heodo)", "value": "da9a8cda83fb2af5ffa32736b4f2bc4a4dbec4c31246a1f2aaa9bd6df86c576a03cb7ded19bff5e95d054a6ce0069a47", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647677179, "uuid": "14f8e5af-452c-4b50-9e26-cf5bedc36517", "value": "T12B03AE30F2D28E99E53A943C878CE9F593288F525181BF2C30D563BC5F526B56B8E24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647677179, "uuid": "113b9162-d2be-4f90-b922-7f9b688646a0", "value": "768:idUCR8xZ5jOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIy5:a5wXOZZ1ZYpoQ/pMAeVIyMId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647677179, "uuid": "ac04c53f-12b4-45c3-b666-0a7021b08521", "value": 39699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647677179, "uuid": "10e0a8d8-3fd2-4b1f-b456-34dc011dd729", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647677179, "uuid": "263ffea1-d929-4377-834f-a0662359f479", "value": "MAIL-115827.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31541859-a744-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647667186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667186, "uuid": "1ac82ba2-873c-4f9e-a030-e59bbd5951c9", "comment": "Malware payload (RedLineStealer)", "value": "9dd4dbd734c22e5c2529c6b3499b9810", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667186, "uuid": "09315870-9602-4f13-a19d-5a374f154d6d", "comment": "Malware payload (RedLineStealer)", "value": "0d406e492d0879dc501507c610332d8db948b5d8e2df05822cf74710f4063bbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667186, "uuid": "1400a5db-e508-4f88-88db-47be8bc0998e", "comment": "Malware payload (RedLineStealer)", "value": "08b2c02a1be24fe6bad1c0deeb9861aee549dc02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667186, "uuid": "582604d6-e210-4883-abd7-7ce1cc7f5b18", "comment": "Malware payload (RedLineStealer)", "value": "57459588f0b0da260a070d819e55bf14384e81ceb674e4fe6de0c9d5ba1dfcf0c6829f7bb49d6f45921ac0b7e330d183", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667186, "uuid": "e7401a92-6eb3-4d75-91d6-7690e8182ba5", "value": "T120C4237772787406C8CF3FF0B36CBB99AB5521789DF0B5647252EE464A8A0C1E6244BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667186, "uuid": "cb440ca6-ea01-43b8-b212-dba07ddd2515", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667186, "uuid": "c7176596-ebaa-42b6-b5e0-962e95ad4df6", "value": "12288:X3UccEdS3528Nru5t8pu1maQS03ULaHNqrxlKIQNo0EqolY3NVzrEeB:0wdzt8pamakEaHNYK337oy3NVzLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647667186, "uuid": "1fcf2ec0-8b39-4874-9017-e0d06d4913f6", "value": 592840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647667186, "uuid": "d22512f8-c673-45bf-b21d-cdd1c40bb63f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667186, "uuid": "8e5077f3-3b48-48b5-b6b4-63da2df5afe8", "value": "29162785.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37852b75-a71c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647650017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650017, "uuid": "9989edf7-b773-4234-8d53-a15695b09227", "comment": "Malware payload (Heodo)", "value": "fea015108aeb75569adf5fd44a5d5126", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650017, "uuid": "cf1f92c5-25b1-4825-8191-9363bb6c0ccb", "comment": "Malware payload (Heodo)", "value": "0d4bd53121788223566bdd7fe6017f6fce2e50fbcd26e616eee76f9707158006", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650017, "uuid": "39ebf60f-244f-4259-b3a1-d4a6f4c98079", "comment": "Malware payload (Heodo)", "value": "d66837e75c82671478732e4e2aaff203f63be59e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650017, "uuid": "90055795-9b6e-4207-9c3b-1e8ed62b27e7", "comment": "Malware payload (Heodo)", "value": "3acd87198b01342458972c122d9bc21107b18c6626968b3fcc82a48d6d993217f3de802c7a35ef4f6d27445839c740b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650017, "uuid": "6de9a831-6b9b-4cce-82df-e5b6aa91eb02", "value": "T199C47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650017, "uuid": "9f977924-6b82-49dc-a8c7-103e904241cb", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650017, "uuid": "fd262e49-f08b-430a-90e9-b37442d03248", "value": "12288:S54yM33d3q3Z7BognreNmF+U/9JckIAGfUeb:SKh3831BoFN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647650017, "uuid": "f5e716c6-ad96-4a28-9a3a-f04bddc2bf0f", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647650017, "uuid": "03784546-4d41-4232-a8eb-9800d310fc5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650017, "uuid": "db3f847d-ba19-4dd4-a5e5-57071a1497a3", "value": "fea015108aeb75569adf5fd44a5d5126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d0f0f7-a741-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666231, "uuid": "00cc0748-4903-444a-abfd-db840a640eec", "comment": "Malware payload (RedLineStealer)", "value": "10fb07985be6c8f08447e8e1e23717ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666231, "uuid": "8e00ab62-4b99-4a5b-bd69-80888b728b2e", "comment": "Malware payload (RedLineStealer)", "value": "0d8ed2c3adb568ac0630b572ac4c79f1023a7266c1bb2c4e23f7dc7467781d86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666231, "uuid": "39b8cc86-9e14-4df4-8352-92478e2a8e35", "comment": "Malware payload (RedLineStealer)", "value": "5ddbfbdd09db3a2969ede403990d7a9673c8d18e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666231, "uuid": "8ce7eea2-6399-4f62-865f-ad81bc58ed8d", "comment": "Malware payload (RedLineStealer)", "value": "48f97f4158ce4eb43da9f9f49a7715cfbd8862c1814925d60bfab250171539e08cc07595e19619a2637013a31dbf85ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666231, "uuid": "00780198-1e72-4122-a61f-a11dfc44edf4", "value": "T18375334776CCDE74C70A7275F7D4ABA15DA8C6EF2DF0959924DF2383261D08EAB18028", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666231, "uuid": "b46bf592-d450-44f3-b9e7-d496a383c0fa", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666231, "uuid": "246344de-ec4d-4d3b-b9e5-1a2caa7ddad0", "value": "49152:OR+jvYGUAbt1mdf/lhbm4St/LlfvcNai9:rjXXbDmPxzShBch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666231, "uuid": "ab1a37b7-a14d-4944-a56e-64ce262d6239", "value": 1694720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666231, "uuid": "f9b04e14-ad4a-476d-afe9-494d2eddc59f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666231, "uuid": "69a0e559-e44e-4b63-bea3-a461bfd8192d", "value": "21828336.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea67371e-a744-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647667497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667497, "uuid": "f92a6327-5639-491d-a80d-e952b6e4a70b", "comment": "Malware payload (Heodo)", "value": "2118eb9d729d8966c968ff12bba84745", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667497, "uuid": "9eb121c4-2b65-46fe-a8dc-8c8e4f1fb586", "comment": "Malware payload (Heodo)", "value": "0e72c304393d92d4958eada21e9283d1a2073fc7779f718e119accb21bcf03c2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667497, "uuid": "2d861685-9f94-4c34-9a2a-2b54af1f9a7d", "comment": "Malware payload (Heodo)", "value": "086d86103aff411bba7f301389dffcf61bb29d6e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667497, "uuid": "71bd67e1-5b98-4faf-896d-f7bbad800e8a", "comment": "Malware payload (Heodo)", "value": "c54f02be0bda22ae2729cdc99a8d19fa7010594784c0483c000205dab836d2a395a83e1bc2e185fa2198a12408151aba", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667497, "uuid": "22306a79-fcda-4f8b-b49e-da28a47ecb16", "value": "T11C94DF007AC6C433E1AA063949A7879467FDBD52ABF5C74FAF807E4D5E314828A35362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667497, "uuid": "9c3e3144-0792-488d-bd18-ddeafbd81cb5", "value": "60acb5dbeebc778b5879492b3afca208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667497, "uuid": "cdf017b3-c9d0-4410-9572-b13aebd1846a", "value": "6144:aH0RW81UplEIb6hRAOf6DXyhCra8VCtS08OB8xS4GE/mFCo3QkgqbqAT:tFpMOfeihCraeuiS4zCCo3QkvqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647667497, "uuid": "3148112a-b3d8-4ab4-9e32-efc8d6728295", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647667497, "uuid": "4e7645e8-37a0-43f9-988b-5876897e5bd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667497, "uuid": "8eb19f08-d578-4522-b7b3-5867bc9bec6b", "value": "emotet_exe_e5_0e72c304393d92d4958eada21e9283d1a2073fc7779f718e119accb21bcf03c2_2022-03-19__052450.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95dfeeb0-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "1825e289-eb62-44e4-a389-97eaa78b3c90", "comment": "Malware payload (Heodo)", "value": "33803aaca1a1cb9cd99f7eb54211dfbf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "216e4793-dbfb-4d25-9217-e7746e269277", "comment": "Malware payload (Heodo)", "value": "0fe94d2b572cec258f61cff3fd0c6db7675fbf45dbd0da7e7d5a23d126db0f68", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "15e43636-a8b4-4385-bbac-ad72025bbfad", "comment": "Malware payload (Heodo)", "value": "c9fdf51868fbb844dc783309efa89003a118cea6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "3634a005-5ad8-4056-a010-2a43d05dab94", "comment": "Malware payload (Heodo)", "value": "752fcd573646ae18943157f0e1ab27467ae1f6b9d97745d9572a52f3d230289a0ebe3d3354439a71dad1350535a2afbd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "00e412a0-da4b-48ae-94cf-2f11be5eb118", "value": "T14ED45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "f2b3d840-8e3f-4294-8a67-4a20c096a9cb", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "1c938491-0bc9-4671-8611-509c5387f3db", "value": "12288:UWBpwupxl0OeL/grx+GzO+r9AjCb/XKh:Psupxa/g12mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648457, "uuid": "bd97b737-7c32-42dc-992a-fb82b01cdf92", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648457, "uuid": "dff763a2-180f-4dd0-87bf-ce48e123bd16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "e1c63c0d-69c6-4b75-9c66-4b6e02fa206c", "value": "emotet_exe_e4_0fe94d2b572cec258f61cff3fd0c6db7675fbf45dbd0da7e7d5a23d126db0f68_2022-03-19__000730.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c3249d-a7af-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647713423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713423, "uuid": "1a89b670-1f7d-40a3-b0d5-32edfc83d690", "comment": "Malware payload", "value": "7c68bfcb0f96a558faa4e55cf8ea7c0e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713423, "uuid": "8a33e2ba-b157-4b3d-bc37-5c5020fa4875", "comment": "Malware payload", "value": "11ac99bf5c1569b02c9ce7eeec465c69a75c7031ab19aa1fa071c810c92e03cb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713423, "uuid": "0bea7d7d-e949-46a0-9c8d-6fac307a7113", "comment": "Malware payload", "value": "31f27e8ac3d896414f42a9fc07233e432be8528f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713423, "uuid": "9513d85a-4505-4700-b947-bc8d189f5d32", "comment": "Malware payload", "value": "a1db25e1afcac6da60c3525769cee53e663ccb253fd3c3f59bfe3e2ce0aede50e574e3808d4b418ebb9365b9dbe92aee", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713423, "uuid": "e3f14a3f-d071-4e5e-a763-4e6d6d4db737", "value": "T137131841BFDA9600C0C011B6EE3B874A3265C3D8E5DEAF578E3697041983459AFEBD58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713423, "uuid": "5de9a970-6ad2-43be-9be0-4d2008dfdca3", "value": "768:xwEWrvxX49pplqoPgYbUmzQFNrS3NlUZyxoaGpQr8pYj7x/:x6cBqg1ZlUAOp28pYnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647713423, "uuid": "3976ce25-ef02-45e3-8004-2c88d90ada83", "value": 43572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647713423, "uuid": "3b6ea4e2-1059-4247-8c9a-729b4dcda859", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713423, "uuid": "447dc339-039a-4a90-92b6-1cfec500e31e", "value": "arm5-20220319-1810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb7f50e2-a7b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647716408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716408, "uuid": "09bbeb24-cf16-4ffc-a267-17ad31fdd3c1", "comment": "Malware payload", "value": "ecff1f46a59846ee8c985a3902cc9d45", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716408, "uuid": "24342f07-ab9c-4187-9ff7-450474ae5cb6", "comment": "Malware payload", "value": "1242bf5f2c5b7a75d26a7e323c75b78e45e6900ab8a52a31ee39c3543d95c0e6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716408, "uuid": "fcb29882-c198-4a78-83c0-a7ecab59b12d", "comment": "Malware payload", "value": "9e1b4e93a1bc473d6e108fe830c4e81023bc47a2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716408, "uuid": "a74e3014-61b5-483c-924f-6469b6d8626f", "comment": "Malware payload", "value": "87ae857403ff6f7bbbbe2aa8fbfaace4cfee121890af953954cd16b9c3ef7e44730fd214eec773e79e56be29f84da2ec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716408, "uuid": "46b84d69-2e5e-40d6-b165-ec067bef196c", "value": "T16632A5D6B9428A17CAC49237FB0E838D7F26670CF2EF33036B176F5065579270A6A449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716408, "uuid": "2a4f8a05-4915-4810-bfa0-d75efdbb6a1d", "value": "192:q2fx7odDX6HwHs5wF9jrr6OyTgev5+VG8bWJHb5B08kEZx4e4x:q2fGDqG59jrr638eQETB08Fx4ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647716408, "uuid": "b32d4ae8-c3d1-47ec-a15d-bc75450747e6", "value": 11820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647716408, "uuid": "b475eba4-aefa-4676-857c-9abf7e85eef6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716408, "uuid": "2a54af95-0d62-43b7-b5a8-9dbb4bd5fd99", "value": "Y29kZWluZQ.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c013da-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666551, "uuid": "7a7b0e23-463f-4924-9f12-b24c02a7aadd", "comment": "Malware payload (RedLineStealer)", "value": "db16787ae4fb67e2eead360c7cf1d2c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666551, "uuid": "15d3c903-565a-4685-b61f-0c3a79d0f957", "comment": "Malware payload (RedLineStealer)", "value": "12933baf023a0176da32539c3f9beb725ba07ecb72bf51d483803841e1a19808", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666551, "uuid": "23e9ec17-1814-4201-a42b-51225411ce52", "comment": "Malware payload (RedLineStealer)", "value": "1f9977affaf73a1964f08134e00001f46b022cb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666551, "uuid": "bc9f2bbf-e31c-4d65-8568-a712c69ec3c5", "comment": "Malware payload (RedLineStealer)", "value": "15b818a7cdcc54401687b70f81f5dfcccedd7d812770f748e7eb631116782d17dd0a33d0e866422dbbdab4225e80662c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666551, "uuid": "8a38c826-6a61-4cdd-936d-be316f80c2a2", "value": "T1F63633F50AD570A5C71E343C4982D34BB98DA594AD3F02B2D9318A109B8C7F43DA76AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666551, "uuid": "a6ea0d3a-887a-436f-a0a5-11b970f93e0e", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666551, "uuid": "bc2939dc-e6b6-450e-a8a7-a91337022339", "value": "98304:AZ3Rhc+G/uiYRUuWPDSUC+K0PoqZMYZ+ERyVewSWj5ONlZ0:s3Rhc+aOWuUCh0PZ5+ERyBSsUZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666551, "uuid": "e1eeaea7-b50e-4c8a-8eb8-b99d9062b9f2", "value": 4899328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666551, "uuid": "475210f5-bfdf-4c41-b8cf-7566341c17e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666551, "uuid": "a6f28e66-c5ba-4ce2-a2aa-f8a2417b6056", "value": "24329689.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d851f8f-a7a5-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1647708868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708868, "uuid": "bd98b758-b25e-4253-bb69-a9f9420ad5fa", "comment": "Malware payload (Vjw0rm)", "value": "69f29cd9961eea44bdf9ac54d34dc1c4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708868, "uuid": "47de9121-bfbb-4a0e-87e5-60dd956d5a11", "comment": "Malware payload (Vjw0rm)", "value": "14516968b1e01bd308c319bde2d4cdba32bf37f07d9e5f003ebc5b1bb1059d71", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708868, "uuid": "c7e3a026-e7e9-404c-89f2-11831aea8737", "comment": "Malware payload (Vjw0rm)", "value": "8b603318d383c298e6613fda82f15fa88cc25fa8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708868, "uuid": "5843c1c2-053d-486d-bdf3-14586fb33fed", "comment": "Malware payload (Vjw0rm)", "value": "4db799730ecf6c83efe4635d222d58af4cc903cf8fa6dbbe9f13cc61e85c5521158399a5aa6c74d6121ef061706e93a9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708868, "uuid": "8bf5209a-47f0-4613-859a-1b7c0d87ac6a", "value": "T1FC3239D9DC48BD8DC724A1406AFD9CC82FE9524B8440A75E383D71859730994E6DE3FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708868, "uuid": "e78bab5b-b0c3-496f-9ec3-54b46a08a459", "value": "192:Xr07IacDqGaJsh+lCg9XNAqx/VQIQgxgfgozH/KGEJpmRwAxYMKnBJhzyw0KvnKw:bBDLUSqxtMwt9uwBvK4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708868, "uuid": "2d897e1a-77c2-4eaa-b580-ea4b8715eda0", "value": 11862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708868, "uuid": "b49730cd-c225-4a8c-9642-b07fe9492035", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708868, "uuid": "cb3c8589-6ef8-4a52-b1c3-0f34ffce22a7", "value": "order_receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c2164a-a743-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666825, "uuid": "5156ce21-c2c3-4ed6-ba00-d9803e77a01a", "comment": "Malware payload (RedLineStealer)", "value": "5b7e7794fdc36ed43d4104ce06585c22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666825, "uuid": "57d3d56a-1873-4a88-92f3-08b4ae73faf9", "comment": "Malware payload (RedLineStealer)", "value": "1522a715bdb622b3a170fb6a52b932182ef3c10bcc3707ff2c6c830ca9a00578", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666825, "uuid": "e213fa4a-53f9-4c3c-bd2f-35a518538f47", "comment": "Malware payload (RedLineStealer)", "value": "736a9c9dbf9cb087604cd8e6697586c0f84a0159", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666825, "uuid": "9804de47-ceb6-4081-9b27-29d778d13fa3", "comment": "Malware payload (RedLineStealer)", "value": "1baef97e5b52d9ab138956a0c9b5aebbcaeff8397dbfb4f3cb34fc70416acaa68944f02e25f6d083880def203a9e6846", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666825, "uuid": "d1a9244a-9432-4504-ad06-2c50460849f9", "value": "T18F3633F766D13508C1C11BBA2AD3D63BD8553DBECC9856C263D948E89370B9A4B28C3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666825, "uuid": "ee1f27a1-4c4a-4c72-a622-6461683c709a", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666825, "uuid": "0bee0c67-ad98-40d0-9482-02ccc13fa8ef", "value": "98304:onPSkHAU8JofATkUw/c8sMaDxrWGiyztCpv1NxP/dvFF2MM3ELDX9U/H0xg:oPH8KYAAIlyzw1kPp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666825, "uuid": "4dc22de9-7d7b-43c8-a5d8-46cea958464d", "value": 4896048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666825, "uuid": "8a2aea3e-60ad-4e21-8f0e-a7e839c41405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666825, "uuid": "d48c7f01-eefe-4c98-8049-9a23f4ed4f32", "value": "27144102.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5553c89e-a744-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647667247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667247, "uuid": "06fb1c77-4920-41ee-ae0b-a59d0dc36570", "comment": "Malware payload (RedLineStealer)", "value": "17ba7c90ea6a1fc3855577effcae9e39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667247, "uuid": "4b371893-fa70-4ef5-ad62-5086e6c0ac49", "comment": "Malware payload (RedLineStealer)", "value": "1587827da79a0bd010b8da9683d966ab254988609b90a19e1f679caf18111880", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667247, "uuid": "7add8f06-1168-4f2b-b099-379a13ef3dc6", "comment": "Malware payload (RedLineStealer)", "value": "ac3a34fb30f46887858a01dfef39c609860dfd2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667247, "uuid": "b428fe40-ab90-4815-8452-a45933e2bf58", "comment": "Malware payload (RedLineStealer)", "value": "8da43d4ff2c7e36947bc038b3baa17bdb9d25c9e7f778b997199f3b3f350ac44235dd0245065af27ea0f5d3041ce178f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667247, "uuid": "c47f082f-08c3-4b99-93f3-0de1938bcafa", "value": "T1E126331631103E96F2C487F8B99B276DE972198DC881C6CDE52A1DD3A1BCEC167E11A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667247, "uuid": "0f70a158-8052-4c3a-8458-dcb2c70b5732", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667247, "uuid": "c785fd5b-43eb-4079-9971-5b1d5da39454", "value": "98304:oRBiP/+jCQJFuqawUyzupMzS63dd5rLLsDwEeZ1RcifvcsUGDysKF:pGjlFupw9fzSYT5rfsDwEq1iiciru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647667247, "uuid": "a7d5919e-a507-4540-ad99-7f5bfa0e0dbc", "value": 4547584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647667247, "uuid": "2bd9151a-c0ad-4b13-8627-3b7b4e0ceed8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667247, "uuid": "65649da0-7217-4af9-adba-47dbe7a4cc05", "value": "29472307.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20a2bd9-a7af-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647713412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713412, "uuid": "d3c2168b-86ad-492a-99ca-40761f46696d", "comment": "Malware payload", "value": "c8ac99629d656af63c1e356d0cb60431", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713412, "uuid": "8bf1a6b3-cb91-4db9-bd64-ba68129ef65f", "comment": "Malware payload", "value": "15d177d32f74e40a926a4f2eba6f28f92683c7eb98ac3ec708f65339e7fb9fdd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713412, "uuid": "d5fe2cdc-150f-4ef8-99ad-9dafccb2038f", "comment": "Malware payload", "value": "bcd0221165315e9ef60849f8fb43964d6c74535b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713412, "uuid": "cfb454e0-2b0b-41a7-a5da-98e81024a1b2", "comment": "Malware payload", "value": "deac5431bafd528c72cf18b74db274fecf9395e092bda4f9b0bc2b2fe588096ee335b5f105117f6d906ea6b3707a49c4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713412, "uuid": "5f704194-fa79-4e59-92c2-29c81ebe8696", "value": "T17D53A4497F21AFEDF218833487B71B35D79822D166E0D6C8D29CF5051E6031DA4AFBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713412, "uuid": "d86267a9-9747-4ccf-b527-9998df94ae22", "value": "1536:CNIRncXsj3irlaZ3jd3jj6jQk/CWUiatxbsiLS9c8lUAtu/Eeng2:CC5urFCWUTbsiLSK8lUAt2Eyg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647713412, "uuid": "5490b3f8-864f-4611-9d4a-c5ebdc6d0b8c", "value": 64956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647713412, "uuid": "13087ec1-d674-4680-b7a2-8b533718c3af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713412, "uuid": "f521c2f9-e658-4aab-8cd6-fa40bdd3ddec", "value": "mips-20220319-1810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0715a0b7-a7ab-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1647711354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647711354, "uuid": "fd595f27-03d7-40f8-887a-e1099b7cbee0", "comment": "Malware payload (njrat)", "value": "37fd70d27ad36d7d9c92a7be195c1464", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647711354, "uuid": "193c3e8e-76ab-40c8-91c2-df0298060996", "comment": "Malware payload (njrat)", "value": "163f0f159705867530e310ee48ffb66a057fba8a236ca2473c3de1d2f9ea48c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647711354, "uuid": "d7cbaf1f-7824-474d-94bd-53c929014033", "comment": "Malware payload (njrat)", "value": "62c739d4d126a3ff6f9d13987c527cb8d44cc376", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647711354, "uuid": "9804c9ed-d97a-4e9c-9d9f-3e314d88b4a8", "comment": "Malware payload (njrat)", "value": "d8b96da79af364c690f2592a50e35ac2ae584732a4c62ba577fbc699ff138980d2aef840a052aa835d08e912a0f887ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647711354, "uuid": "7c363595-9f33-4591-b703-a1b891ebcaa4", "value": "T1ED25230D7FB7D911C68E2A31EDE642A0DF359D232602C7EB7912376B8E770025D166B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647711354, "uuid": "e3422724-03db-4441-993f-5a2ad2682acb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647711354, "uuid": "5d95536b-ddad-4c0e-a286-5d62371fe226", "value": "24576:3vyhswO3ySphmzsfl3zA12aoxbLY/N2l2hZtLj:3vyWwOiiYzstG2a+HWUl2hfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647711354, "uuid": "000c889e-93c7-4d39-bebb-3419f78f249a", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647711354, "uuid": "9d896c09-cc88-4e82-8544-777cf50fdf08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647711354, "uuid": "e6f5f790-b2af-4e4a-88e3-01f62b89a8d7", "value": "37fd70d27ad36d7d9c92a7be195c1464.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9438fc-a723-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647653109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653109, "uuid": "6b56287f-1336-43a8-a6eb-19a82d2ceed2", "comment": "Malware payload (Heodo)", "value": "d97d0962adeb0f7e04ef398482e26322", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653109, "uuid": "b04c5ddd-094d-404e-950b-7337ccf144ee", "comment": "Malware payload (Heodo)", "value": "167e4869ac7ea296268f75a5deda05d0661956ced492a6ac29710f074aec3c31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653109, "uuid": "453295c7-5edb-4782-b2d1-5a26f84ebebb", "comment": "Malware payload (Heodo)", "value": "3a3df8b5f8f756f35b358f742a14b4aa866acf3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653109, "uuid": "c0ae1aa0-1106-4530-8822-5f6dbf5cc6cf", "comment": "Malware payload (Heodo)", "value": "81baf0e06da77ffe80498c51de37cb331ff5d87ef10bafe92275b7a0d995b5a869bdbe48d7b3690e4c3c55209e0f6e9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653109, "uuid": "7f596db5-899e-4764-bda3-cd2c7f042c44", "value": "T142C47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653109, "uuid": "8b4d8b69-9511-440f-9e2e-3fd2a97dd01f", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653109, "uuid": "ee2ac754-8847-4e39-93fd-414f37a7a959", "value": "12288:S54yM33d3q3Z7BogRreNmF+U/9JckIAGfUeb:SKh3831BoTN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647653109, "uuid": "8bbd6aa6-b3f6-491d-8564-b85e6cac4f0d", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647653109, "uuid": "8a5d1a35-28eb-4d2d-8d08-b3e2b4328654", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653109, "uuid": "d8f92cce-33d9-4f3b-bd53-34bf28a98b77", "value": "d97d0962adeb0f7e04ef398482e26322", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c60983f-a71c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647650025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650025, "uuid": "308acee8-9213-4fa4-a988-877d6372f887", "comment": "Malware payload (Heodo)", "value": "5eda9f207bd1dde5f40e44bb2b9d6760", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650025, "uuid": "163b89eb-7698-41b4-98b8-daf9d53783bf", "comment": "Malware payload (Heodo)", "value": "17e2ce7168b9a8bf19c657de8eec9380d2ff2a0191d446268958e6933dc8de5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650025, "uuid": "4d39f095-e68a-4782-a3b7-73083959a9ec", "comment": "Malware payload (Heodo)", "value": "627488c5147ee061d4697e6b0eedba7da859716d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650025, "uuid": "0b0eff7d-1f86-4ca3-92ca-45a8b4dbd39e", "comment": "Malware payload (Heodo)", "value": "b12445ab69ff07367bf105b053b824684af4b402274a219462a28ac38ae5c7f700ae351eff72c8f7334bfe30622910c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650025, "uuid": "574e255c-6ce5-467f-9d0f-a66e22154b9b", "value": "T184D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650025, "uuid": "37e66a66-d00b-4a4d-8657-819d72bf81f3", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650025, "uuid": "69a26895-54b6-446f-8635-d88df10e9449", "value": "12288:UWBpwupxl0OeL/grxaGzO+r9AjCb/XKh:Psupxa/gt2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647650025, "uuid": "f525a6b1-7b2d-4120-9ce6-afe71e410503", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647650025, "uuid": "a55d204a-e8ec-4c13-b610-49bf4e3ec652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650025, "uuid": "fd638ed6-e3e0-48a6-b17a-bd3042f41df2", "value": "5eda9f207bd1dde5f40e44bb2b9d6760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca4c58b-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666427, "uuid": "e977ea20-7f1e-4d63-b838-b95ccbd72e59", "comment": "Malware payload (RedLineStealer)", "value": "4b09cd845b2053f0c6193d18854e4b2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666427, "uuid": "a6475160-a3d9-4a0f-8f21-cd3e6dd6c733", "comment": "Malware payload (RedLineStealer)", "value": "18d3c86e8cf3eef27c596430279fade1c4c46b3ed4e59de2912ef2c803e13e32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666427, "uuid": "1d16b1b2-c692-4714-93cf-c24d005f1c57", "comment": "Malware payload (RedLineStealer)", "value": "50af59e26957c27fa5166908b62b06e8ca33dd98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666427, "uuid": "3ebea920-abe7-4dc6-9eb9-862be6efe9ee", "comment": "Malware payload (RedLineStealer)", "value": "95a9796bfa03fd494e42210e29f80d0ae5c3596bbe60beeed92d546d76dff9da531adc76c8ce716cd739100df362444c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666427, "uuid": "99f3464f-7f20-4c06-8da8-c0776a403ffa", "value": "T137C4237FB341F64EC08E13789F717D8F850E545066E83887D2661AADF86814AF39E238", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666427, "uuid": "cdf495ea-0e12-445f-a637-cb2269a8eff5", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666427, "uuid": "85d6f394-cc94-4773-83b5-1f7dd5bea266", "value": "12288:orpHlBlAWvfdTlnzbIQQS03ULaHNqrxlKIQNoyTC+K5DyoxjFrUba:orpFjAITZDkEaHNYK3++K5Dyox5Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666427, "uuid": "cd895e6c-b38b-43a7-8397-a861a41d8d6c", "value": 572928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666427, "uuid": "dfdd9ef8-53da-41ed-9434-db09503941d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666427, "uuid": "965ea53d-48ee-4961-a4d8-73d5cdfda416", "value": "23561503.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe78af89-a75a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647676979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647676979, "uuid": "13a8e1b5-8a19-4837-9fb1-c8d28c67441c", "comment": "Malware payload", "value": "15550724f6976222b35862580a9de736", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647676979, "uuid": "cc142ae4-58f2-4779-88c9-a97a57e07209", "comment": "Malware payload", "value": "1ad01131d1c18e2d5afc81d9392e200ee19f02e4367048b10f440704962f2f0e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647676979, "uuid": "1e31682a-42d8-4dde-9ff8-6d9ac90202b0", "comment": "Malware payload", "value": "9c18de379a8c0901b04732f8bcb6ff3f18e129db", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647676979, "uuid": "9133a5ac-4881-4956-9295-14da8126bc7e", "comment": "Malware payload", "value": "d21154db3326c9a79eaa368a38dd0574b2863551eab6b53bdfe45b6f1c6ee2810cbb9983f93279a05c99287becf24183", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647676979, "uuid": "69942971-c3d3-4bb6-a540-53e00a907b16", "value": "T116862287F31D946FC9F715768D3A022506975C2A0683ABE32D54732C58B7AC06F6AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647676979, "uuid": "2e937d7d-c091-4d23-a61a-d9a663fb60ad", "value": "196608:f1k7pRYh685j/QPr6w7cHsCeoUyUFWSjacCsk1ud5g:C73YhN/QPsMDoUyUESjTfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647676979, "uuid": "d5767b4c-ed96-47fe-af4e-6a3258c27a84", "value": 8510658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647676979, "uuid": "48fa0eb2-af03-4fd3-8d1c-8b6388585785", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647676979, "uuid": "b101d6fa-605c-4074-b852-1b2e92671b45", "value": "Blood Pressure Diary.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ed7514-a743-11ec-9275-42010a9c0029", "comment": "Malware payload (PhoenixStealer)", "timestamp": 1647666976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666976, "uuid": "da712675-aa74-43e6-bb1b-05aafff425a0", "comment": "Malware payload (PhoenixStealer)", "value": "d6400095bffdf07603da238051f31bd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666976, "uuid": "2301ab3a-b11e-4be8-888f-6daac1b9c849", "comment": "Malware payload (PhoenixStealer)", "value": "1c524c438438a2998e6f47513a8b639dc7f9c1ea649085bea77b2509f5e62dd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666976, "uuid": "bec6621c-f531-47a3-8eca-47b3c8980850", "comment": "Malware payload (PhoenixStealer)", "value": "12d517d298cff39d493d1de9e6da6e24c0b4f5ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666976, "uuid": "384bfbbf-fc5f-4b2d-826b-89608553e4ea", "comment": "Malware payload (PhoenixStealer)", "value": "150cd65bf85816cdf953c7ba75114cd7e65aca045228273e9d07af7efd3aad89fffc555e360c173bbab46d80aec416f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666976, "uuid": "a1a260bb-36c2-41b9-8476-6d172f696d05", "value": "T104464AF1390AA2DFD1AB44B4E856CE03E42D53F646249801DC6DB8BEEE93D8515CAF1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666976, "uuid": "0fa957cf-1623-46d0-b406-2944c42eca50", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666976, "uuid": "1eb19485-4965-46e6-a70d-d4b62596a5a2", "value": "98304:F+I53ziFnREI8AWlOe9GHa53EsOsLObV3BjrNKqe4SZiJ6Cofxo:F+g3z0LY3EsOskAqAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666976, "uuid": "629b2e4c-606c-49d6-aa97-2151ac668284", "value": 5494784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666976, "uuid": "f661330d-8512-474e-adf9-999584d3c2cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666976, "uuid": "b9ee201b-7f8e-4a6a-9fdb-07dc9dcd4523", "value": "28166889.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fabda9bb-a7a3-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647708326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708326, "uuid": "508411d3-1f27-42aa-b8a8-689f0b336979", "comment": "Malware payload (SnakeKeylogger)", "value": "1ec6a6b4e24358129923ea845c826565", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708326, "uuid": "07701a1b-c7a0-4f95-b375-66ba27c9b58e", "comment": "Malware payload (SnakeKeylogger)", "value": "1cace7cf34d0805e581064e7366a708a9ba652f81bbf2547f188ba1362b928fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708326, "uuid": "d5c28607-3452-475b-91c8-36af6f9cbda8", "comment": "Malware payload (SnakeKeylogger)", "value": "14b6fe5f6f4d12ff1cfbaebef38707465f2c8497", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708326, "uuid": "a35295b6-94d5-4a75-9b35-c6fcced6c364", "comment": "Malware payload (SnakeKeylogger)", "value": "85bb827c9b5a590f81da21b96d31622c960153f379deafbbd9c9154b25b33426a68d7b9cc8e516589db6a9ce10f561bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708326, "uuid": "e5bbf09e-541d-4252-9bdc-222d4da39623", "value": "T1E125ADA83E047ADFD817CF31C9991C6CDA9324672B07D13751631ADB8A0EE97CE251E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708326, "uuid": "53a77b8a-1e0d-402b-8fe4-bbc0a47514d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708326, "uuid": "ba67de7c-8797-461c-91ee-1530cb80f139", "value": "24576:HGJ+z84uFMXMV+St1TC//8dEv9X2sbk4+dHaucyhzAz:mJ+PSDQ//WkkdHaMhzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708326, "uuid": "74b4c703-fc8e-4d86-b137-77fbe5679d5d", "value": 1027072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708326, "uuid": "8acdacca-668a-411e-ae3a-a703e649b67e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708326, "uuid": "df798deb-5018-4fd9-a5f3-18cf0ebfb235", "value": "1ec6a6b4e24358129923ea845c826565.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f32f6e-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "849df4e6-4a82-473e-b03f-f7bdcc8a7e9d", "comment": "Malware payload (Heodo)", "value": "490cee9781c3bb5328b02a05d4b5c984", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "cc09eaa8-fe59-483e-8da9-78154ccc1dd4", "comment": "Malware payload (Heodo)", "value": "1d3b38ad2917127722eae5acc3d9040e97ed2d62696ac5086131398e3b455159", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "33daabb6-cbd7-49dc-82be-18e941523979", "comment": "Malware payload (Heodo)", "value": "4add7fbe4662a2867aa64e1ae64aa1a85d1d065c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "850a0330-99ea-46d3-94b4-903ff63033ba", "comment": "Malware payload (Heodo)", "value": "c15a0619e384265264064c263a2b93dd4006c24548c2393292c98e466555b7fc208b1882f99bde71357a515509fbcdba", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "0114bc17-d1b3-4301-8b0a-73483dcaae0e", "value": "T1AED45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "2f2e7798-5c33-412e-add9-dd9c41946d6b", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "8ec4f38c-7ac4-4c85-b88f-7e8ff59da890", "value": "12288:UWBpwupxl0OeL/grxeGzO+r9AjCb/XKh:Psupxa/gh2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648457, "uuid": "e0ef063c-d00e-4820-9e5a-0c4ad94d1491", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648457, "uuid": "28e2f713-efb8-42be-abbd-dc6527b61227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "276154ab-3e17-4972-9ff2-1f90a17aa737", "value": "emotet_exe_e4_1d3b38ad2917127722eae5acc3d9040e97ed2d62696ac5086131398e3b455159_2022-03-19__000730.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f92239-a751-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647672853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647672853, "uuid": "8654f8cf-5b66-4e5b-b69c-d7e188d07ee9", "comment": "Malware payload (Heodo)", "value": "69083b26054a690b6f7e9deb3421fff0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647672853, "uuid": "5447477f-69f0-490f-9386-09bae6a223ae", "comment": "Malware payload (Heodo)", "value": "1d82ac764551bded18429055e8199b9605e36f350a54f04ed69729aa1c651061", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647672853, "uuid": "25625931-b26f-4730-a8b4-402096e068d8", "comment": "Malware payload (Heodo)", "value": "e8ad6c2ebc5fece299c2548b5f4cd20e4960659f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647672853, "uuid": "8bf436b9-bb5c-402f-b32a-48e4ca9d1681", "comment": "Malware payload (Heodo)", "value": "5af97f110a31d81b8210d89a7a77a6e55b7ec721b41b73f181138f451a2c88293d19fe4b900bdc0745bff7b01a12eb61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647672853, "uuid": "70d21636-c0d8-4aae-b6a2-2303f5d864c9", "value": "T1C9C47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647672853, "uuid": "36bf47ad-5d8e-444b-b214-11cff7225341", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647672853, "uuid": "1a4fa221-c0de-4342-abba-ecf9acd3059b", "value": "12288:S54yM33d3q3Z7BogkreNmF+U/9JckIAGfUeb:SKh3831BoqN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647672853, "uuid": "77f9a931-4052-4a1f-bb43-14bd39d5a78f", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647672853, "uuid": "d1a5ec2c-f9f2-4593-baba-eef2fdcdcaa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647672853, "uuid": "5b1dec1b-e5fb-4bb2-b48f-fa4fb6c09ca3", "value": "69083b26054a690b6f7e9deb3421fff0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff6ecee-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666620, "uuid": "990b6502-1c50-4190-919f-68b86b80318d", "comment": "Malware payload (RedLineStealer)", "value": "7585532d64583a8c1e2952b81ef2005a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666620, "uuid": "70003576-1da4-4429-87cc-f2e4fc71adb9", "comment": "Malware payload (RedLineStealer)", "value": "1e9198c2df71b9681956f4f2a5ea3f5cddb4cb5e85bcf1741070a589a520e8b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666620, "uuid": "3b7979be-0b6f-4dcb-9c97-82e7ef670a02", "comment": "Malware payload (RedLineStealer)", "value": "e40c9fbba9d6fbb57bd0ec55d5c94403e0d4035b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666620, "uuid": "082b1f94-4afa-41d7-a91a-7b0176116fba", "comment": "Malware payload (RedLineStealer)", "value": "67f9785e9180bf1d1fb4224c4c5848b10b56482e4c1284c0a7192e768d20ac978f888c108ad2b95e7dd03b0e05d823b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666620, "uuid": "1f8de672-1499-436a-bbd9-a34d88a2cc64", "value": "T1403633B6B23078EDCF860434CA57889D933D1331A0E599FBE0DA5C8307D96C6B672897", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666620, "uuid": "18fc6228-6b15-41a4-a050-5da8b7d4cfbc", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666620, "uuid": "b54f9050-e6fd-428f-96df-0596a5f274ea", "value": "98304:fO2gp0rLk1uKTrhJP8AvOE54mgtxOJ7e0rSIYgN9669fzwuRmt16HBb:fOg4UGV7Ow4FwJ7wp6HAKBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666620, "uuid": "76e5fcf7-73c7-4799-820a-685f31e2d434", "value": 4891440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666620, "uuid": "054599a0-29df-4968-be4f-c26aa84a062f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666620, "uuid": "82931c70-0668-42b2-a95f-33354a04cfc4", "value": "25429835.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58aa6110-a733-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647659951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647659951, "uuid": "1685c91b-9895-4cdd-86fd-ec10410f28a7", "comment": "Malware payload (Heodo)", "value": "10bf736caf7b39d518f7f834981050e5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647659951, "uuid": "e6382c45-905d-4aa9-b343-59083148fe2c", "comment": "Malware payload (Heodo)", "value": "1eacd446971728577255c409bdcc0c48520b8b8f01d4f68d8f7131c56fb2ca9e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647659951, "uuid": "f04fbe3b-2ed1-4b0d-a255-776746de63e3", "comment": "Malware payload (Heodo)", "value": "25400ac11e83fcf30c94ad01ff93f285b6ebd82c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647659951, "uuid": "e3ad5c80-d43e-402b-ae99-e5b7a9fcd88f", "comment": "Malware payload (Heodo)", "value": "2de9b5ef552986afac876545622492bf0b0b8aa387b2a61196a7aab884b4b5c9abb7f2214d9db28c2a6bd5f4634c59a7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647659951, "uuid": "ed750324-1b9d-46f9-8951-b88f2e72bcc7", "value": "T1B3447251956340638BF779E2DBF512776AD59B81C33B097E02A8C43FBA28E437752E20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647659951, "uuid": "2943eeb0-ec07-4fe8-b0dd-82033b09ce03", "value": "3072:Pu3zSmuSHHfI/USrrg/vzXqGaesLQ0TxPejjDK/fvS+jWhyoDDTDDCDDYDD7DDV8:U/L5tYtXZ1BpFHyFjJmP/RbV1M2lvMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647659951, "uuid": "7494f0b3-337e-41f2-8463-963edd53573e", "value": 261652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647659951, "uuid": "2bf81e05-c7ef-4266-ae41-7c6d7032e5ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647659951, "uuid": "eaf32a1f-5a8b-4c4c-9579-c8183f7357c5", "value": "emotet_exe_e4_1eacd446971728577255c409bdcc0c48520b8b8f01d4f68d8f7131c56fb2ca9e_2022-03-19__031907.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251da6eb-a71e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647650845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650845, "uuid": "dbba7e11-01b7-4a69-a8e1-2b25a5548121", "comment": "Malware payload (Heodo)", "value": "a89689c2b48ad9e031f6a0fd927cd732", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650845, "uuid": "9b776f58-70fc-45ec-88fc-0e59b989ca87", "comment": "Malware payload (Heodo)", "value": "1fe36fb672d8f7845df91e7440138c5b5c8a697f03633a62dca4546eeda3bbed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650845, "uuid": "40586914-a249-4588-8e5a-3abc70498c67", "comment": "Malware payload (Heodo)", "value": "80581e121a98cde7d59fe761500e8384fa8138c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650845, "uuid": "23fe8f25-cd78-4183-b390-cbd8571343c2", "comment": "Malware payload (Heodo)", "value": "1d6957aefbd1a75d442e44d1b74d84def60c285ad1265af569c93984210cd5d6147acee8bd836702eb9c00350d86a8ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650845, "uuid": "f6869bc8-834b-4d24-8496-05224c3ef39a", "value": "T1DED45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650845, "uuid": "d8b6fdce-d547-4e75-99b5-3df4747456a0", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650845, "uuid": "e7405602-ee06-4d24-bc7f-4122829a14c6", "value": "12288:UWBpwupxl0OeL/grxLGzO+r9AjCb/XKh:Psupxa/ge2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647650845, "uuid": "01e46300-1f9d-45d9-adb4-587dd9318316", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647650845, "uuid": "3bc7e252-00c7-4da9-8aa9-e6b9e96b09fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650845, "uuid": "e1a530db-e4b7-4547-8704-a262893a4d5e", "value": "a89689c2b48ad9e031f6a0fd927cd732", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39923bf7-a77e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647692111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647692111, "uuid": "efcf72b1-c962-4f6a-8270-6009d0912366", "comment": "Malware payload (AgentTesla)", "value": "7ab7d97a6b9538ceafaa5b96f846e387", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647692111, "uuid": "6dc01523-07b4-4cbc-83e2-52ab30eeae4a", "comment": "Malware payload (AgentTesla)", "value": "2068a183130d0926f443d69b17fe4c9a1272a871eae047e3b6bbe55522c89c65", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647692111, "uuid": "e3feb5a9-6653-415c-be9d-db7e27b1510d", "comment": "Malware payload (AgentTesla)", "value": "a87d138705923b28a3e739eef2cf3dcf4cb816f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647692111, "uuid": "e5ec798b-7c4d-4e89-a611-d42ca7a677f9", "comment": "Malware payload (AgentTesla)", "value": "01beeee2049ce39e303600331bcb78973aba74857df0035401449945137ac1cc06591f3d6bed6abc7765673ee7f97798", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647692111, "uuid": "bb0adf04-fdeb-495e-85be-39e78127bcdd", "value": "T1FC353351F3B504F7C5B2A2BC506F1C55F36AFECE8ADF22E693204A7A4125C798E0E254", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647692111, "uuid": "c45da65d-448a-4018-b3f6-3fb60ca057b2", "value": "24576:SLEoei+69sOYF19X4LmRDwIIMHNvysaDv4wnOf6Yd9/:S4ovuOYF17RDwIIaN6DwwnOf6Yr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647692111, "uuid": "8fc65f7d-dc27-4ae9-940d-cab305157b6b", "value": 1084909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647692111, "uuid": "465fc016-5645-4a23-bd67-d7c5816d6ebb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647692111, "uuid": "a094934b-d6de-4f2f-aa88-779c6e05bc7e", "value": "BL-SHIPPING INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3ba3f7-a71c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647649995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647649995, "uuid": "0d7df544-499c-403a-86c2-e6c43da91080", "comment": "Malware payload (Heodo)", "value": "20f5db11569e00b4e9c78a587fc23ea4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647649995, "uuid": "e3d9aba2-4910-4478-8b65-8065420abe90", "comment": "Malware payload (Heodo)", "value": "20bb4365f7f51ccc8f2e3b66c664f3e3918c86fd21c7b41d4fffc865fc65804d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647649995, "uuid": "3e9a75dd-cc68-41df-acac-9d2d87b4ba1c", "comment": "Malware payload (Heodo)", "value": "61d484bdc5094691540adbdbb9e27bae51737bff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647649995, "uuid": "6d33dab5-927c-46f6-8732-d5e8332ffc69", "comment": "Malware payload (Heodo)", "value": "eddce401ca3c76bebf69398a405dc8e2b216be1dcb286a1d610b67c0ba81ea87412ed7074d214765b4e96b0b8972ecf4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647649995, "uuid": "4d00dd7c-4362-4ce8-95ee-b0db35a7b8f6", "value": "T10CC47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647649995, "uuid": "bb3c869a-3f2a-462f-ae3b-89649a5aaa63", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647649995, "uuid": "7a41e2c2-f57a-4565-b010-c6d9ebc4127b", "value": "12288:S54yM33d3q3Z7BogoreNmF+U/9JckIAGfUeb:SKh3831Bo2N6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647649995, "uuid": "99972b0d-eee3-49ed-85a0-6f91b7ea6285", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647649995, "uuid": "e62578b7-b3e3-405b-8e30-644a1ec950d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647649995, "uuid": "94b91527-9c6a-4819-b225-f33c13137167", "value": "20f5db11569e00b4e9c78a587fc23ea4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2861bf4a-a7a5-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647708833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708833, "uuid": "0e067b82-9213-4b27-bf49-8c70ee96e8ab", "comment": "Malware payload (AgentTesla)", "value": "9206cecd632886a68881fe2f70771b5b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708833, "uuid": "a7bf1c53-c055-415d-8d74-208442295f3b", "comment": "Malware payload (AgentTesla)", "value": "232f099abebd4a66d7407a9f0974effee4914e968b7b4b1fa559174ccd66ff12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708833, "uuid": "87c748f3-095f-4d69-a794-14c452545486", "comment": "Malware payload (AgentTesla)", "value": "4f49e371bca1f47a9a8c552043da6eaaef42b30e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708833, "uuid": "8c174b1a-7a59-451f-94ce-ec240bb14452", "comment": "Malware payload (AgentTesla)", "value": "2eafb40bcbbe6d37ae55d434b2ca7edcbb77bbc401e39866ed863849cc419d4be6ad190bda17912add8b9f0c3b624098", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708833, "uuid": "ffd6c9fd-5e60-4a52-8a6f-c6900ff81cde", "value": "T17873CF22D78646B6EEB407B034474A7372AB1F22B53B60BB349C7CCE7B83214095BB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708833, "uuid": "82e06e4a-d749-4e8a-8743-bf7543bf8af7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708833, "uuid": "eca19acd-dc3a-435e-b27c-64c7402a5590", "value": "1536:hS9ZPppv3sD4ldQxM/TsLi+vQrpazPcXofYsxzR17TtJeqZ2:k08d4kX6YsxzRB5JeqZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708833, "uuid": "faffd9ec-70fc-4aa8-8564-bc99bc4f2567", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708833, "uuid": "cf6aa88c-fca3-4074-ab91-46e87b2b4fd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708833, "uuid": "3c684564-af99-4885-9e52-54e021ce70b6", "value": "DHL - 10036732022 .docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86493a65-a723-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647653156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653156, "uuid": "c28fc4c2-d981-43c3-bd0c-5f92b6b3bfbd", "comment": "Malware payload (Heodo)", "value": "7016e35e986052378b8c07ccde1d2577", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653156, "uuid": "cec4efad-fc3f-46b9-ae01-0a78f562e4a9", "comment": "Malware payload (Heodo)", "value": "23717c94ecae69f9e389c66c5c0a76628c33fbceca6bf072b1e61f154944d3c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653156, "uuid": "7cbf2657-2945-452d-b3d3-f6241d961fea", "comment": "Malware payload (Heodo)", "value": "d858ce90c22faca3f12fea2370cd60502d138830", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653156, "uuid": "effbfbd7-cf75-4659-bf05-27408547986c", "comment": "Malware payload (Heodo)", "value": "a7b1697d8348ccd913cbf6aded673964caf126cdf5ca807add345d203f41fbbbf693ec610fce444bdf396e1c329e7865", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653156, "uuid": "e62989b7-df1b-4f07-9d1b-a0a1a0522388", "value": "T13FC47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653156, "uuid": "527b5f09-9f17-40de-ba98-f820e1d10c82", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653156, "uuid": "f7248e92-6520-443c-a95e-679ef497ad2f", "value": "12288:S54yM33d3q3Z7BogsreNmF+U/9JckIAGfUeb:SKh3831BoCN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647653156, "uuid": "2e803954-89d7-49f9-befa-40bf1996d63f", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647653156, "uuid": "1bb89216-9c81-459f-b351-f5c6725313a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653156, "uuid": "d4617876-ac88-4da4-967c-74d05e9dbf51", "value": "7016e35e986052378b8c07ccde1d2577", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26965f2-a743-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647667000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667000, "uuid": "85c7f34a-8ac6-49b8-a1e0-f1db786037cd", "comment": "Malware payload (RedLineStealer)", "value": "9bf274f06b776e40cc6150e37d2b8242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667000, "uuid": "1af15fa8-9c44-45ac-b689-72b3a490b381", "comment": "Malware payload (RedLineStealer)", "value": "24cf5566094b9c99b75303995b503b3285531d1313658f318a931424c9ef46d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667000, "uuid": "98b90b81-5103-4fbb-af28-19070b082238", "comment": "Malware payload (RedLineStealer)", "value": "1a5e605ebb5f9d6d673544219052fb9a07f0d4eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667000, "uuid": "15fd64e7-6d70-4448-b210-6697b138e727", "comment": "Malware payload (RedLineStealer)", "value": "0ad858ab46c0877714c3dc2dba3c49f44a6f74733865ee9acab85d281317c815a0b364dc0f9e0339a5ca6cb8ccad76b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667000, "uuid": "5dce8757-2fdc-42b0-b22b-b525b60c11e2", "value": "T1162633E6D4FC2D4BD987B27869647E0381CE0EB541D181099B963C7AF7FAAB790244C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667000, "uuid": "dff80a77-72af-47e3-b8c3-9674067b5f5a", "value": "7c731c5b9001d2535d059651bc782194", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667000, "uuid": "fcd90a23-3a77-4ac0-91ae-3fc16bd41c36", "value": "98304:xXjxks+RBLKK5Js8LI5D0TFtHMKN26VVE+xOObn91:NjH+ROB0TFtHMhItVnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647667000, "uuid": "7bec2e6e-e592-46a3-a85c-e469ca27d291", "value": 4731904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647667000, "uuid": "cc264e2c-81d5-4d80-84f7-617e39b4604a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667000, "uuid": "a7e54dc2-e15a-41cb-8bd1-ce63666ee819", "value": "28205967.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e68e027-a744-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647667289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667289, "uuid": "59ab9e71-631a-476f-b471-a6363fd7a1f6", "comment": "Malware payload (RedLineStealer)", "value": "b48648846b0b4d740f20bdaeb4a4a209", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667289, "uuid": "9e0df4a6-d307-4001-a6c5-9fe0f350f9c3", "comment": "Malware payload (RedLineStealer)", "value": "2568f408dd3cc81ca088f75c295ed4cc813c440e7c6c2e2d97e02f77e49de6f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667289, "uuid": "dcb39b99-40cf-4f56-a0f2-09445af70c38", "comment": "Malware payload (RedLineStealer)", "value": "b28c3906ec33cee1f76e1b84db33282059abd8f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667289, "uuid": "e35eb987-f0f3-44e6-a525-92f8e327c5e0", "comment": "Malware payload (RedLineStealer)", "value": "f10b3ae534fae0da421d314ce9e7a105c3bb70153742d37b5a51056706ee9cdc492e965aec2104ac00779bcc1edb4fb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667289, "uuid": "e7e90817-1dc8-4943-a608-770baeb52971", "value": "T191B4A43839FB5019F173EF75DAD874969B6EFA633607E91D209003864A13B82DDC163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667289, "uuid": "9c80c060-28ae-401c-9d16-b9a70f116de6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667289, "uuid": "c0d4b676-f824-425b-8121-803e9379dc02", "value": "12288:5BGnE/LcMqRfWXJYnrj9qboFKMi3goRLk51:NIMq1liw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647667289, "uuid": "009f6e45-e685-4dfa-98d0-af5c9a52cd3b", "value": 499200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647667289, "uuid": "f936efa6-1618-4e3e-8ff2-e34a43c55c37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667289, "uuid": "762f52ad-cf15-4f82-8f44-1405eebc61a6", "value": "29856156.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb593f2-a7b6-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647716091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716091, "uuid": "b03c4caa-031c-4d5f-a035-b1a465c1e783", "comment": "Malware payload (RaccoonStealer)", "value": "a3563dca52c4321edfea385226ca79a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716091, "uuid": "5316c841-0f43-416a-b7c6-8f46ecc284c7", "comment": "Malware payload (RaccoonStealer)", "value": "2631bb84e6e34dd72aca532864d09e51d161c687ae3f5e495c16a2fded1213aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716091, "uuid": "5a5d406b-9847-4ac3-800a-2bd1a35ff58b", "comment": "Malware payload (RaccoonStealer)", "value": "ab5597bea6578dbee20b9a2c7daa4eef95b6f589", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716091, "uuid": "3a8d12d4-c8b2-406c-b582-f5daf6bdf874", "comment": "Malware payload (RaccoonStealer)", "value": "1a2612d7b25aabdea8541d6d3979c06978ab87fc58fd39fbbbe6dba289dd9dcfaef381364eef8fd3423230b07216ad45", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716091, "uuid": "1093a97b-0345-4198-8987-6feb9cedd13a", "value": "T111E4F150E7A0D03DE47312F8787A93A9A53E79A05B3141CB62D63AEE55342E0ECB531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716091, "uuid": "0a9a3188-1572-4b81-8780-d39b5c108d61", "value": "31ff0fcf24c663417943c5927af948dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716091, "uuid": "6540e8a8-7bf8-468e-8394-7d8e0e77a666", "value": "12288:nToRZ1TNVbk3O64jnjEIO954e9RrqxVrW9CqZqMXmQStSl48v7tOgcY:8NNWe5jEIOkemfrW9CqZ/2Al/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647716091, "uuid": "aa111b6a-e91c-4ef8-bc2a-8fda7009bede", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647716091, "uuid": "7534de84-ca7d-4cd5-bcbe-2fb339fb9fd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716091, "uuid": "5080bb9e-c64b-4fba-950a-18c999c49784", "value": "a3563dca52c4321edfea385226ca79a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265ee5a6-a743-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666739, "uuid": "217e8315-fdc5-433b-9ff6-9424ded2e091", "comment": "Malware payload (RedLineStealer)", "value": "ed9061148832c3d96a9215c96293ec25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666739, "uuid": "bcf43aeb-2778-49e1-8a43-bf16d18ec1c9", "comment": "Malware payload (RedLineStealer)", "value": "267ca80ba7f91e7982bed38464198b13be2a517b2db425e4f9e3af39f003248d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666739, "uuid": "f741f372-c775-41e3-88b7-00749c9971fd", "comment": "Malware payload (RedLineStealer)", "value": "c04d4250fbb3f1008a5def6ebf42e9db55ee067f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666739, "uuid": "f9a5647f-03cc-4d78-9e66-9b887e8abda6", "comment": "Malware payload (RedLineStealer)", "value": "aef7796651c72db41f9ec672acf09415448ac842e5544666feaebe806e8d18272f4c085bcdf6ea22cd881795a0757ac6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666739, "uuid": "c3b11a9f-cbd7-4b33-b59d-d58972028905", "value": "T1B8C4234BCA88FE14C4C717B02FAA8C8DD7454C60E9A1D60EE16FB907DD714B7EA05B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666739, "uuid": "e5707f49-4439-4e05-afaf-5240c9eb7afc", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666739, "uuid": "f811dbed-299a-4d40-a089-b6ea221c5222", "value": "12288:QEsXcQ4rOMjsh0oQWHq8nELQS03ULaHNqrxlKIQNoM+/lf9NX6Z13Rzk1cVQy2:MXAOM60XWdELkEaHNYK3cNfX6ZRFk1ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666739, "uuid": "6e736e95-7b42-4425-848d-a0a326a44d7e", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666739, "uuid": "f01bdf7b-512a-4b90-9986-4318ae77399f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666739, "uuid": "1d73dd6a-9a39-4e05-a8e1-9c16f08480ed", "value": "26202886.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7ae104-a77d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647691688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647691688, "uuid": "924566eb-1888-466d-b268-b9cf3be462f9", "comment": "Malware payload (AgentTesla)", "value": "3fb99b41ac07a0cf1aed8b357894da9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647691688, "uuid": "72c33017-2ed0-4b97-8199-76cac41403d2", "comment": "Malware payload (AgentTesla)", "value": "277dd3df513f187ed41644fa4839dd7de4c807b49d24feeee82fed97711333df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647691688, "uuid": "353dbe3f-ab89-46d2-91c7-a2c3fd924e0f", "comment": "Malware payload (AgentTesla)", "value": "b51f56232329e230827c72b726896673e0c4055b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647691688, "uuid": "1c0a954c-f59a-4248-85b2-9f03d1b6abc3", "comment": "Malware payload (AgentTesla)", "value": "c2508950aaba5fa3687384afe73b4db802559b85765667f0ae44bc80ea9c8b37802241b6b85f1e33c1171e10c7c74b04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647691688, "uuid": "13eaead5-4926-4f63-94ab-7c8908c776d5", "value": "T15AE4062A3478B367C97B8A71896A140CFAE0DDDB34199C59AF83B7700D735862BE350D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647691688, "uuid": "badac28e-dcf3-4ec9-b0d3-77f753eea1f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647691688, "uuid": "a2caaf5d-300f-4e28-b3dc-3feac1e2f550", "value": "12288:MLxnHMz7jbvTCcBizKKplcRIAuswrZcFQJQeAjthrn:0abvmzKKpl4utZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647691688, "uuid": "b1c09ff5-0f23-48e1-ba0f-16df3400501a", "value": 663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647691688, "uuid": "c6832b77-1b22-4c40-94ad-813e68f9cf8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647691688, "uuid": "e3161116-16e1-43a9-9127-fa7641876c12", "value": "new order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3701f75-a7ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647718166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647718166, "uuid": "77062d2f-3d4d-47fa-9125-95b6df308022", "comment": "Malware payload", "value": "cd537df93c026034f0a3c7110a171e47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647718166, "uuid": "532fff6a-1ab8-4422-9c31-86673e8bdede", "comment": "Malware payload", "value": "281abd06666e9dc52d2dfc61cd77ad11828feb2f139ca0cf075cf3821d09520e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647718166, "uuid": "4924fffb-dfe9-4768-bac2-cceb73131832", "comment": "Malware payload", "value": "063edd56d64684e6a1ebda1f69842af7db119109", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647718166, "uuid": "c9739cf3-febc-4d08-8699-3bab58a5e56b", "comment": "Malware payload", "value": "b4dc9d21df5d0cd16eaea25d900bad01787f0fdcec2b0ce897e921cee8d40bd2589d8e17e95bf5d84983f264bbb9d758", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647718166, "uuid": "9d67ea58-245a-4366-92ef-d93a48fb3aca", "value": "T1CED4F7AD316472AFC877C0728AA81C68F650A4FB671B5D07E55307999D0F8C7EF840BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647718166, "uuid": "40159455-d9af-4bfd-9386-39fc0653b4ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647718166, "uuid": "c8094146-9b7f-4569-98b2-c1a09ea592af", "value": "12288:82Or39aI4UnJ0yZYIjtYSa/t5U6PoT18pTOrG3to/PIIGnuwv6LN8BY0Ep+1UHBT:82Or/Yuwv658BYYUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647718166, "uuid": "9d4e6533-efca-40a9-a715-8527ae79d608", "value": 644608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647718166, "uuid": "b3d31805-cfe1-4176-aa84-e94a29e644f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647718166, "uuid": "7b8d9a36-bb5e-4c1a-8485-c931ad41616d", "value": "delivery status.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b322a6-a741-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647666174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666174, "uuid": "a8411490-6119-4f2f-8975-9c2d8bf770f4", "comment": "Malware payload", "value": "e9beb4efc6be57f436eab15e03224ded", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666174, "uuid": "b4206a8b-86e1-4c56-bd2d-4df8f371215d", "comment": "Malware payload", "value": "2ba411a9033a2ca63f7aade7920ebf734eea0ec8356ec7b51288dcf633949587", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666174, "uuid": "72a9fd7e-a5f3-4d68-b62f-234145a5a81c", "comment": "Malware payload", "value": "a6a89dab88fd74fd7cbba0b7df18e0e5d036f367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666174, "uuid": "f03c3a15-d90a-429f-902b-2b54d56742c4", "comment": "Malware payload", "value": "e93ced91b72f673a5fb53dbc7a52580f42e7c8cfd95cf0ce4ca77aa6ab92ec363b27d07c0e296adf947eb4c52a944da2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666174, "uuid": "9f807834-a1a2-41fa-9d97-e1c2d8b4ccf5", "value": "T1772633EC44057FBEECD35A79AF3CBB145FB09032C89CD428F15960972A492620E9ED75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666174, "uuid": "243e0b64-23e4-4658-b850-9a07a652601e", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666174, "uuid": "83292bbb-4a79-4d14-a5e5-9d984fe18db8", "value": "98304:KQ10e02XdTTxMF1T7LwqiJTXcsOaAwbAKPk8icYeooyqDDv:KQ50Ohx2d3wqiJ+aAMA8r3Dj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666174, "uuid": "982a5944-3e50-4151-8b64-c02bb3f1b672", "value": 4542464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666174, "uuid": "c342646e-5fd7-4de6-b09b-f26091f1e567", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666174, "uuid": "81f9c98c-d3c9-4da5-96d3-888e1065b1f4", "value": "21436955.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adfb008c-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666537, "uuid": "d2ee3670-fd62-4f28-bc7a-fc8939ffb1e7", "comment": "Malware payload (RedLineStealer)", "value": "d5229aba941f173111e16e250358f9ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666537, "uuid": "2f2488ad-0f1f-41a6-9038-4c6451064f6c", "comment": "Malware payload (RedLineStealer)", "value": "2cd531baaf63a621107321cb59c46481443d98b40e6312af95a8b6cf43a5c3ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666537, "uuid": "dca6b5fa-23d8-4852-9417-ee34c6e28bfb", "comment": "Malware payload (RedLineStealer)", "value": "13b9cb35188da0c88b127c4e2ba616e882e92eb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666537, "uuid": "5c5ebe40-421f-440a-b041-3197440bbc26", "comment": "Malware payload (RedLineStealer)", "value": "f2542d924ea1264ad58448d5caa32e45f11e4cc8c9c44f3ae273e509e1e8c7159ecb78b4d47b8b87ffe4c802e734172e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666537, "uuid": "34e5c3bf-0593-48e2-8a7c-a074849c6fa4", "value": "T1281633D70E109F5CC54ED1BB0A385E95F86E9A4BD3413C1AC5F84C4E9CFBC8AE059A1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666537, "uuid": "e504f429-0c9d-4d33-a3ee-1e6dc0bb5f3a", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666537, "uuid": "119634ca-a782-4ee4-948b-ef32ed041d5a", "value": "98304:GjrJytzIcJEVM5cAyxMW790iscImocs75ZX+qzt:ay5Icf52xB+iO5Ztzt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666537, "uuid": "7f90c6fa-75a5-444a-9c60-ece41755f12a", "value": 4040648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666537, "uuid": "fb59856e-0235-435b-9cba-1c673dd7cc6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666537, "uuid": "d9651612-e7ff-4c31-b952-d582eb75e329", "value": "24248870.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e758f4e0-a7a5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647709153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709153, "uuid": "7d08c2f1-8384-4913-b4cd-440a0b253e21", "comment": "Malware payload", "value": "4c47c1d10cfec1c69e4f76f3d5882a38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709153, "uuid": "d5d84369-2d91-447e-8ad2-8601bdb75fbe", "comment": "Malware payload", "value": "2d424bfc20d7c7ffc3d637214f278df9b2b633368fe21746cd17bdf647b456fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709153, "uuid": "0676b3ad-9442-420c-be73-7fa1dd309e64", "comment": "Malware payload", "value": "47b280ac62622fe2094a02a2aef2fe752bc2a1bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709153, "uuid": "2b0d86a7-029d-40d9-abd9-9555b3ad0aa1", "comment": "Malware payload", "value": "45049cc22b7bfab48d0aacbc04f3b6d491c4b806ef31bf5f79884c0032c5607c15a57484cbb29fbcaf00155f56872b53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709153, "uuid": "b63c4ef6-9e24-4cd3-b86e-364e730e5d6a", "value": "T14C3649F321C1778DC156C4BA8362B97F9A9FB4368B1AF4B7D0917621E927C007A08F19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709153, "uuid": "3963607a-69a0-4a34-aab7-96e24960601d", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709153, "uuid": "9fe5e3ec-515c-4e33-955c-f8aa21bf501b", "value": "98304:nI5xrmcv2GEzvH5jk27ZZql+gmOtxz6CY75GysPOyu7p3wQ9E+B4ZhDRJ:nYxEGEzP5jk27Za+KttnQtt33NBoh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647709153, "uuid": "39dd383d-74e5-4104-bef5-ca379f7f4f38", "value": 5287327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647709153, "uuid": "158ddb1f-f61f-4147-bacd-5e4750fe37bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709153, "uuid": "cfc64e58-dcf8-4d13-b3a2-7c651057834d", "value": "4c47c1d10cfec1c69e4f76f3d5882a38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a9b650-a7b5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647715809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715809, "uuid": "eda5cf96-c03e-49ee-8206-c7a4a46f3754", "comment": "Malware payload", "value": "d2260bcdd0144e4698497a9502ede549", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715809, "uuid": "3f61ff05-ea4a-45f1-8667-a7e07a1a68f8", "comment": "Malware payload", "value": "2dcd05019e842caddf9307a49bc507d4eaeaa78fc39850432c595943477ffc44", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715809, "uuid": "316826a8-c603-4745-915e-8f57ec863f0d", "comment": "Malware payload", "value": "915d6cfcdeb91c9955261a2301d63e0d5a9093fa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715809, "uuid": "00c8c915-dc3c-4c2e-9a05-27e91547f1a6", "comment": "Malware payload", "value": "ecb9874925a793db767af5d129604a00568d689e0f79b4096ac792f88a2c591ffad8d241c0da6b8bc1947162cefc109f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715809, "uuid": "e7e7b5a6-ecd2-47f5-8a94-6e42643f28d5", "value": "T1DE3318C5BD95C702C6C90573FE4F8248372AC6DCE0EAB3878A157FA225A70664F9B419", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715809, "uuid": "b8a0ba8a-6dd7-4127-a1fa-8fc567a7c03f", "value": "768:cjwMECbjf8oPvNTpzTP4iN0SwYgtbkNy8kNlUZyO0un3+LVuCly2L:98bjf8gLTTgtrvlUAOnupuMy2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647715809, "uuid": "e5c4a17e-7c7b-4adb-b874-304a4510b5a3", "value": 51540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647715809, "uuid": "3a24365c-c943-4161-acf5-2e00b4954826", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715809, "uuid": "e28a8da7-7833-41d7-afad-6f1b054d0ba2", "value": "arm-20220319-1850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae62cb7-a741-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1647666021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666021, "uuid": "d796645f-a340-4cab-84c5-c1b5c7e424f5", "comment": "Malware payload (ArkeiStealer)", "value": "8495bdc8f8d575ea980de3f30941fc9e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666021, "uuid": "af0f1242-c843-4773-809c-7e28a15b39bb", "comment": "Malware payload (ArkeiStealer)", "value": "2eb0bd8d5497a0ff3032732ac570f0ff05195e6f72bc724d71db06be6a02fc26", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666021, "uuid": "01379f3e-0832-4bd7-b982-a513aaccd272", "comment": "Malware payload (ArkeiStealer)", "value": "91ce0c43d738a27b676edcab0f1bb4b54f33e509", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666021, "uuid": "00ea1b78-476c-421a-bbbf-77159b27f581", "comment": "Malware payload (ArkeiStealer)", "value": "66482b8d15cc71d5df87e08ed852ac010adba89514925f79f5fd451bae43c0077cacb4bea491da65d0aa259d32b8357d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666021, "uuid": "1a33c1a7-b1ed-42e1-ab3d-6ac6bae0198e", "value": "T13975AD01ABD1E833E5BA1B31D4F547F03D32EC15E9E6D21B2964BC2E7CB169099B1316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666021, "uuid": "cad1dcf2-e2e3-43c1-b66d-b6ab7e6c741a", "value": "d9051f25a2e18d0a82f0a2268199b2ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666021, "uuid": "2cddaed3-3460-4052-8b65-892fe0987667", "value": "24576:o/z2WiCy/SzRJ3ksePUXprL9jqrxioR6wbSRxZT9o0zApMR/:A61r/Sv3neKprL9erLXSJT4MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666021, "uuid": "2d8e1970-1533-4d9f-a8a8-328e4ee50eb1", "value": 1693536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666021, "uuid": "1c32f60b-0696-42fd-bc1a-4d519c30b6fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666021, "uuid": "784003d5-59e6-49d9-ab49-97bfd8b3c0db", "value": "20709480.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909593c3-a767-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647682379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647682379, "uuid": "b9cdc7eb-ea33-4181-864b-6ce789ed9326", "comment": "Malware payload", "value": "a61bb723addd3cfd50051b1a9f35a244", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647682379, "uuid": "255e99a3-33a9-48b9-8c67-29d99a506489", "comment": "Malware payload", "value": "2edb632695c49e69933dcfc9f7204209a4ccde346ddb86c8cd2f692e8be52cf9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647682379, "uuid": "5a7c49c9-b843-4b71-a3dc-c255f3c5c7c3", "comment": "Malware payload", "value": "8ecd9efdd2147e0848664635dc5689553a44a88f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647682379, "uuid": "f94829e0-6d06-4e3b-a99f-2ab98f71c8cd", "comment": "Malware payload", "value": "dd76005dd21b1471aef7e90b0d6c4c246c7eda69012208b786d101e9a4ee08921d86aea07d9d495112760149232bff0e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647682379, "uuid": "d3675fa3-b852-443b-a704-c9f5d946eb61", "value": "T10852497CD0BB46D9CFC9A394A528ED0524E8762CE3D6E12331BC63702B97E2F64025B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647682379, "uuid": "6b80515a-b79a-4fba-afbd-8744382bb2b2", "value": "384:wurF0SzSzDTlaW0sbNtXW2dv+0o73Px59xpWd/ORbq05:lFKAstmmG0oDPxrxUd2Rb95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647682379, "uuid": "70feeeb0-ed4c-4990-85c5-e0b315d5f259", "value": 13503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647682379, "uuid": "e9770455-4dd7-43f5-85d7-d3eb93073faa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647682379, "uuid": "ad749c16-a557-488f-9554-628676b329cd", "value": "Transfer Slip.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6ea125-a767-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647682209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647682209, "uuid": "9d09beff-e318-4c8d-848a-50fd1b799b5f", "comment": "Malware payload (Formbook)", "value": "56e9bb5f9eaa3ac747f91ea6637dbbc6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647682209, "uuid": "4ae3c736-927f-4e83-8b92-ead8c17f41b8", "comment": "Malware payload (Formbook)", "value": "2efdfb77530e93c15a16844ba44e1e7f7f7b36aa75be5d005e01ebb13aeb9fb7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647682209, "uuid": "b5dcbfe0-5ad8-4675-84ed-9d287f49ec01", "comment": "Malware payload (Formbook)", "value": "36b2b6396d982b17cf6e652bf49a97a5f0b2303d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647682209, "uuid": "f71154ed-27d7-4a02-95ce-a3658e0b46ad", "comment": "Malware payload (Formbook)", "value": "846c5782184702ec459b93f6db705dd44ec119223e67fda4463220ff8a1b52cd49377bd8523957fc0281e992572c3887", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647682209, "uuid": "28456088-7216-4110-8c61-4d84cf5c0fa2", "value": "T1A78423A0919BB78B493ECC2E0C88352CD06F05E15DE6C5A5760CBD55FBB83BCA8DD891", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647682209, "uuid": "4086a0f1-1698-4cfe-ac54-80659f428912", "value": "6144:6XJRJUx4v6a2BLLKtY39Xtguj5KjYNuUprBiWuVze1SdckFO4RcgY2ESoV+CvGp4:6Xyx3RLuY39dvj5GzaBiEqckU4R82Yw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647682209, "uuid": "0cdca59f-bf90-4865-bf7d-259ade686a33", "value": 375925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647682209, "uuid": "8269a2ef-f7da-40ac-a8d6-cbb03cb6d811", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647682209, "uuid": "c9c4b2af-35f4-47ec-918d-c3e531b2061d", "value": "OFFER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3499b9fc-a7bd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647719161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719161, "uuid": "89404260-5308-4ea5-b038-fadd1736839d", "comment": "Malware payload", "value": "3c96c4450e1b7c77af8de63f3addaa2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719161, "uuid": "3aed8983-c6f2-4e29-8480-851c0a5a10dd", "comment": "Malware payload", "value": "30e2ef82ea777c4407cc6949caa76dd2338d4902d935d5010b671f693a0e354d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719161, "uuid": "863f86d0-45cc-406d-81f3-068328cbc7c1", "comment": "Malware payload", "value": "5048e92d966fd5b3dca15a8c7c8f2c865db21805", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719161, "uuid": "6eebcaf5-6f4b-44ff-bef8-4c8fee53de77", "comment": "Malware payload", "value": "59c0c37cb6e9b252079dd225c7fb6d1313a820de619086057a980622f9de15dd79b36df3e5e2bdc30829e838c063a986", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719161, "uuid": "56ecf10e-5bf0-4666-850d-837f686795aa", "value": "T13932A5D6B9428A17CAC49237FB0E838D7F26670CF2EF33036B176F5065579270A6A449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719161, "uuid": "021e0846-7e74-41db-9a69-9a77025d8b92", "value": "192:42fx7odDX6HwHs5wF9jrr6OyTgev5+VG8bWJHb5B08kEZx4e4x:42fGDqG59jrr638eQETB08Fx4ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647719161, "uuid": "7e5c301d-7095-4b9e-8aeb-2873c2307ffa", "value": 11820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647719161, "uuid": "67421f98-7e63-4ca1-9027-0bedcc152710", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719161, "uuid": "6fea11fe-208f-486d-a4a4-0318d5d80aa3", "value": "3c96c4450e1b7c77af8de63f3addaa2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f09ccf1-a71c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647650003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650003, "uuid": "a6bb9916-586e-4e7c-b413-4b85b39808a9", "comment": "Malware payload (Heodo)", "value": "18ecdabb75326ef7701426ec78eaf155", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650003, "uuid": "6e672f89-5186-44eb-991c-c85cb863c668", "comment": "Malware payload (Heodo)", "value": "351a3dd1a45aa183121158949cdf7b5fe24092bd3cf3455c44535a682bbabb7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650003, "uuid": "f4b9b353-4bb2-48e8-9a61-c14f9a2a5329", "comment": "Malware payload (Heodo)", "value": "a05e84d72bb4c47a1c9589415c0029bf995d2750", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650003, "uuid": "5d847ed1-1768-422b-a0a5-0bac47bb7862", "comment": "Malware payload (Heodo)", "value": "8dae48b6e2098d75d0dae4ff401cf4810f33033c33e430984909b6c1ad1820390a247042067171a97feb9810f56851d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650003, "uuid": "bc7beb89-126e-4be7-ae1e-de8835473ea0", "value": "T128D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650003, "uuid": "16655bf5-b2ea-4d80-939f-bc8e6ffe5387", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650003, "uuid": "82a4896f-1bfc-4ea1-b0c2-f14064ac0740", "value": "12288:UWBpwupxl0OeL/grx2GzO+r9AjCb/XKh:Psupxa/gZ2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647650003, "uuid": "a647eebe-8d7c-41af-8adf-bc71daf0d7db", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647650003, "uuid": "49d2695a-9f90-4d1b-8118-6b4ead59a83a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650003, "uuid": "0f18b181-1765-4bbd-a8d2-5ada8d0dabab", "value": "18ecdabb75326ef7701426ec78eaf155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd78878d-a740-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1647665730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647665730, "uuid": "25866f5d-633c-44d4-b002-f978cdd52510", "comment": "Malware payload (CoinMiner)", "value": "8e7189bc1559c135c28ccfbbb57b8332", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647665730, "uuid": "6369270d-9710-4461-b775-046a8fe63632", "comment": "Malware payload (CoinMiner)", "value": "354d75a7702604c1424e1e922958a93e5911ed356a5736f1a0f4de84eca02412", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647665730, "uuid": "659afebf-358a-41eb-bdee-32913fd959c1", "comment": "Malware payload (CoinMiner)", "value": "5d113feccaf88956be8e0d917f1ea7dd5bb54377", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647665730, "uuid": "f1fc5abb-94c3-4821-bdd5-1022b55f7d12", "comment": "Malware payload (CoinMiner)", "value": "702902f029972128a87a6c60ee83513b93495310f1c7959e1af22bc607b7497ffb6ac330d591d2e94b040e64a4483c44", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647665730, "uuid": "062425d2-db2a-46d1-aa94-de9134d0760a", "value": "T17446336BEB133D45CA7788B44F2C06978482030B9DDD9D9AED8E918F27296E37903D17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647665730, "uuid": "58efd1df-cc27-4b63-a609-8352e9fdc6a4", "value": "31023d5744de3370464ffe7b77a57d1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647665730, "uuid": "8698b1ab-3212-4541-a3ab-99d90e841d73", "value": "98304:LZ97cdM6kVunOON+b/ROdw758l0SG04Ip5NJVWgdFb+rS3vY:F9uM6kQt+8CSGbCnZb+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647665730, "uuid": "726064c4-4689-416a-bd82-c36b9031c4d0", "value": 5631654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647665730, "uuid": "925d0b53-be64-4e16-95ce-81335fcd98ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647665730, "uuid": "a2999744-06bd-46ff-981e-96ff61a4bd8d", "value": "60668405.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cee06b-a767-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647682198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647682198, "uuid": "01a60449-c43a-4918-a29c-a16729f57596", "comment": "Malware payload (RedLineStealer)", "value": "3bf01f0436a5295ca7247b87274a6650", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647682198, "uuid": "767b94f6-bfd4-4f82-a3a1-f33ec607b4ce", "comment": "Malware payload (RedLineStealer)", "value": "381517605def58f63a5aabe969f824b399e16c952042d3d549bf4a276d433eb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647682198, "uuid": "76829292-b12e-4d28-8f86-7b7b7d1200e7", "comment": "Malware payload (RedLineStealer)", "value": "6abe39ad6833025485227ab87f24c0d697fc4b0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647682198, "uuid": "aea4bc08-0a5d-4187-bc4d-1bf62d3ebefd", "comment": "Malware payload (RedLineStealer)", "value": "cabf12cca9e93eb3cb411f3e9cc2e80d107f243a72923317da73b5b512181317ac9a933b0332929298d61fc35db6fb99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647682198, "uuid": "6b9c38d0-0016-4961-9056-e7357c3886be", "value": "T1DAC423F957C49A0CCE0B46F8BF86295E86B70488C496331376FB34879BF84DF6A45264", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647682198, "uuid": "2a3700c5-8cf1-454f-a1d7-ddd5629e91dd", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647682198, "uuid": "74daaabc-785e-40d4-961a-a04ae81b6d19", "value": "12288:K8jyffsYT3I7ejp7QS03ULaHNqrxlKIQNoPSHXjbIgQUrr7MLZFW:K847Y7eBkEaHNYK3fTbIgQNLnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647682198, "uuid": "ac98314a-9e57-4981-aea1-71f87005378e", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647682198, "uuid": "4bc21cf2-632e-4a53-922e-c362da4b070e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647682198, "uuid": "1f826d37-007b-4abd-9517-796e463e1fb4", "value": "komaruteamsup_crypted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ba2773-a7a5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647708857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708857, "uuid": "f73a29a3-6fad-4f7e-ac10-73698622e487", "comment": "Malware payload", "value": "93a7b6f76491e52cb8b49f1305812fdb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708857, "uuid": "9d5eefd0-558b-4595-b40a-3296bf847115", "comment": "Malware payload", "value": "3835c31ea805e35b64345553d7555af65b38051204a93b341cb7329130f36042", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708857, "uuid": "fb3585ae-45b0-442a-84b7-7e2048a6b88e", "comment": "Malware payload", "value": "c4cae65a669babf0479bc137f60f91037cb58241", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708857, "uuid": "0cb9f2df-b045-409d-8a68-3e63094719f6", "comment": "Malware payload", "value": "2b19a7249cddbf73f38b6c22d41ee9eb5440b10890f607e911ed91c85a263c0c27268aa838794ca76a41b177ea4b0a14", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708857, "uuid": "8be6fddc-760c-4faa-a38c-5701bc86becf", "value": "T18FA4232B03185C6BE5AD85357B68B9F452D2C6E62F6DA4B0B0802ED71FB43148EA7F05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708857, "uuid": "60d1f9c4-7c44-42eb-bc9e-07f7a9a832dd", "value": "12288:JonLafKj4ZsjJ7DLB1FjV8MIcf8SXzBuB8tETU:JbyE07R1FjVR1ESt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708857, "uuid": "42d36fce-deee-46cb-bf2f-173d62cc4558", "value": 487389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708857, "uuid": "4ed56010-4cb0-4b52-96cd-3fbe60daf46a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708857, "uuid": "8ffa0318-f060-4b7f-9a81-3f30bc21ddca", "value": "OFFER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ea60ba-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648598, "uuid": "61bd0977-fb13-4693-99f3-6747657ea960", "comment": "Malware payload (Heodo)", "value": "8317ac1f022f74c055e8929e5305df23", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648598, "uuid": "a0691a6b-11c7-43c3-b19e-e6add89b6023", "comment": "Malware payload (Heodo)", "value": "3afdd550f8b95da966a08ad154bfb24c0f8e655a2952313e7dc6fb70e27f3f98", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648598, "uuid": "f4b6c0c2-bf6c-418a-9710-010187bd4cda", "comment": "Malware payload (Heodo)", "value": "ea6481a2c77c0f0bb6b6997a9f5c49284e4df274", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648598, "uuid": "07a26421-2397-4b81-9190-6dc95830c46c", "comment": "Malware payload (Heodo)", "value": "2780a07af5555ad3f0fcab494bbf96e298a34eddcc183e0f9fc78759ad07fad86fa34d12f0bbff3656f0001ce737d351", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648598, "uuid": "4d8984a7-16e8-4830-9a0a-e9de03cc5d1b", "value": "T16DC47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648598, "uuid": "8e3708a2-1db2-4a81-aa7c-a326dd7f5034", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648598, "uuid": "168ced8f-d65c-4a48-8d73-ac6affd44937", "value": "12288:S54yM33d3q3Z7BoglreNmF+U/9JckIAGfUeb:SKh3831BoTN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648598, "uuid": "850e6b8a-9536-4bb3-9dbb-06a9f5cc737a", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648598, "uuid": "69836983-140c-4733-9c5b-f57335766bc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648598, "uuid": "0faacd20-f1e7-44c3-9434-723778a2f5fb", "value": "emotet_exe_e5_3afdd550f8b95da966a08ad154bfb24c0f8e655a2952313e7dc6fb70e27f3f98_2022-03-19__000953.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64c652f-a743-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1647666980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666980, "uuid": "e440e06d-05c3-4281-ae85-5243383ea36e", "comment": "Malware payload (DCRat)", "value": "c8add1b132c55789ebb6a66f94ecc76e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666980, "uuid": "9585a928-e5f9-41ad-a10c-dda57193ecdd", "comment": "Malware payload (DCRat)", "value": "3b4357ccbe5c7ec75510c453b4b191cf5f076babbf645938d4584ba9bc532e19", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666980, "uuid": "720a5ffc-dc41-4268-941b-af8e831361d7", "comment": "Malware payload (DCRat)", "value": "fc2ae28f9fdeec92364e9d6a328f565e738315fb", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666980, "uuid": "fa447277-79df-4f24-9da4-a3d461dbf7cc", "comment": "Malware payload (DCRat)", "value": "6f7875e2f0e159dd54b494edc880b161641d9fa0f54cf29925ccb1a3542ce94f24b71d49952e57fd9ec2df0a26968e0d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666980, "uuid": "66acc1ed-61a7-4eda-bba8-45dcfcceb017", "value": "T123F4F112FAC4CCB2E06601729937AB115579FE301F768A4FA3D93A39E9323D19636247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666980, "uuid": "0b8b9b31-a293-4979-8ae9-8ff8bbbcfcf8", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666980, "uuid": "8242973a-7116-4aa0-9f59-6b7fbf904627", "value": "12288:5ToPWBv/cpGrU3y4q6s8mUaEuUkGwz2FSkdCw2Jb8XYsxhq:5TbBv5rU5VmFUkGIq7Cw2N8oD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666980, "uuid": "576656f1-5a83-42c2-9ad3-00f478975eab", "value": 780801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666980, "uuid": "034334c2-24e8-4ac1-98c4-783e1e8fc535", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666980, "uuid": "ceeb7573-02bc-461b-8a45-aa93f3ba37fc", "value": "c8add1b132c55789ebb6a66f94ecc76e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ac666c-a781-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647693551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647693551, "uuid": "9e27670c-3d15-4f14-90ca-9849cd85bcde", "comment": "Malware payload (RaccoonStealer)", "value": "ce82ca20c64a4699a03cf0ebf8f3db4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647693551, "uuid": "ae7d288a-4992-4e63-8f60-449eb3488f61", "comment": "Malware payload (RaccoonStealer)", "value": "3c072e8447a090783007f41a0293c619b455742d4d1b35011eb112a1b8cc2e12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647693551, "uuid": "6d8ae7cc-7fd8-4f12-8adf-a21589638371", "comment": "Malware payload (RaccoonStealer)", "value": "b75d14b3896bdb6dbb878b92ff98c376d6e2ecfd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647693551, "uuid": "2bfe1702-9241-403c-81f6-6783b4e13f6b", "comment": "Malware payload (RaccoonStealer)", "value": "e1429e46e2b471d8c6e1e9d34c85448e73376f3c35959d8ee2d5783c79336ea440fb43da6dd8f60b24b3dffcff4b0c75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647693551, "uuid": "b33e9165-f5ec-48d2-8dfa-2aa5185c1cd7", "value": "T194C4E150BBA0D03EE1B311F4787693A9753E7EA15B2410CF22D66AEE56342E0ECB5317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647693551, "uuid": "7ec37136-a2f0-4255-ba79-651d984253a7", "value": "4afe698a4ff3f157978858a4a5de1db8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647693551, "uuid": "bc097f86-bdb0-465b-9cf2-4b58a86103f2", "value": "12288:gdWe/K8QU551qxnQvm85azZ+r6uKUM0dftS1l4pnnCrIeZib1b7syDVCn2:ZKWUjUmvPwc2ujM+ftS7cCrHiJsbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647693551, "uuid": "c75101aa-eca8-483b-baab-aa7a2291d0a6", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647693551, "uuid": "4aac67c9-26d3-4d8a-9c4b-393dd98a675f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647693551, "uuid": "f27f9e62-abb4-455a-914b-b17b0ad22e1e", "value": "ce82ca20c64a4699a03cf0ebf8f3db4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3ea21c-a741-11ec-9275-42010a9c0029", "comment": "Malware payload (PhoenixStealer)", "timestamp": 1647666102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666102, "uuid": "6a6783f4-d262-4fa9-bb59-3509d5e81473", "comment": "Malware payload (PhoenixStealer)", "value": "add658b878f56073cd43eaa869341400", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666102, "uuid": "53eb00b4-6ae9-4aa5-98c1-f32f3d627962", "comment": "Malware payload (PhoenixStealer)", "value": "3cc17e8a578397b8dad4299539f31925ea3777455d112dafbaf7df283c7cb11e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666102, "uuid": "763e9b56-0fc1-4f55-a861-fde488abcfa9", "comment": "Malware payload (PhoenixStealer)", "value": "79083cfa2282242a3471c823f6480fea695aa56d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666102, "uuid": "c286c74a-d360-4c1c-ac89-b28a7effa185", "comment": "Malware payload (PhoenixStealer)", "value": "7e7a39dbe83d2e04d735ea035c2f5d421e008628d542c0f33b4e10e415a0542306bbb3aa0947f01a5df69d9f31ae6f2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666102, "uuid": "1ffdc8dc-ee1f-4d46-a7a5-4adef2a36be6", "value": "T175C4BE17E6428076E4632430265D9B7649BD76300A2655BBF3C42E2D9EF02F2AB35F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666102, "uuid": "121f7a92-a4d9-4811-8a60-babf52228df5", "value": "06c6e92acd3ff57b00b3132976b3f6d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666102, "uuid": "75cf7acd-d365-48fc-920c-11f854efe509", "value": "12288:F7vT8cGUCZmxIwNjVGCXZqmmJUL+JHkdIUnjoqhwTw4d:Fz4BUCZmxIw1VGCXZ5mJdkdZnBhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666102, "uuid": "87076425-4cd1-47d4-84ac-7854579d5876", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666102, "uuid": "8cc1c483-e730-40e0-b7da-70184d890dc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666102, "uuid": "45772563-8ff1-4551-ad19-a738aa1a7e40", "value": "21214651.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a246e70-a741-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666020, "uuid": "1d08b1fb-b4b1-4a9a-926f-f6d8d83f066d", "comment": "Malware payload (RedLineStealer)", "value": "359e4504d8d40d09ae1d3ffa0a42ace5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666020, "uuid": "c2e08a84-7afa-48c5-8a5a-fb6d459a29d6", "comment": "Malware payload (RedLineStealer)", "value": "3cf9159bcdcb4a0b0ae77006ce2266c752363d51441a1061c9a03b0cd71873a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666020, "uuid": "0e7c5a3f-b31f-452f-9a65-050a90b711ff", "comment": "Malware payload (RedLineStealer)", "value": "0e50f2d5e70559dc49aa339fb5dfd73ee483f88e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666020, "uuid": "ae4915c1-0584-457b-8f4f-c8c7671d5f5c", "comment": "Malware payload (RedLineStealer)", "value": "970d72c0fd4d09d5dbc5fd630befb97a2e42f8a54251ab66c0dacfd25d86ce3f8d3e79566e9ba0af3981c26fe528ef62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666020, "uuid": "26dd4cb6-7014-4f3f-8e74-fac065033c80", "value": "T1673633AF89502492C8CDFBA05B750C2143B879A3A7F7674BB7ED0DA35451A5FFE20620", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666020, "uuid": "10f8f3a0-9835-47a8-a07b-1a987a9fe559", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666020, "uuid": "270ccc2f-0ba1-4ff9-ac23-8dd9d4fdd3ec", "value": "98304:2p2BJ6Y/5dbiYd0iXjqWHuEVnf9Ri6mNm+KcyTGsgORRER6zQNjDq6v:2pHYdNAUfSg+McgzSjD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666020, "uuid": "8c0b82c0-60b7-4abc-8a11-119cbbbb4cb4", "value": 4876952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666020, "uuid": "b0708a0b-fb5a-4df8-b531-8a00fed8eb81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666020, "uuid": "186b6392-e846-48b1-bdc5-2834df4b7290", "value": "20562945.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "993097b8-a743-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666931, "uuid": "7bd16207-0e05-40e6-a1e1-e38b56fac340", "comment": "Malware payload (RedLineStealer)", "value": "aa0d4fa15da2ffcc06d16d362733d55f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666931, "uuid": "ff27644d-7c79-4bee-90f6-0f600e437763", "comment": "Malware payload (RedLineStealer)", "value": "3e1a6299d80d53a831c2e6759ce2ac41e6d9aa6603cb2a1df7efbfb86debefa5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666931, "uuid": "41eede7b-3fe1-4669-ba7e-c21a296b06cb", "comment": "Malware payload (RedLineStealer)", "value": "056b336f6166288c1ed7cbdf781f37eab75c0f8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666931, "uuid": "63e88c67-5058-427b-be47-8f8dc24ade1a", "comment": "Malware payload (RedLineStealer)", "value": "946e58acc31516d8ff0b41a5751c28cb228be2b9b7731d54a94b1c921963b7d92de5bbc4902353629b18c47c45301f30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666931, "uuid": "576dcc82-83b0-456c-9968-3de1df1a1bed", "value": "T1D375337A73C2E07AE2242AFC9E3D5609506F754FAFD1B8B493AC09D578CC498E6C94D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666931, "uuid": "cbe48390-2ef0-4f24-a7ce-46ac120c419c", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666931, "uuid": "1b899ff1-e275-4101-a659-302ac0d346d2", "value": "24576:eTQ6EUjmce7sbvraS/DrDU+CZGSZExANojgMSKuMpZDoUOu3CBVRgkEaHNYK3ucy:vUKRqPUhZExANojxuMbrPytgNawS3gd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666931, "uuid": "2068efe4-a754-473a-b6a8-c01324151138", "value": 1615360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666931, "uuid": "4572327c-aac3-4cbe-a5ee-152c02edec5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666931, "uuid": "3ec38c7a-872b-49a9-9464-14db462aaa6b", "value": "27792839.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50751a68-a7a4-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1647708470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708470, "uuid": "ae526274-d522-4435-bae0-eb897193e0fd", "comment": "Malware payload (Socelars)", "value": "e8d6d7ce29b27db16d8e401990528fd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708470, "uuid": "d3700383-a5df-4300-9176-124900e75a67", "comment": "Malware payload (Socelars)", "value": "3e9f8a23ab29dc16006d57204e1bf006257de4378cf4e10943bea540cdf2b468", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708470, "uuid": "303aa835-6ad7-4248-86a0-e7ab8aebc1ef", "comment": "Malware payload (Socelars)", "value": "97f4ddbea97cd2e99bf13235affef71c7f54d325", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708470, "uuid": "7a5dae02-fd43-444d-98f7-47efa11c211b", "comment": "Malware payload (Socelars)", "value": "909e52df9b573c3d413e955b2aa6601294d720b9ce2f654c700b1b6bd9c2c8c1c5e327930310fdb45e78e6c7b3b86477", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708470, "uuid": "a6d4967f-e96e-495e-8979-2086f45fd387", "value": "T153659F11F642A036ECE310B2C6FF4AFE8D286A21031894D7D3C46D695E715F27A37A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708470, "uuid": "5ce2535f-0ec9-46f9-b2ea-ad8af0828e20", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708470, "uuid": "a06c67b1-4ebb-4e46-bee6-6f455e4561ac", "value": "24576:Iwpk4V9rRM1oDb+enGs2Q6E9ZBJRPHJYrFSJ84ufUgKFcuXsg:dpRc1OMcV8sJjAUgKaRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708470, "uuid": "a13d6680-e48b-4f2a-9c1a-db2f02931b32", "value": 1514496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708470, "uuid": "c627cd96-48ee-4a35-a8e3-db3b8b2cf24a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708470, "uuid": "31e80d99-d63c-4fbb-adec-d14c150795ec", "value": "e8d6d7ce29b27db16d8e401990528fd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f32532-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "2773e0ee-3448-4633-9ee7-aa21e9a76509", "comment": "Malware payload (Heodo)", "value": "33efaca5b974380826836183d5e3392f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "6bf1f5fe-8432-4a47-aba8-04440ed8e0cc", "comment": "Malware payload (Heodo)", "value": "40828cbbb0f4ec10ee238d4deff067546b2316c56fd77ffeddf29a9208d3cf23", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "16c89cf9-b037-4eec-bd2c-3c2b4e31e100", "comment": "Malware payload (Heodo)", "value": "06258e04fcabc80325f236b1f9112dd36689a10f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "6857f27a-381d-413e-9dde-f8c3056c2b82", "comment": "Malware payload (Heodo)", "value": "f61def8cf70d06cb66b79ce483cce3636826e794625c5429f4e9e31cc722be68c2dc3b33a3087e9437cf71c3d3fc6105", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "b3aeaa28-37a6-4bf3-a8b5-aa0de8aed8a9", "value": "T139D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "c421131d-f667-4173-8444-cd8a1dd8d2a7", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "47602752-ee72-4ae0-9f78-b17ebdaf942d", "value": "12288:UWBpwupxl0OeL/grxpGzO+r9AjCb/XKh:Psupxa/gU2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648457, "uuid": "761de7e9-f0eb-4d92-b073-166ef900ea44", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648457, "uuid": "15e132b9-0f17-4d5a-9985-b01b12a2a687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "a25e3f0d-3dbe-4f7a-a0f0-23251bd0ff83", "value": "emotet_exe_e4_40828cbbb0f4ec10ee238d4deff067546b2316c56fd77ffeddf29a9208d3cf23_2022-03-19__000730.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08230f4-a7a5-11ec-9275-42010a9c0029", "comment": "Malware payload (CobaltStrike)", "timestamp": 1647709115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709115, "uuid": "79d3f674-8a29-4faa-9446-db4764a3bbf7", "comment": "Malware payload (CobaltStrike)", "value": "61fbae60a51d1d38d72d01e75947e990", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709115, "uuid": "be329169-57df-4b6e-b760-ef0d0e6b186f", "comment": "Malware payload (CobaltStrike)", "value": "40c516a67062e113e4d9211890b926bc04a76624ab12379485014d4f5e987538", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709115, "uuid": "3271d30f-3958-4168-a964-1d759bce77b0", "comment": "Malware payload (CobaltStrike)", "value": "265561f8aba7a1dd0a21e96c0e9291f79a30ce76", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709115, "uuid": "44295241-7913-4a24-9710-618382827d99", "comment": "Malware payload (CobaltStrike)", "value": "57db15e8b1ddcfbe77d31dda747c15340a8ecf4bd463e6a1f1fe108b532d9b3544eb3be20576b9b04a04c3d1ad41f7bf", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709115, "uuid": "04e04b1b-bb87-4910-a666-0f1eeb7251bb", "value": "T116256B0BF6B842E5C0B6C17E8593966AF7B2B851473083C752919B1E5F377E4AA3E301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709115, "uuid": "bef863a0-8b78-41a7-80a2-d12beb4449b0", "value": "a62a4e55e145a922e3a860d82c01e587", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709115, "uuid": "f6476d2e-982f-4679-85d0-62ed4fdc75ee", "value": "24576:p1PghBzKWN1zjpjLJ1RxfawzZA2UDF/WYVO0d8:pVax1zBLnfNZA2UDgYE0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647709115, "uuid": "186e843f-2420-45a4-a45f-1f52ec194b2e", "value": 1004183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647709115, "uuid": "7c34a50a-9a2b-41e2-8064-3de8a6eb9b6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709115, "uuid": "1ed09147-5148-4495-bbce-6d084bba5f7e", "value": "61fbae60a51d1d38d72d01e75947e990.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd647c06-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666670, "uuid": "3d1ac05d-20f4-4cbd-a43c-ba11d0cbce46", "comment": "Malware payload (RedLineStealer)", "value": "8b2b5ebcf5a28a1cb95c1a3461c819d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666670, "uuid": "5ce87cf6-ce95-4f20-92db-20737c279118", "comment": "Malware payload (RedLineStealer)", "value": "41caed2870d3a4b0e87bdf814b98d656c043f9dcdb386517fb19a805e8e26212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666670, "uuid": "e3027404-5836-477a-af11-37440b131e29", "comment": "Malware payload (RedLineStealer)", "value": "facc136a6c5557dc88705ed05075af1cf2118091", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666670, "uuid": "d445da47-3797-4837-b245-af5121157234", "comment": "Malware payload (RedLineStealer)", "value": "4e021cda087c9f705fca8d5a85a634916e7c0cec5b795928a3f572161afab7143d3de07083324e226d5a4303f907bcf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666670, "uuid": "c99e5f69-7d56-44b8-8730-63245f0b797b", "value": "T11A0623A685EC1D4BDA5BF27460292D07D6CF1D70818991462BA9BC36F3FADBBC1440E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666670, "uuid": "bbe69599-997f-4d37-a45f-5f54455c0ac2", "value": "41304e4befbbd8a63ad6ec59f252160b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666670, "uuid": "2d07167e-10ca-46c8-90e8-0586a9426274", "value": "98304:aVBB+4pjnaPa6Nn6J/mbUtgHUI4OADtZbUwLWjmzP:4Bhl6Nn6J/mbUyHGOAUwLWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666670, "uuid": "92774c57-84bf-4f8a-96d6-f226a8ca3bdd", "value": 3885568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666670, "uuid": "17456f88-8be8-44ab-8dfb-b1b55f33fd22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666670, "uuid": "566a7007-c9f4-4cb6-bc3c-1e8d10fa0a62", "value": "25704973.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fd639a-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "cc343b08-d4a9-432f-bcb7-ac4239f353ca", "comment": "Malware payload (Heodo)", "value": "1547219ad7629095365ccd748aef3fa2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "41705f2d-acf2-4e31-ba5e-7d5970099ff1", "comment": "Malware payload (Heodo)", "value": "41e5220c75553389254a88d46082cf1989e56610694540dfad85090042495785", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "3fe0856e-b276-4f57-9874-35763b10a737", "comment": "Malware payload (Heodo)", "value": "1e52ea59704c8aa54273b3607e263584b63b76a5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "a5265fd7-07c0-4eb7-92f9-0178f3323cc0", "comment": "Malware payload (Heodo)", "value": "68717950c4e189cf895cd2f6f983563b3f6e21354cdd2b0f50351da632180d1f14049968fc02e7a059d9b8311129c9d5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "776904da-0b6a-48a5-a7f6-1cafb15fcffa", "value": "T109D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "8b994979-1768-4924-a36e-c8515319df25", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "fe5c5e32-7c59-4462-8cd4-d1e54620f8ff", "value": "12288:UWBpwupxl0OeL/grxFGzO+r9AjCb/XKh:Psupxa/gs2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648457, "uuid": "007dacd4-7299-45fc-9ef6-2e8bcc3e0f1c", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648457, "uuid": "3e0efdcf-b1b2-47ba-b98c-74013e9e5357", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "3ef2cc3c-43d6-4e9c-9b49-0e4e258d1c64", "value": "emotet_exe_e4_41e5220c75553389254a88d46082cf1989e56610694540dfad85090042495785_2022-03-19__000730.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05f2f04-a7af-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647713409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713409, "uuid": "27f79e06-0a59-4d34-b0d3-bf7924bc2a0b", "comment": "Malware payload (Mirai)", "value": "0cc7c243f811e04b830a8314813157fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713409, "uuid": "7b93c063-bac8-4eb1-b756-6eca483a00dc", "comment": "Malware payload (Mirai)", "value": "4380b1d1ed1c02f442fca1ee476c2c656cd5456939456983225cbd57b57e5246", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713409, "uuid": "3ffb5e5b-e734-43c5-a50f-aa521364b7e7", "comment": "Malware payload (Mirai)", "value": "5d467f6f425b7c91f3f4cfab024a2b17985e9a9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713409, "uuid": "561e9df5-bddc-4f18-970f-6acbd0675f20", "comment": "Malware payload (Mirai)", "value": "cb28afbcf21be0b74d748daa805d1bf883ed811ec31a16fa5248f1f0e8d0c96ece8a729c25949465ebbf639ef7578599", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713409, "uuid": "3b074a6f-5c3c-43ca-8d18-9adde16689fe", "value": "T145B31A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713409, "uuid": "8fbc2b76-37ce-4c18-9748-6d557f34e2c7", "value": "3072:pC/4rdZHsXsZwwR9iNk5mm/QcuLmHniPNb:pCwrvHwsZwY9iOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647713409, "uuid": "1e23a254-f792-43c6-a1fc-22825551002c", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647713409, "uuid": "e31e0e86-9243-4d8d-8191-aa2b79122a73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713409, "uuid": "efd6681f-7781-4c11-9a9e-bad523a95cdc", "value": "0cc7c243f811e04b830a8314813157fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d361500d-a7a4-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647708690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708690, "uuid": "9180bc9f-425f-4f58-8c6c-e90f0fbdaff3", "comment": "Malware payload (Formbook)", "value": "126e9f12b4685d85bbe762c28c21a620", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708690, "uuid": "f3d7fa79-b15d-4027-8115-71979ad2d34e", "comment": "Malware payload (Formbook)", "value": "43a45b5e5d4b0d325358b84ab6c16d4c80a49d3723e3c31909dcdad87cbca07e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708690, "uuid": "18061b98-8462-44fd-aced-dca7a3fb1679", "comment": "Malware payload (Formbook)", "value": "1c2f2037bcbccaab610d34d8b4b7f1595a796a3a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708690, "uuid": "599d5224-5167-48d8-afb0-3dcbfa04e476", "comment": "Malware payload (Formbook)", "value": "90c9cc02684373e4ea2c821b049826d999ac0009b2747e582f3d441a6e4d12e6b620ab56bebdd992d202f3dce48ad0db", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708690, "uuid": "381713b4-07c2-45ae-87b6-62c5132845e5", "value": "T17A141206B3476742E1F8A13F851FBB627234ACE3463EDAA2C66EF447847138B785560D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708690, "uuid": "42d7e06f-f508-46a1-a3b9-cda5a4eba341", "value": "3072:qIO3LPuJEcT/ySwZW3exOG/J6lryAO4LRnwR2lon3ytJXKGUz9B0DKHqDmoDZ2x:HO7P9q/yCZGYpyA4Xn3QJa9cKODAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708690, "uuid": "6a86f82f-81a9-402f-ae8d-c77b2408e5c8", "value": 191272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708690, "uuid": "71dc8043-d251-49de-9a22-a42d5c45a5e0", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708690, "uuid": "84a615c3-b67f-429d-aad2-aa051c0f3c91", "value": "Awb_tracking_receipt_0318202291319800000000000000.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e22d13d-a7a5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647709003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709003, "uuid": "e967c182-8d5d-450b-88d6-1d175c495ecd", "comment": "Malware payload", "value": "2475b88c447d3260758d6cff863fc0c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709003, "uuid": "7f54dd6e-526f-47a6-96ca-ffba3caf6ecc", "comment": "Malware payload", "value": "4480250209cdd20bbfff913aaca7887cc68bcb592c12d84b39c0dbaff39175e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709003, "uuid": "15e66e89-b844-467c-bbe9-4e5954e3f717", "comment": "Malware payload", "value": "5b7509860ca0529f0473684b9f0046a35d7a29f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709003, "uuid": "2825c986-aa5d-4f1b-bee0-57d4cba813ed", "comment": "Malware payload", "value": "30ee50916c98843a0e3a225b752010d5cc1c124566dfe2946033e4191bc3ddbdb8ecae7b83bbe7ce9c85dc8ea592fedd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709003, "uuid": "bf7b2f89-4574-40ba-b3dd-e616702c44ca", "value": "T1485430867A0E821FD3331A78068AD517E924FD0E3A76CD13BE5D721D3B336977891292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709003, "uuid": "5bbc2139-9fcd-44db-85af-7672fbec65a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709003, "uuid": "a58637e1-98a8-44b6-b9c9-f9948bea68a7", "value": "768:y1Vje3/fKDV7VVV67VVVnVVV8VVVzHVe47rAVV0Jq:Cj46muM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647709003, "uuid": "61a89051-8a40-4ec9-8539-4afeb3be6954", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647709003, "uuid": "d3faaff0-52bd-4dcc-8a74-354ce8a39a31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709003, "uuid": "f13f6285-306a-4b5b-8e0c-073666b0530e", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20dbf9d-a755-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647674784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647674784, "uuid": "5a98b41f-0949-4d6a-9b59-8cd0392ab7ad", "comment": "Malware payload (AgentTesla)", "value": "2e87374ce8371648a76f80e698f0ea7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647674784, "uuid": "e96fa626-3bb9-49b6-9795-7ab521537c16", "comment": "Malware payload (AgentTesla)", "value": "45783e7e511965c5ecd64b76a341e5d669ec587a52ab91e0c167c0eaab5eb45e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647674784, "uuid": "99d30aae-3e76-4b64-8abb-715003371bc8", "comment": "Malware payload (AgentTesla)", "value": "fcf31b76d7cbaaba310a625a148460eafd09279e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647674784, "uuid": "cee57eba-9b25-4677-be1c-465d5387adb2", "comment": "Malware payload (AgentTesla)", "value": "8e7bd1dc4f0175af6d18b0d3ae4cf4fd54aec477f2ed104e5709a210b378f040897088a8d61c4fa0b8d42afbda026bee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647674784, "uuid": "c0dab53a-11f6-481d-82cf-dd6094dfd883", "value": "T10F8423911B39A5669610C0DB7750831A2299BEE348C5E870FFDDD37CA693EBE1EB4430", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647674784, "uuid": "1892cda0-5df5-4122-bb08-0d492d920e12", "value": "6144:dtoi2wJcjen5hcxu13RzTnVLtHjB/WbyiYAr/ib2W8CbMsrS0W0YGeaRigZVs+Sc:/wwJcKJ139TnjjJWe/ArKblbMsO01YGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647674784, "uuid": "6033190e-1979-43b4-9ebc-cd6a1b92298e", "value": 391373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647674784, "uuid": "4bcc05a9-1d3a-4529-bbcd-7623fbed3ac5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647674784, "uuid": "d2f1a15a-a74d-4385-9dd7-f2cce52abd8f", "value": "11317693065_03162021.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b0ba7c-a7bd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647719213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719213, "uuid": "0a4aec75-90c6-48c3-87a1-cc5a79b53598", "comment": "Malware payload", "value": "cd6a265d0414c1c8800ef4d00e2ea2bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719213, "uuid": "6fbb86cc-4b61-435b-8edd-d780e12c955e", "comment": "Malware payload", "value": "46e4687936f88441219e3912165bacf6d2012c6ae00b390952dcfaaa0380f8e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719213, "uuid": "1641b985-d6e2-429c-8353-1155547097ef", "comment": "Malware payload", "value": "e7b9e24852105d992e8a55452ac3f1d3b80c701c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719213, "uuid": "a59ab6bc-f21d-4ea3-addd-d5a4b2571383", "comment": "Malware payload", "value": "4ddd34d1369971590fe254b62c3b91615b7df3055fb36de9a8ccc75e8794432bb3988e371e0101cd3e4c774f2fb35755", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719213, "uuid": "ae433ffb-6d31-4c69-8da6-99f41893917b", "value": "T1C0721E892E229FEDF62DC63547B74E20635823E526E1AA84E76DD8040FB030D559F7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719213, "uuid": "234a538e-c7a2-424d-9cb8-8d5eae37a3ba", "value": "384:Ol1A7+cb1dU+OA9GigJL7+fvSFAS5cqRvP4qUMB:OzOuvi9fLB0vPJUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647719213, "uuid": "0d77d59e-c71b-4ac5-813f-0b151ab8c08e", "value": 16164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647719213, "uuid": "c7d1572a-2a29-4961-b4ac-d8c30b3d0c7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719213, "uuid": "d7ede691-2bbb-474c-b02c-6f9d979a2cf2", "value": "cd6a265d0414c1c8800ef4d00e2ea2bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6692034-a7c0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647720667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647720667, "uuid": "fb1c40ab-19ca-41b6-be15-5d471be48ea2", "comment": "Malware payload", "value": "48fa743690e56e3f135c990afd7d2ec3", "object_relation": "md5", "Tag": [ { "name": "bashlite", "colour": "#901CA3", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647720667, "uuid": "9ef86c31-bf73-4076-9b92-5a75d266b3f7", "comment": "Malware payload", "value": "494935a4741fea6a3407a1191515707161f88435f081f1fcb231f56d43d916a6", "object_relation": "sha256", "Tag": [ { "name": "bashlite", "colour": "#901CA3", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647720667, "uuid": "6c413354-0c33-41fb-9b2d-1565570539ae", "comment": "Malware payload", "value": "9697a8f4e4c90c378fde7f2307a329bc4f77c5a7", "object_relation": "sha1", "Tag": [ { "name": "bashlite", "colour": "#901CA3", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647720667, "uuid": "0ce4863b-1c1c-46ed-b41e-fd0de4b27c5d", "comment": "Malware payload", "value": "1fc47084861996e07228367d88a06db6b71659ff66bda1c9c3fdbb25f0614d0022ea6252932fd9ca621b23c292f1dd80", "object_relation": "sha3-384", "Tag": [ { "name": "bashlite", "colour": "#901CA3", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647720667, "uuid": "62614aa5-3601-4932-afa4-daa122e582c0", "value": "T11D619ACB036223303CD1D97F77FE071A7650E4A951D9BA08E9E8AED5C24CD093385A87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647720667, "uuid": "55a063cd-5550-4b5e-8715-144de62ca7e2", "value": "48:MnisymOkKHn3F/g/q/lFnFSFraQGKvFkmRFAKFFnFSF7B+FGgrFsO93pFZnsFPtN:MisymOkKH3N82lmLvfFGCfLpU+iZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647720667, "uuid": "f3c1701c-1ae6-4a1c-9f13-bea9e598037b", "value": 3264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647720667, "uuid": "4969cfa5-ceb9-4acb-82d3-85a94e6737dd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647720667, "uuid": "718a60c8-0219-4150-8954-e04c4f3d9b8b", "value": "onions1337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344214ab-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666332, "uuid": "231a3c57-0a1d-42fc-8f57-f6d05af3afed", "comment": "Malware payload (RedLineStealer)", "value": "ccb7887042b33973bbabc48044266fc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666332, "uuid": "fafc44bf-4aef-4184-a37f-76477b92b30a", "comment": "Malware payload (RedLineStealer)", "value": "49616cdbc02fd68e976fe40f8538a82d65fdf0649501753b6d5bd25de9169c02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666332, "uuid": "22aed18a-8b96-4947-8d67-86f945c69182", "comment": "Malware payload (RedLineStealer)", "value": "84d116e773a6e0f8a7307f64b4fa885a19052ea6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666332, "uuid": "f4adb385-fcc1-42c0-8492-ea3da2742ccf", "comment": "Malware payload (RedLineStealer)", "value": "f0fdb3d964d3408b90faefe5345fe3f96839b49412d9eb91f512f8a0f865b07c3e281aa41af337135faa732b0a888405", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666332, "uuid": "735eb50f-9a07-4659-bbae-93ea2b089b69", "value": "T15EC423186F07E58EF0E5AAB35AB7F55B950A2E431883069F8DCE7FDB50987391D0042E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666332, "uuid": "779d3169-4f3d-478c-9bb9-2301acf9db84", "value": "a46b056f1965aa9a62c3f21951e41446", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666332, "uuid": "9e70e1c4-e372-46e2-906b-cf7958a3cebc", "value": "12288:BW+qnrCCdkBWZBZPx0SkFK/lGRgOUqmq9kR6lhKXbAJ3q2fOmf2dAN:BDqrFd4WpPx0SkFK/cRgOnmq9g6L82fX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666332, "uuid": "4e4a9432-43f9-4a57-b52c-ad8bd7ca01e0", "value": 557568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666332, "uuid": "cecc9e0d-e001-48c4-87e9-f03536d251f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666332, "uuid": "d17f300e-d913-445e-a9da-53154777169a", "value": "22800906.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c0e6eb-a7bd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647719196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719196, "uuid": "9877db87-3456-4df6-9e5a-4edfecf2e245", "comment": "Malware payload", "value": "9c9f2696fb0bb36db2988b14f0cc90f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719196, "uuid": "a7bccb5f-d21b-497f-b85b-ba424c26b8bc", "comment": "Malware payload", "value": "4b58a0df9e5d8ce1c73e707fd6c1100984aa46211a8f807322f9f0ab7408123a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719196, "uuid": "dadb762d-f314-43d2-ab27-a162bbc44339", "comment": "Malware payload", "value": "811d3f3c74acf48ef03284b5b6dfb2424bd03fd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719196, "uuid": "fecce9eb-d549-4a5a-a6f5-dd720dfa5958", "comment": "Malware payload", "value": "34571cf452ac03ad274ea13f144c59ca585ac0a515c1423c1f6c71ac6245777d0281051dfa596ebb198d13097baea87f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719196, "uuid": "e42845f4-f8cd-4646-a6a9-b67b5005c307", "value": "T18EC2C656F9819F11C5D11279FA0E124E77135B2CE3EFB3226E246B34678757B0E3A80A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719196, "uuid": "54f5638e-1e86-4e6e-90f1-2a774fc4871c", "value": "384:/nNnVhJ/9njiXQwM6KF7m31C8sZJE/JAgfdxeaDp3EgXx4elkLhVy:vNnVv/9jigIK7m36ZgJAgFxZDp3aNLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647719196, "uuid": "e52e7103-a844-46f7-a0f7-d8cb672d0d28", "value": 26388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647719196, "uuid": "2e5b6bb6-fbfa-4e71-b1ce-70dad6ef4bab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719196, "uuid": "2451955d-a747-49c5-b871-f5a970c478b7", "value": "9c9f2696fb0bb36db2988b14f0cc90f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1f2d3a-a7ba-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647718157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647718157, "uuid": "b732bf5a-4cf0-4ff1-ba69-43cbdac46576", "comment": "Malware payload", "value": "fa69bb723c2cdbf91413b1a3114a9a8b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647718157, "uuid": "0419ceec-668e-477c-b0d5-e6c166975c34", "comment": "Malware payload", "value": "4b9566ddc47d03177c6537f09195021540af48df4ebef64c4412480b387c6d68", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647718157, "uuid": "43af3104-e09e-4605-a41d-cd5cbdfe2cef", "comment": "Malware payload", "value": "e38e3a7ef41398b29dd58962eb546f9317455ed7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647718157, "uuid": "732c3106-a478-40d5-bc39-738e51d9f211", "comment": "Malware payload", "value": "04efc5270b443f0894551d2c95ffb0c8f9b38b069893047ce62c765db3c364ca065fcdb5132723f1387bf7c7c6be0ed6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647718157, "uuid": "3ab3de1b-38d2-48e6-9e83-8f3a43074591", "value": "T18AA423815322C6A757837318EE52EEE54680DDA0182837AC71E9D6DC476CBE25ECBF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647718157, "uuid": "b1d7b96c-16cd-43a5-9c73-2a17317c7158", "value": "12288:iOOfTxWUxZW2mwzIIGzawf6LNWBYEEL+Lon3ef+DhAq:iOOfTkYZx30ewf65WBYOofdAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647718157, "uuid": "c99777e8-1f1f-41d9-bfb6-6425ffc34d39", "value": 486789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647718157, "uuid": "21323048-d526-49df-b863-3115d55a498f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647718157, "uuid": "7dffb506-9f95-47ed-a9aa-88adc27aa8f1", "value": "delivery status.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3eb56d-a71e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647650832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650832, "uuid": "8407c911-bad5-453a-8875-a8bc68c76fa6", "comment": "Malware payload (Heodo)", "value": "c6a93941ae84056d749a3d96a0103e45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650832, "uuid": "e8ad4c7a-69b7-4a6f-b753-b3c91c60a1ee", "comment": "Malware payload (Heodo)", "value": "4bd5c8b57bc21e7b3bfbf287e85917450e471a67b3300d0cee005e6ba7431ed3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650832, "uuid": "72c1da67-59f1-4c2f-8d1a-b44613a45a55", "comment": "Malware payload (Heodo)", "value": "942e89cf5f5a3d45586cdb440948ae65870c4001", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650832, "uuid": "a6cff75c-72df-4d7d-ad8b-0afef8a4f439", "comment": "Malware payload (Heodo)", "value": "b9cb5336727d6138de39442733660e27ce200d5c0ac945166583584ecf24fcfaab7f90baa2ed9c8f5dfb8f2d64c91d28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650832, "uuid": "f090959b-f0c6-4a05-bdae-9a040b354b79", "value": "T176C47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650832, "uuid": "987a91e4-1ac5-4da3-86f4-7649064af6fa", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650832, "uuid": "f4211c79-168c-4c7d-8579-9cf3826c860d", "value": "12288:S54yM33d3q3Z7BogxreNmF+U/9JckIAGfUeb:SKh3831BoPN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647650832, "uuid": "0b52858c-4b75-4881-b070-7c12e6dc486d", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647650832, "uuid": "cc3a69a8-5709-4ef4-bcb4-19d5d75ac5cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650832, "uuid": "a216cdc4-6df4-4296-8ff8-f45fd160463e", "value": "c6a93941ae84056d749a3d96a0103e45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b17276-a75b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647677289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647677289, "uuid": "6690f12b-11ef-490c-b34c-bdf4cce4e95d", "comment": "Malware payload (Heodo)", "value": "8d0553314b8a9d09d837d586c325922e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647677289, "uuid": "174cfee7-c499-4a19-bb08-a5380758ee00", "comment": "Malware payload (Heodo)", "value": "4c50e287038e18b55bcdc5f10476c2121f74e51a6424b73104ca50ea810a15d2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647677289, "uuid": "5bf0a803-f619-448b-81f8-e4820dfe97a0", "comment": "Malware payload (Heodo)", "value": "bfe29716bedc13cde0c680b00558c8adf488ded2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647677289, "uuid": "669e2b29-87c6-43a9-89b8-20e549857ca7", "comment": "Malware payload (Heodo)", "value": "ae6a76f92ba6368f4eff6a3cc0fcbd224b13e3e25c7bbc7b2c9752d1803a652858b603851f9e051b2a5ed1a4bb6fdd33", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647677289, "uuid": "35769988-26bc-4bdd-8f38-d3f82c67898d", "value": "T192349E52BAD5807AC2F321B14A46726FB3F5D700473A6BC35BD11C286B385D7923CB9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647677289, "uuid": "3901186e-31a2-4026-b44a-52cb32dcfd2e", "value": "6144:WZ7T8DsyVvuJb8fTSeOPwSyeuRJ0tvZVKudKV9x:WZjb8BOPxue5dKV9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647677289, "uuid": "c548bbb4-3cd5-4789-8fcc-a02a2119aa55", "value": 236902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647677289, "uuid": "c1c6d50a-ac9e-4e5b-bb63-f83d09e33ff1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647677289, "uuid": "7b8ee80f-885e-4934-afc2-a31e3d36605c", "value": "emotet_exe_e4_4c50e287038e18b55bcdc5f10476c2121f74e51a6424b73104ca50ea810a15d2_2022-03-19__080804.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c84ea2-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648596, "uuid": "04672391-9fa9-48bb-bfee-6774674d3efa", "comment": "Malware payload (Heodo)", "value": "914e260e76725cb7b1b0be995dcb7dfc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648596, "uuid": "99f7a52c-2dbe-4bca-99d9-a9d8b6a9878e", "comment": "Malware payload (Heodo)", "value": "4df30acec4e4d2439df643e6180684576a44393f2ebbe7489f7683cbb6f67283", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648596, "uuid": "2da1cb09-b15b-464b-b831-fb4036d309fd", "comment": "Malware payload (Heodo)", "value": "a1585fddb70ec6e5df0401aa7499cbf1c0a772b5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648596, "uuid": "6d826450-4241-4d24-a00d-c53ec4479c35", "comment": "Malware payload (Heodo)", "value": "c77393a67e7f3ff7bc714024da66e6e80f6af790ad268fe6a873496656d72dd9cc93208c7ddcf485d690bc95411f78bf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648596, "uuid": "c3fff305-1cb5-47fc-83ec-52c7d09063a7", "value": "T12DC47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648596, "uuid": "5e06e1d7-65fe-475c-bb85-be49eac0bd23", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648596, "uuid": "e496aee0-017b-4549-83d9-5033e05abaa1", "value": "12288:S54yM33d3q3Z7BogwreNmF+U/9JckIAGfUeb:SKh3831BoaN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648596, "uuid": "74137a63-7478-4ad6-8f2d-c5986538dad5", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648596, "uuid": "a111de52-6987-4a99-89fb-8849fa6eefa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648596, "uuid": "cebd9ee5-2865-464c-8bda-78fb6b0a8f1d", "value": "emotet_exe_e5_4df30acec4e4d2439df643e6180684576a44393f2ebbe7489f7683cbb6f67283_2022-03-19__000950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74a34d4-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666660, "uuid": "525a1d5b-5b86-470d-8103-89e72bc40b02", "comment": "Malware payload (RedLineStealer)", "value": "9721accea7b82e4c3edaf18d91f93775", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666660, "uuid": "1813ca6a-2816-41da-9671-a68fc098fd75", "comment": "Malware payload (RedLineStealer)", "value": "4e13831c85b9b70bdb63c7dd28efe1a2adf00fa4e7efa3871edc63956ad4ab65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666660, "uuid": "5d77ed1b-9a59-415b-948f-82b8eb4f3432", "comment": "Malware payload (RedLineStealer)", "value": "909db689d0c5cda60633c20c7ddcd504a6a2f973", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666660, "uuid": "ce989aa6-95b9-4f06-b5a9-ab36dbae5451", "comment": "Malware payload (RedLineStealer)", "value": "9f73afa0b58ce7aab8c342d0c55b5772ff3926ed171e9e51af7a49c43c7029ecd377e14dbebc698252735f4c0a95e9f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666660, "uuid": "edf8e3e8-fb4e-445c-afb2-be9254355ef0", "value": "T12626334F53C5A766D5DAD6FD0F689EA10B0F2C0FA281E3E7A7AE4383D5A2045E1041E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666660, "uuid": "6cbfc370-429d-412c-aece-385708ceecc9", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666660, "uuid": "841fc898-a329-4411-a27d-b1093c427d12", "value": "98304:rFaH2D24Pp8Co/gSJLp5f759c6rcZCsfO55BTk0tUjhMLammJU:haH2D/8CoBdV9c/Z3fO556WUNVmmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666660, "uuid": "e4393f5c-7bc5-47d8-8015-2ba065f47ab3", "value": 4434432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666660, "uuid": "f2c15923-94ea-43cb-a025-41e5df8d9ba2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666660, "uuid": "9d41272f-a0eb-4cf6-901e-01a3c53d0b13", "value": "26156512.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a900d47-a788-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647696381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647696381, "uuid": "d5475a7c-06bf-415f-b051-840f5d435f35", "comment": "Malware payload (RedLineStealer)", "value": "3e7462489b760fa3eee713ae03ae7249", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647696381, "uuid": "483b8d54-6c26-41f2-9cc8-a61760676a9d", "comment": "Malware payload (RedLineStealer)", "value": "507eb00d1d9dfc6b9cb5a54c4b94984cc4382caee3c45e0b4c9bef3b6d8d98da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647696381, "uuid": "c9db43a2-a8d2-4cd0-bf5f-ae2ac9e7aa07", "comment": "Malware payload (RedLineStealer)", "value": "9c7ca609467e4656da1da610f56da7b5e2a308c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647696381, "uuid": "bda4159d-c9f8-4a97-8c41-634d7e914604", "comment": "Malware payload (RedLineStealer)", "value": "1d76b044f05e79bc2bb1d5ffb9d800ff8a03d8e637d367bb1e7f56570453ea423e0494430b2d2fdcd0a37d9b288032d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647696381, "uuid": "56dc8089-19d9-4337-a69d-1f8527fd5330", "value": "T1001523ACB350B69CC66EDD30AE005EEEDE9F0C1DF0E8E0B7B211AD89C914954FA1E155", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647696381, "uuid": "d0cc40ed-fb35-4c54-a280-9372ee7ac460", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647696381, "uuid": "817d5b39-d1f8-4284-8ed3-e9c9150b3460", "value": "24576:mPuLxonomPhwPU+pCzf0hWaNx8qra4zFHwXkEaHNYK3c+K5Dyox57:m1Jw7kf0hWaljzFQXNau+M17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647696381, "uuid": "56b5d46d-1b0d-4204-a999-51ae77b431ee", "value": 943616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647696381, "uuid": "4d21aae7-9c63-49df-84ed-d42b218db1bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647696381, "uuid": "4295e323-bc3d-4294-8f8a-1144ea0a8ea6", "value": "3e7462489b760fa3eee713ae03ae7249.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8766474d-a725-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647654016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647654016, "uuid": "a7a96536-5fe7-44be-a0b2-ad0d95f87f62", "comment": "Malware payload (Heodo)", "value": "801cbf5895fc408ecf31ac670680714e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647654016, "uuid": "55b35a4f-02f6-4ce0-a563-5e124189b353", "comment": "Malware payload (Heodo)", "value": "51c45df4ad55a27528de48e14a516a439d0f3ac811728e4f7b67495cf23e6989", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647654016, "uuid": "0f7dc063-3a9e-4b83-9db9-78d2986a7864", "comment": "Malware payload (Heodo)", "value": "2aa7a3dde6fe8483d4a6c373ffbf0c0bea198264", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647654016, "uuid": "7a222ef2-085f-4e91-92d8-1ee94e7b83d4", "comment": "Malware payload (Heodo)", "value": "22ed14ad030d6426b2c9cbdc005802456bc8ade1052148a2fe42ac116a2f6be1ef0253d6a6bf14b2e294dbe01b3139f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647654016, "uuid": "9762aaea-dec9-4e47-8175-cc300dc79ffb", "value": "T1D9C47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647654016, "uuid": "53428fdb-c4f4-4d20-b345-9ccc48ad5667", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647654016, "uuid": "322ac898-f493-4dc1-8a83-532cf0d7f0a7", "value": "12288:S54yM33d3q3Z7BogFreNmF+U/9JckIAGfUeb:SKh3831BoDN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647654016, "uuid": "8d6aff49-c5af-40df-ab7d-3ddb5cba01bd", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647654016, "uuid": "9c4767f9-727e-4923-b953-299e386712f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647654016, "uuid": "7ce149f7-6c76-43a2-b711-ce210b09ac5d", "value": "801cbf5895fc408ecf31ac670680714e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5fe2c0e-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666550, "uuid": "e35fc0c1-c7fa-4dc8-b36d-30656e698d64", "comment": "Malware payload (RedLineStealer)", "value": "e207025b9f8555f0b882de0de5bfc177", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666550, "uuid": "71e04003-ef15-4fae-8944-70d65ee8441c", "comment": "Malware payload (RedLineStealer)", "value": "52cde59bd8a4c4c3c9f1084cc1cf19c9b42a5af76b27b4b074388a6ff9ae3860", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666550, "uuid": "71332141-7404-43ef-998f-596cb3f6e1d1", "comment": "Malware payload (RedLineStealer)", "value": "e519acba4446f392763c69b20ab226755495b2d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666550, "uuid": "a8c17f84-d837-4ed4-8418-2fde9e4ab69e", "comment": "Malware payload (RedLineStealer)", "value": "4463c05b498823659dfee5867eeeb65974b36e9ce02ee22f8f66e265c48ea81c62cae1df2ed0be1682b245ea9528eace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666550, "uuid": "a2035d52-04ab-425f-ad86-9acafcf33cee", "value": "T194C43396B7E5BF88D38B0B345E49364693E3A262D7D0E547F94F0E4812188BC5B93273", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666550, "uuid": "b3336731-7bd2-4251-a02e-a60f3867f613", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666550, "uuid": "64105a01-c50a-444f-9c39-777d59d0b437", "value": "12288:Umr13SDaizT/BBpZc+coQS03ULaHNqrxlKIQNoAupxJ4E/+CeBKlZ0:UmrJPif/LpZhcokEaHNYK3Wxj+CY2Z0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666550, "uuid": "6b409fdd-7f78-4a21-a2b3-e7a27b0d60e9", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666550, "uuid": "e8c8817f-2fe5-48cd-a7fd-0cd8d8e763bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666550, "uuid": "b58326d5-1ac2-4327-ac1b-61319dd10ba4", "value": "24528179.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712213a4-a75b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647677172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647677172, "uuid": "b79ea8db-c6cb-41e3-9d0e-a0305db1e5df", "comment": "Malware payload (Heodo)", "value": "cd4d90aba3b5a43aeabb42c7b443a9ef", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647677172, "uuid": "5dc7dcac-5dbb-409a-a564-00edc8e032f9", "comment": "Malware payload (Heodo)", "value": "52cf3e047423ee1fde476165d8eee346c8549db7947f8da60adb9931086f3054", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647677172, "uuid": "daa459fb-de58-4073-a7e4-2d0294657433", "comment": "Malware payload (Heodo)", "value": "3d54c610ca87f5bb356ea54b9e956356af7b97ba", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647677172, "uuid": "89652875-e0c5-4c3a-9d27-d2cea3077f1c", "comment": "Malware payload (Heodo)", "value": "93d8c3c6f0ac6856bfdae9f5844bd6aa516a05a495f6759f33377c3fbae1d7464a03fcbf0b236537b841a63af99c3f79", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647677172, "uuid": "fb4f12f5-d67f-40d3-bf09-8b18b2688610", "value": "T13103AE30F2D28E99E53A943C878CE9F593288F525181BF2C30D563BC5F526B56B8E24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647677172, "uuid": "416ca5ae-7e0d-409c-a455-3efec47f901c", "value": "768:GdUCR8xZ5jOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIy5:O5wXOZZ1ZYpoQ/pMAeVIyMId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647677172, "uuid": "b41c3b33-55b3-442b-ae9b-769afe484ae8", "value": 39699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647677172, "uuid": "d719a0f0-3a6a-474d-8851-6eff48b99947", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647677172, "uuid": "8b746563-9b8a-44e9-867d-248e38352a5a", "value": "Info_018.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c16ce68-a725-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647653997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653997, "uuid": "2c63e4f1-7d32-455e-bb6a-937deede87b1", "comment": "Malware payload (Heodo)", "value": "02bcc0ebc62beda54ab0a9263bcffb25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653997, "uuid": "f3816327-b63a-46a6-8db8-c1261cde21ed", "comment": "Malware payload (Heodo)", "value": "545282027718bd22bd7fcbb471a65d0f7c47b62da0e95e69743a305902207728", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653997, "uuid": "57f18bee-d4e0-43ef-a3fa-ab2606755957", "comment": "Malware payload (Heodo)", "value": "ae353d2926cfe174462afbe1bb2837b89b0968a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653997, "uuid": "8388c2ab-311d-468f-aca0-0051bf0d02e4", "comment": "Malware payload (Heodo)", "value": "845c4259d6b3110cedf3c17dabc9767dc12b11cc4c36deb7fb2ddad31092269e36068954837d738795da8d520464abbd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653997, "uuid": "d9cd5d1f-4b42-4486-bb19-c772c9dc26b8", "value": "T112D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653997, "uuid": "263228d5-6555-40e1-b5ef-15abaaa45aff", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653997, "uuid": "e3bc9f40-71b1-49cc-ac51-ccb3cc38660c", "value": "12288:UWBpwupxl0OeL/grx8GzO+r9AjCb/XKh:Psupxa/gr2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647653997, "uuid": "ed666936-9dcf-4a6a-b5f9-14bd50c44de2", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647653997, "uuid": "c3275e77-afc3-49f8-9b5c-97d8fee4418d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653997, "uuid": "d0790c6b-c988-40fd-b966-9325ea188b78", "value": "02bcc0ebc62beda54ab0a9263bcffb25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9abc3943-a77d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647691845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647691845, "uuid": "e7df38fa-3b06-4978-8261-899b59bfd883", "comment": "Malware payload", "value": "a1051b393eaea4bca768f1e8cd84ca27", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647691845, "uuid": "bbfb57d0-3361-40c3-9eaf-b75e97694785", "comment": "Malware payload", "value": "55e3fdbf579a7e6f04a3e34f59dedf318428740fb592321048b49b6622a39c7c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647691845, "uuid": "06b84444-139f-46c8-b4ee-99fdc066f39b", "comment": "Malware payload", "value": "78547a1ac237b77ca62c325d7ecba3b97ddacc52", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647691845, "uuid": "55ca8d43-ebec-4817-8b1f-58c88c5aeb0d", "comment": "Malware payload", "value": "a1296165bd2fbea10875c62e69cb0403721da8d008cdbb8b3cbf7d80d80fc57830833b0ac62f6f42192d3df601f2a0e7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647691845, "uuid": "a1d25ee7-3af1-492b-8e83-a6aa57a1dee6", "value": "T1C5329DA3D842F129D19A867C899B47FCE74E21828672A60F3093770C2FE09CB139C94D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647691845, "uuid": "4033bdc7-a860-4f41-a757-472466b58f72", "value": "192:ScIMmtPyr/vdkm2Eve11jl5bv/0f/GvTjmJYvKdv4sMYNJvZazgF3aI:SPXKr/vdk7P/qG1c4mNJvZUe3aI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647691845, "uuid": "5d6a8d53-54d3-401d-885c-f8fabce4357f", "value": 11861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647691845, "uuid": "b999e9b5-3bea-4c7f-9939-02f9208c2ca0", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647691845, "uuid": "7847cc16-de50-431d-a0af-b9c19f93c8b1", "value": "STEVENSON_2022_(1).docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7ef7b1-a723-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647653144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653144, "uuid": "44f5c659-85ca-490a-ae86-9b7b128588e8", "comment": "Malware payload (Heodo)", "value": "7f78185856de7d590d5a7d19b5eaa838", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653144, "uuid": "8cdf7f28-fc04-4f57-9c72-b33c215e166d", "comment": "Malware payload (Heodo)", "value": "5a57ee76c2ff65245d58180eea88f01a1cb42731f6ee413714128456fa49b7c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653144, "uuid": "c2c0ad5a-4aca-413e-8f87-af30c5070fa6", "comment": "Malware payload (Heodo)", "value": "76727edd89e31597b56f9d74a3de7cb112fbf43a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653144, "uuid": "cb1db7fa-e36b-4c0f-8a89-f0feb688068c", "comment": "Malware payload (Heodo)", "value": "deacd209e78ee6d46d604b22478ac45b3fc4b59174778216803254609fd0cc0d6b6a4539ada98fcf8c099568487d0cd6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653144, "uuid": "b38fb09c-edaa-466c-bc5a-b743c10de0f3", "value": "T1C7D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653144, "uuid": "c9bc80c9-5a84-4b72-ba85-f496a8a1c4b8", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653144, "uuid": "987a8f57-512c-4a42-b6d2-91771d03f6e1", "value": "12288:UWBpwupxl0OeL/grxsGzO+r9AjCb/XKh:Psupxa/g/2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647653144, "uuid": "a289589d-a611-4eb2-b511-47288c8b11b2", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647653144, "uuid": "b4e831a8-c700-44f6-a400-d8baf5ab32f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653144, "uuid": "948434eb-5104-480e-ac25-a49db3487994", "value": "7f78185856de7d590d5a7d19b5eaa838", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2f6fdb-a767-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647682343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647682343, "uuid": "cdc335a4-d595-45ac-9ca2-e882bbb309d6", "comment": "Malware payload (Formbook)", "value": "f7ad9c53a027e3486655ca9944682dc1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647682343, "uuid": "eab8ba56-e608-475e-be4c-4257d03da9e9", "comment": "Malware payload (Formbook)", "value": "5b93e92b5e9d07f0fb6027776e074a38dfa2d8020f8fccfb1166907d09e81252", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647682343, "uuid": "50bb0c49-6d8b-4d69-bedf-7a1d99a43e2e", "comment": "Malware payload (Formbook)", "value": "e082cc1c7a9ae6bd3f4ddef2457aa72d27d006b6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647682343, "uuid": "5de478f2-2097-4af0-82db-5f128d5f7a72", "comment": "Malware payload (Formbook)", "value": "415b59c691795b34250b873cd94c8517d3772afe54e474ea575d42977a13931af427a4da808b0426f3d59403e55cae30", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647682343, "uuid": "7b6b39ae-a186-492f-81e3-41333dcf8dc1", "value": "T15D8423A0919BB78B493ECC2E0D88352CD06F05E14DE6C5A5760CBD55FBB83BCA8DD891", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647682343, "uuid": "67017e92-03d0-44a4-a28e-ba1f5e7a0c4f", "value": "6144:IXJRJUx4v6a2BLLKtY39Xtguj5KjYNuUprBiWuVze1SdckFO4RcgY2ESoV+CvGpG:IXyx3RLuY39dvj5GzaBiEqckU4R82Ywi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647682343, "uuid": "4a4a3c69-cfe2-43e6-998d-254d62fd9cf5", "value": 375925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647682343, "uuid": "99f765ec-6d96-4da0-96df-e9f9345eb41d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647682343, "uuid": "906e74bd-6069-4f42-837d-2b202c6d0199", "value": "ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df6115d-a71e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647650887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650887, "uuid": "369252cc-accf-4c9c-bfaf-0d6ba2018dac", "comment": "Malware payload (Heodo)", "value": "9a10f9a707ad6ff833d4cf045806c9c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650887, "uuid": "2ba7abdb-5e8c-425d-996e-3feba34a3b56", "comment": "Malware payload (Heodo)", "value": "5bac9d63d620289ca6a70080f3de03f987b3ba928d6d6aa5c3c664993ba2bcbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650887, "uuid": "401b4e93-082f-4574-bc88-e17d151a9e56", "comment": "Malware payload (Heodo)", "value": "23714a67453bd97e77c21ec5c799e9a15d9e19f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650887, "uuid": "e81aac1c-4600-4a51-8326-54c420c83e93", "comment": "Malware payload (Heodo)", "value": "c4484f12cbab302572bb7573cdaae6406404a62d647c63a024c513f6615ba05a4f5a3beb3387d1bae0918c9624299dce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650887, "uuid": "61c22a55-71b6-4dc9-a083-f4070caead40", "value": "T1FCC47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650887, "uuid": "5be9f6da-5168-43cd-882a-e196d5644fb1", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650887, "uuid": "f9555329-6a70-4db0-943c-d8a9c290d4f1", "value": "12288:S54yM33d3q3Z7BogjreNmF+U/9JckIAGfUeb:SKh3831BotN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647650887, "uuid": "00d1f1fe-ad2f-40c0-a19e-bc82efaa859f", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647650887, "uuid": "5bed0a00-215a-4d11-8206-99c992df3b20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650887, "uuid": "6c74b874-4f05-44bb-a635-3bb1af977a1c", "value": "9a10f9a707ad6ff833d4cf045806c9c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfe4b84-a743-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666991, "uuid": "661ad384-b3a3-42d0-ad75-f6fe315bd891", "comment": "Malware payload (RedLineStealer)", "value": "0385eb5feb3d2441922233d601722629", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666991, "uuid": "8eebda1a-7c02-4daa-9a78-7eccf2f6a66a", "comment": "Malware payload (RedLineStealer)", "value": "5c37f02c9355594c1cb04eb53550de3653b8e049ba85671b4e32ece0a8fa968a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666991, "uuid": "05a0ee4d-6e1d-4a28-a4e8-562f3fddc5f6", "comment": "Malware payload (RedLineStealer)", "value": "d41090a648c1b87aeb76bc5686d0ff0de752b51b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666991, "uuid": "6b964933-e371-4fd4-b01c-1b554f498b66", "comment": "Malware payload (RedLineStealer)", "value": "a3ef28173e5d667634df696e7fcd1f6f480d163d802cf7e6ea91aaa66723c8074f39b8f6c7cac7d1b23b18bf60e9be70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666991, "uuid": "f6d41f4f-b492-43d1-bd6e-a5f30719ce6d", "value": "T155363317AD593877C6CFC37CA113A84930B1F9A56AACD60801F5CE4B2BFE912E8B1075", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666991, "uuid": "553ef4ed-de73-4986-87cd-daf4df1a8066", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666991, "uuid": "b69ee995-e26c-4021-b5b0-e7f1128c819d", "value": "98304:EVfZ20PXQYnyrJhNckUkcCsH+EKzZTyZuNtbV7XwIscyar29IAMl3vWG:sfhPAYnIQqREKzZTyZuNtbpXhGaqqjvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666991, "uuid": "2af269a1-d0db-41ce-8413-10f261ed7596", "value": 4890264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666991, "uuid": "f175277e-8287-483a-8488-d949f92660a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666991, "uuid": "3ea4e66f-1cdf-4b42-9717-5e8d76138f65", "value": "28671717.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4df0d95-a769-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647683406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647683406, "uuid": "f5597af9-fcbe-491e-8f18-a927954ee4d3", "comment": "Malware payload (Mirai)", "value": "f5c63a179b531719cf3467bc7a9a47a3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647683406, "uuid": "16e4543a-d1e7-44b0-a38e-660707a1d105", "comment": "Malware payload (Mirai)", "value": "5d873e3f7a155de2e6b46be6c4e39ba1137353c2dd45f292ae7864a4f7e3a2dc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647683406, "uuid": "0f223115-c302-4654-ba36-806f21649edf", "comment": "Malware payload (Mirai)", "value": "a8818d52a4c927faef9c75f814ecdb4b2c6fd47c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647683406, "uuid": "269c9e9d-8605-4a58-86b9-990283b22c08", "comment": "Malware payload (Mirai)", "value": "cf33bf381891d4b6c830d3d697b1d74ee27acea6d12c567cdddcc55a5cd2ce448ae91606afdaaeaf07632dda4641132a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647683406, "uuid": "e601ff9f-3a23-4a09-8968-e88e264f6275", "value": "T101833981FC41A622C7C11777FE5F018E371553C8E2EA32079C285FA03ADB95B0D6BA5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647683406, "uuid": "b475ab32-8729-4420-8a84-0dc224f59042", "value": "1536:JOOFQKx7ghLCMw9/LQmu33eZtXpFNoW5lqlx131vn:JOOWKx7rsme3wfp503bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647683406, "uuid": "01994e5f-4d3d-4bb0-afaa-9084a5dd1ae0", "value": 87172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647683406, "uuid": "440718a8-3441-4f0d-b537-7956604d43e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647683406, "uuid": "1ba9f267-b61d-4eef-8ec2-a7099ceb94c7", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273abf88-a72a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647656003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647656003, "uuid": "70e44231-2555-4c17-88ce-670b7d293ef7", "comment": "Malware payload (Heodo)", "value": "71dddbd33d0756f128b44787216cb623", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647656003, "uuid": "5c942c54-db19-48fe-a5a0-c239ef9d7b4b", "comment": "Malware payload (Heodo)", "value": "5f1d1eddcc75a4abec8f4f8b55e7b60b09cf2a5058746c3f5898dae642aec936", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647656003, "uuid": "b7bef4c9-76f4-4a03-a000-6eba534607c4", "comment": "Malware payload (Heodo)", "value": "e48eeb0ee1e7832a9a323aa54b73f9e5a74cc585", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647656003, "uuid": "49eb7029-2b26-4000-a2d7-f6f47fcc27f8", "comment": "Malware payload (Heodo)", "value": "92a7541d5df914ab3ca7763372d49a0748f1b4fd6f15a58e6e6c845e21e21fadb8344488a12b91d582b6c273b985c8ce", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647656003, "uuid": "2562aee4-4059-4750-80e9-5c5bce2f8eef", "value": "T1BF34A30233C361F0CA53B564840FD525BCA7B83C7B15497D9247A5AF87EB8D09A34AFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647656003, "uuid": "51462673-ca46-4215-a1ed-e553228916c9", "value": "3072:4TdrXJjOjQyNo6BUv1gr8qcKRXyMjO8rSXVKfp8GSaztT2GTrw9dH0rd:S5uok8qcKhyMlSXVKfKGS4Tp3wb8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647656003, "uuid": "cf4b4de0-dfcf-4e1b-b9b9-7155511b28ec", "value": 245604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647656003, "uuid": "aa448801-f6fb-48af-9461-b110fc346072", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647656003, "uuid": "5dcedffb-8f42-4a3b-9e99-3a36b24deb8b", "value": "emotet_exe_e5_5f1d1eddcc75a4abec8f4f8b55e7b60b09cf2a5058746c3f5898dae642aec936_2022-03-19__021317.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bfcc1d6-a7b1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647713966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713966, "uuid": "faf3d15c-76e1-4ce4-a509-b0bdc49020ae", "comment": "Malware payload (Mirai)", "value": "6700506951d7f6ef0ede9adf9298c93b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713966, "uuid": "df13df4d-cdb8-4c6b-80bf-17086a97ea66", "comment": "Malware payload (Mirai)", "value": "5fada6688eefb3bfeae9e142ab45316a9a43a8c09029d1bfb24481c8f6d2d253", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713966, "uuid": "6788545a-3f8d-471c-8f53-ee2720805d07", "comment": "Malware payload (Mirai)", "value": "aa41fe3802c05058c7b0c9fd7119d82f178b8a0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713966, "uuid": "154676b8-335d-468f-8801-be9a287b0728", "comment": "Malware payload (Mirai)", "value": "af6844baf2c0af86b79e278c3f69376a8804233da5cd7d264fa7797bd6ec3aa92b30f0e833ab9b0682b1f3f19f911e78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713966, "uuid": "822208ca-8c31-4258-940b-1b816b007269", "value": "T185A3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713966, "uuid": "cfd70724-58ae-43f3-ada5-ff579806f9fe", "value": "3072:wW8FUmgujld6Mkxm6AJ+4fcHmmFVcqq0GnDZT:wJFv4Lm6AJ+4fcHmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647713966, "uuid": "d5847489-791f-429a-b22a-fcbc9e0c62d9", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647713966, "uuid": "af4af95b-c59e-43dd-8229-b6a66c11a8e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713966, "uuid": "4efde6d7-ff0b-4747-9b6c-c0f85311d6d0", "value": "6700506951d7f6ef0ede9adf9298c93b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa12bb47-a7af-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647713345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713345, "uuid": "98b58ead-79e1-4c9d-a7c5-e6d4863cb96d", "comment": "Malware payload (Mirai)", "value": "96e2312fe6ebecf600a59f1310b07016", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713345, "uuid": "f4564c5c-e343-476d-b36b-561944d9b034", "comment": "Malware payload (Mirai)", "value": "60bfa6326f2d52e416a72301eafdea5942786f150fc45a594cf407cc80a7bac9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713345, "uuid": "2988e41d-f382-44ed-8a88-3bdf4712ec71", "comment": "Malware payload (Mirai)", "value": "fa88b95b13de6aeb0eeb95e34aecf35cc91b52c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713345, "uuid": "8a707720-377d-4c9a-9b0f-f4d9fdc3e2b2", "comment": "Malware payload (Mirai)", "value": "832d44ac65b1b114c9e75e5dc2c7988213ef6bacf49512c45655564b2c37a02e3249e1b99d3ff2fa43ed358a921fbe87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713345, "uuid": "91d697d1-7de8-4242-8174-eabde02dc4d1", "value": "T175E32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713345, "uuid": "d3bd8a5d-fd40-45e6-bd40-6644bb205af4", "value": "3072:Cv/WwsLgaq353qHiCOvhOpGqkDQHbeskmhxQwoVSUNu:KPLaq351hOpGqkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647713345, "uuid": "71aaad18-6da2-4999-bd24-35e264561057", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647713345, "uuid": "18d64673-697e-48aa-9ea9-51da56141618", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713345, "uuid": "fd5ceb49-3b5f-49f2-9946-20ae599ce178", "value": "96e2312fe6ebecf600a59f1310b07016", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf32a28-a744-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647667177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667177, "uuid": "88b6998f-f34d-4e37-a02f-b727851b4c28", "comment": "Malware payload (RedLineStealer)", "value": "968627064b9719bc5499eac97e43d7b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667177, "uuid": "7aa42ac3-d989-419b-8231-9d1ca9877b09", "comment": "Malware payload (RedLineStealer)", "value": "612eba8d74d362a8afd206665fb48f2779df19610d16e95e669feac8983eb612", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667177, "uuid": "fbc79a70-1094-4c8f-8642-ff0c0d1b418d", "comment": "Malware payload (RedLineStealer)", "value": "a172950ba1b30b5b83ed0f21a0b238c728f71ec9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667177, "uuid": "39629ae5-f229-48ae-83fe-3fbdc2519c38", "comment": "Malware payload (RedLineStealer)", "value": "9b6c9a78fed9248c1d462db57eb514404d4b59030bec9d63b4cf885ed80f060b0034149877cc6b5de3927198e61d3d10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667177, "uuid": "fe38417f-851f-4506-9a9f-e03aaefa8bc8", "value": "T1672633737A618B38D109AF72CC02397BAF998E7C94597031E26E95F91F73027276D482", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667177, "uuid": "f5a43fef-8791-4288-9448-4b152e2eaf05", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667177, "uuid": "c6b649dc-1503-4fed-bfe3-d3f0e66cc57a", "value": "98304:6VLxH3zOi3Sxw2zWHQG6MFIdinvuFZxkemrrauvfs:6l57CSjUs/vGqVraqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647667177, "uuid": "1a7a6453-9c66-40bd-a134-9439d86c069e", "value": 4545536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647667177, "uuid": "b949b0bb-1a27-485a-9f0d-5cf5e6c74359", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667177, "uuid": "52cf81a4-f7e0-4d92-8235-d3cb184dc647", "value": "29010012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc0cd69e-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1647666587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666587, "uuid": "501127e3-9d55-42be-82ac-b9f53579816b", "comment": "Malware payload (ArkeiStealer)", "value": "c449cb81d0541fb4b1aae49ef8f51b47", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666587, "uuid": "ebb03b22-9201-40aa-a80e-3853725038ab", "comment": "Malware payload (ArkeiStealer)", "value": "61a33ed4391c455177ceb3c2c6ff2ac34453204f87192ebbd4bda39816c3ff50", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666587, "uuid": "d1d462e2-d6ba-4fb5-9e41-55aece9b419e", "comment": "Malware payload (ArkeiStealer)", "value": "69666a1d3668c9f4dfec51b63b90030cf6a1619c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666587, "uuid": "4ad4e12e-d46c-468e-bba1-846b7c9e11cb", "comment": "Malware payload (ArkeiStealer)", "value": "addaa19f33ab735afda17580565238d98eebbdf26561a3451916a4ed6af5dfcd04babaaa2e597f7c4c5631d368e8ed61", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666587, "uuid": "73851f5f-21d5-4354-8b60-b8b9724834fb", "value": "T1E4E4120330C2C43BEBB602748856C7B06A6BB8750D7559B777C45B1D2F62FB28B2A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666587, "uuid": "ba18a0df-8ec8-44c8-bef7-cc3a58cd1ce9", "value": "9b4372e7e634637357c11918204c4bcd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666587, "uuid": "234f8f8e-7f29-44fd-b8f5-14403741bb42", "value": "12288:mmDuxvHnS3YG/2wnMA/htd10/iUTp6n5Cnk2+zIN3jwF:mJHS3b1/+ViCnXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666587, "uuid": "6226b9a8-672f-41ef-acaf-d2e089d13968", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666587, "uuid": "8b402e90-8c0a-4daa-a82b-e9f2969cefcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666587, "uuid": "c0d26efd-2554-49b0-9e35-71b03ade4662", "value": "24750547.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb58e8b-a743-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666801, "uuid": "147eef77-6327-4cd9-9e61-39701c8ce1f7", "comment": "Malware payload (RedLineStealer)", "value": "45bd842a9ec0dd02a6bb7f5ca16272cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666801, "uuid": "3f43c45e-e5f8-410c-bbec-4cc863e6d125", "comment": "Malware payload (RedLineStealer)", "value": "626843db5bfe74b22104c10fe6f33c1d80de72eb9a3416ea1b93577f69033dae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666801, "uuid": "005d5b08-47af-4ea3-98a3-429dc78f748e", "comment": "Malware payload (RedLineStealer)", "value": "6def33102b8bc2ed9420e16f6b3cdd33cdf6e961", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666801, "uuid": "c9f5fcf3-e04f-42cc-ba7a-f4f6e34780e2", "comment": "Malware payload (RedLineStealer)", "value": "7d11c86534b64007a6a195b123b2349c9b66ab516093a611ea729bf9de9a2e0821ea0bdb45f8f1fa5f606ac2c7d69e8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666801, "uuid": "c4d00b23-24e6-48e4-a218-6f4ea9ce5f73", "value": "T1063633FE7B86D080D59488B0D1420866EDD8674B0EE9DFFEF0B9A2C7B95466EF14604C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666801, "uuid": "e4255d5e-a2a0-45c1-9aa1-b64e36634e40", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666801, "uuid": "56914222-1975-4d19-a034-649268300a3a", "value": "98304:d0a8bxwVsJUJvE69HgAXMtxCz+dHjhkmHzlADi3J/UfViIvN4R/Y6Wx6:d0aCuVsYvE69AqeKi3JaJNLtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666801, "uuid": "13baf220-2e81-4ebf-9ebe-e46203e91744", "value": 4882432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666801, "uuid": "831b5312-babe-46f3-bc09-8144ba67b3e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666801, "uuid": "ec257095-3782-48f7-a8d2-7ff0818cef6e", "value": "26891230.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c9bfb3-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648596, "uuid": "9c2b0343-661c-46d9-8c18-b66657bde6b8", "comment": "Malware payload (Heodo)", "value": "d26aa1ce3beeea995160e2045194935f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648596, "uuid": "f43798fd-4e98-4897-b192-8244e4f6c1a3", "comment": "Malware payload (Heodo)", "value": "62a66bde818f0a6024a45b0b57a232deff089f8fb0a227b32671cad816f80c21", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648596, "uuid": "6776cd3c-9f13-41ce-9924-9158292a4a0c", "comment": "Malware payload (Heodo)", "value": "793083bc8145ee17e78412d7a71cc98e7e11b162", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648596, "uuid": "19353f58-7f4c-4311-acf7-701956a9bc77", "comment": "Malware payload (Heodo)", "value": "a23330b4ba6cad172ad323bd02b683a14cd8cbcd3b4a98cc1d2b7c6d22eb3138555e6deb69769e03c14c0de9b2b97ac4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648596, "uuid": "e99c4e07-d562-474d-a456-17cd3e1621f8", "value": "T114C47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648596, "uuid": "5cc50f8b-80cc-48ae-b111-d02efc241150", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648596, "uuid": "e2ab0ecd-a213-479c-ae67-c68612c850f1", "value": "12288:S54yM33d3q3Z7BoggreNmF+U/9JckIAGfUeb:SKh3831BoSN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648596, "uuid": "2bfe4822-b92d-4e93-b388-5b732eb2c1ee", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648596, "uuid": "92f5f932-77be-4219-86ee-45269403e2f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648596, "uuid": "bc19430c-e99c-4e47-90f0-bb3461563e4e", "value": "emotet_exe_e5_62a66bde818f0a6024a45b0b57a232deff089f8fb0a227b32671cad816f80c21_2022-03-19__000951.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8352c0-a7b2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647714509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714509, "uuid": "85696faf-0b0b-4480-a01f-9fa194ee4fe4", "comment": "Malware payload (Heodo)", "value": "5b880b8f185cfb773c97583fec8044ac", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714509, "uuid": "3d491594-159c-4022-977b-96661c7319ed", "comment": "Malware payload (Heodo)", "value": "62caf7a484168e0c86378366c94785ccc3680affe14a7325c05b217f62bf958c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714509, "uuid": "5ef160f8-8852-4602-9ca6-684f9381abf7", "comment": "Malware payload (Heodo)", "value": "a11dc8f4118487becec3f4be8ca91c01e3793e84", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714509, "uuid": "edb22e5f-3828-45a4-a6c3-7ca5fcd1aab1", "comment": "Malware payload (Heodo)", "value": "5ba8288663dc462874b224ca14553dab174fbe31ea557ca46faf6acbaa617f70d86cd28ccaf3c6d77b1220ef9850aa8f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647714509, "uuid": "b0cc99cc-9f12-4182-a82b-c2448fec4cc3", "value": "T1D2E427137CC34030C89F0875891AF20A6995EF04DB99B33AEBB5BE8D65355979D38B0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647714509, "uuid": "ee6e3639-e15e-4fa7-af19-df0b24fdad4d", "value": "b39d2fd2d18c2cfe493a1e089561b46e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647714509, "uuid": "74a6d6a1-4026-418b-9a3f-26e2f106f510", "value": "6144:EiH1vXSjOsl8UG2fde2VwS7D8dwDFYAcAf6U6UfNKLgM1xIhg3teXE3XsuTWKi7T:X14GEdtVlnqYF0Ar6UQgM1xou/iA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647714509, "uuid": "8feed509-ea84-4659-bcf7-edbbe4672f2a", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647714509, "uuid": "abb35e5d-75c8-44e9-99e1-c42e48f04134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647714509, "uuid": "80cbb801-e035-4b33-8929-da82ca0a5ca6", "value": "emotet_exe_e5_62caf7a484168e0c86378366c94785ccc3680affe14a7325c05b217f62bf958c_2022-03-19__182822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc365b27-a7af-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647713429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713429, "uuid": "d376c03a-5376-4115-a6e1-17ae7d4dbdcf", "comment": "Malware payload (AgentTesla)", "value": "f804ce308f674b07e26282b9f3940d5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713429, "uuid": "2f9ca79f-21c3-4611-9a6a-000a69d245c2", "comment": "Malware payload (AgentTesla)", "value": "62ddac340a0985fc96218aae3bf99635d503117d2b2f3edeac9ec19247d2d43e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713429, "uuid": "aa50714a-cb9e-4636-b012-935092f48e03", "comment": "Malware payload (AgentTesla)", "value": "b516f00fb5f91c3f724c916ef02d8903f7bb1302", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713429, "uuid": "d36e8bdd-3efb-435e-9c3f-22fd86c454cc", "comment": "Malware payload (AgentTesla)", "value": "deb051f8e7d7db2cc3e6e9abf7ec8ae418badcdba3e2768d574ae1756f3de70097b437cfee0b1bff688f2aa4b0012cd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713429, "uuid": "f8a063bf-b2ff-4e96-84f3-4b882d3bf34a", "value": "T1F2A4F08B75EC4ADBD1CD0EB06C25F32C627A6F612160AE017E55FA8A3A3541714FB87C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713429, "uuid": "ae9eb45c-c366-4223-b0af-96e353c67a2e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713429, "uuid": "05427250-5930-423f-82d0-b6f557cdbbdb", "value": "12288:wKwxld7bd8/BKWu40dp5H+KUbvfRYDG+w:b/QWu5LHwvfRmFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647713429, "uuid": "15430602-4789-4185-9951-4fca93647602", "value": 463334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647713429, "uuid": "f038a228-0165-4e9d-a0f6-20780fe5e6e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713429, "uuid": "c3d64c90-8f4f-48a9-85de-a0efcf604ed9", "value": "f804ce308f674b07e26282b9f3940d5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4a2b74-a723-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647653117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653117, "uuid": "c0afbbfd-4c7f-489c-8f5f-0b5537f04b4c", "comment": "Malware payload (Heodo)", "value": "664b469d22c5a1bb762a1dbc363bbdbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653117, "uuid": "c6365b96-4054-494d-816e-c2bb8a26fdfc", "comment": "Malware payload (Heodo)", "value": "6355822f6b31343dd91c966a7212f091019bd9f927b5478c76f2e1d317845053", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653117, "uuid": "ca08aee9-4046-4356-8143-aef4b08d5d00", "comment": "Malware payload (Heodo)", "value": "bb31bf74d1a011e0fa90303958326aaf8112c20b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653117, "uuid": "ab194ea8-c95c-43f0-aff8-a52d9ebba7c3", "comment": "Malware payload (Heodo)", "value": "ab4f003a906410b02b58cb0c8c64e952f89ba97eb9eaf7df8917af903eb012e1ccf885f02675ddcc12ec8aaa84036755", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653117, "uuid": "e557f542-e25a-47a5-a1db-344ed6285c42", "value": "T1BAD45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653117, "uuid": "705e1982-5dac-45ce-a36b-e5d8b83506a4", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653117, "uuid": "93d68726-b274-4ded-bc1b-992622234868", "value": "12288:UWBpwupxl0OeL/grxyGzO+r9AjCb/XKh:Psupxa/gR2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647653117, "uuid": "e0ad23c8-f62a-4703-940b-d7177fd93724", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647653117, "uuid": "90da6210-875b-4270-a835-efc110f01037", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653117, "uuid": "6fa65253-6078-44fe-adc8-eb60a0777181", "value": "664b469d22c5a1bb762a1dbc363bbdbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b575df-a723-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647653104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653104, "uuid": "3a176b6a-5d59-43f6-81c0-794d71db38d9", "comment": "Malware payload (Heodo)", "value": "209e1658646d4a9d4896f658a47a8334", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653104, "uuid": "443d0506-3854-48e1-928a-bddfeb426266", "comment": "Malware payload (Heodo)", "value": "65a345388c84c9da8c14409f67c7c3770cc0c40c3800eb9ea952afcb28e442d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653104, "uuid": "237d3d5e-50fe-43cc-b17c-7ab3b128a169", "comment": "Malware payload (Heodo)", "value": "5a146943727d4c5e391cbf63b7ffb050cf67185c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653104, "uuid": "9ed0abd3-0d37-45ca-874b-3c6b03dcb03b", "comment": "Malware payload (Heodo)", "value": "08d381da7902ff6d161f2e0d23ff7cd429b86cb445bc17d1084cf6556623489c3feadd1bf03eb298b6ec8189be9eb548", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653104, "uuid": "0bf886d0-6527-4df6-84d5-459468fa86c4", "value": "T11CC47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653104, "uuid": "fe04521b-e375-4d8e-830b-b951a8362c17", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653104, "uuid": "ccdfa33a-9800-4952-8bbc-d838111294da", "value": "12288:S54yM33d3q3Z7BogfreNmF+U/9JckIAGfUeb:SKh3831BoFN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647653104, "uuid": "f2a2d667-7441-479d-b9e8-17a816749552", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647653104, "uuid": "8984cc4a-8259-496f-b984-77f8b32550ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653104, "uuid": "1668dc01-6c4a-4f21-a8bd-9c8d994713fa", "value": "209e1658646d4a9d4896f658a47a8334", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65918402-a74b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647670281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647670281, "uuid": "ae0294ce-31ce-47f9-ab49-336a7123f7e2", "comment": "Malware payload (Heodo)", "value": "59603a7f2cb6b68329e085330a5ecb11", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647670281, "uuid": "ed5c9510-89a6-4adc-a8f7-90b0d9783c39", "comment": "Malware payload (Heodo)", "value": "65f87453fdad8e69ea4d7bbb2cfa1f3469b99a41612686a4dcda720b34949893", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647670281, "uuid": "c3428c10-2ba2-4b2a-917a-3e8cc1c01b51", "comment": "Malware payload (Heodo)", "value": "8aeac57bcec13303b39dedb2eee0d0e7208fd959", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647670281, "uuid": "7874ed3c-f71f-400b-8929-c5d827c82fad", "comment": "Malware payload (Heodo)", "value": "e553ad604f085aa230506b5074fa6e69def14bb687d1d622bd61780ee28ffe10863bf267ac291017d413a22842ed84d2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647670281, "uuid": "9bd01bda-95a6-419a-ab44-29f703c651af", "value": "T1CCA45B0173C390F0C657A574840FD525ACB7B83C6B19857EA28BA26F4BF78D09A346F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647670281, "uuid": "3051a2b6-f213-4e1e-ad37-8f8303950847", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647670281, "uuid": "60e93d44-faf4-4a67-87ac-267c2232c885", "value": "6144:S5uok8qcKhyMlSXVKfKGS4Tp3wb8iZ7B1yarh97ArkqBoEimFmzUM090/DHr8cQL:S54yM33d3q3Z7BogSreNmF+U/9JcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647670281, "uuid": "59dc3af3-304c-437b-9230-b552eeaf5fd6", "value": 484512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647670281, "uuid": "7d8650b5-86e3-4251-95ad-68e4a9e6cf68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647670281, "uuid": "ddeb6d57-3a0b-49f2-bcc0-1e6a160a072e", "value": "emotet_exe_e5_65f87453fdad8e69ea4d7bbb2cfa1f3469b99a41612686a4dcda720b34949893_2022-03-19__061116.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca959b0-a7b1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647714021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714021, "uuid": "31fa1958-2dcd-4de3-b087-9ec2818feceb", "comment": "Malware payload (Mirai)", "value": "fdde4ae9d61a44f5ba01574727fe0c79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714021, "uuid": "2fba28d4-4ccc-49da-b8fb-8d093916ef57", "comment": "Malware payload (Mirai)", "value": "69040585fa59540c00f3db4936d65dc7a78b63529f8959403ede0789b0896f6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714021, "uuid": "539af732-3966-4303-a091-ef4bf01d270b", "comment": "Malware payload (Mirai)", "value": "0eca33ecff17137fd8da6ca51fa5b2e2b6fee027", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714021, "uuid": "c5d2f482-6458-4d10-8af0-4fe1421c9a75", "comment": "Malware payload (Mirai)", "value": "e9a8593e05ec5d015f6a99b6419c267bc3ebaeff1e871ccbc1ee7f98dfc248d7e2c712b67316d7c6572eab5d089df7f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647714021, "uuid": "59806d40-99ca-4a92-9b95-0a74a7ef9603", "value": "T1E4E3A53E7E11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647714021, "uuid": "a0d0df59-0a9b-4516-9062-d6ca6b199e80", "value": "3072:JW6dm9tS1aRGQdK76t/zCpI5mrThPaLEnvPrNb:c6IG+LC+mrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647714021, "uuid": "e38d47b1-130c-4bb6-a6a4-ab0bd93d8e51", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647714021, "uuid": "a2323153-6871-4cd2-b8fb-2ec2e4a34477", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647714021, "uuid": "51242f1a-b749-4cf6-91e3-b8ce43166575", "value": "fdde4ae9d61a44f5ba01574727fe0c79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d301bdb8-a7af-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647713414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713414, "uuid": "147e2d60-fcaf-455a-b3ae-78a8d0cdc1eb", "comment": "Malware payload", "value": "2da4f640edc2f9c4ec22137b8ecb7664", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713414, "uuid": "26b2f048-8f49-4747-a7a8-9b72d8cd2396", "comment": "Malware payload", "value": "6af405ee90b04e560116c3bf4fc5173d504d1759dc480aafc7261a5e7e090644", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713414, "uuid": "7efeae93-35eb-40c9-81f3-b3d1468fa7ab", "comment": "Malware payload", "value": "0012447dafed4a7da85fe2d8f4a210c14037b610", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713414, "uuid": "131772d3-2acc-4124-b366-d3355bdb896e", "comment": "Malware payload", "value": "ce7754db588a0547cc4f6ed4cd970677d8692aec976f41e5e032eb919c74d1e3dc4201b0d522aa63435dd6c8f4411cb9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713414, "uuid": "ee78623b-968f-4a98-8acb-4a6917ea646e", "value": "T1F4232980BD4BE474EC0201F5E1ABDB229779D4BD2405EFBAE7BCD225AC81051978B67C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713414, "uuid": "2cd76115-75f4-4380-b5f4-4d553363dc60", "value": "768:5JEu3gSUS/WFwsNlWuo9zjrgRYbhyGR3J/KmZ7um+PocCYbQovIZMzp744BDFusQ:5JEu3gzHr29zjYYbhye5/TY3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647713414, "uuid": "7ec03e9c-0abf-4fc9-a578-a2979248555a", "value": 47660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647713414, "uuid": "ab80a870-ec48-4024-8d9c-005c60745cda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713414, "uuid": "9c33bb1f-32d5-4e61-8218-78d13b9e8f7d", "value": "x86-20220319-1810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11688f65-a7a6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647709224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709224, "uuid": "8636a8d6-22dc-4dac-9aad-858dae6f785a", "comment": "Malware payload", "value": "bccc4de44c19008b6db1153db2f90600", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709224, "uuid": "91c765ab-b44a-430f-a05b-8ff460ad8b22", "comment": "Malware payload", "value": "6b1a9bc3d99ff1fa45a0e5872be9b897de3a8ccc4f48b35e5aecadfc7496f91f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709224, "uuid": "fca11acf-3382-4ecc-a97c-c14b87b648cc", "comment": "Malware payload", "value": "83bca7b5d2b6bdef275695b6f26fd984b102e353", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709224, "uuid": "976389da-0609-4329-ae70-54dc91d4d877", "comment": "Malware payload", "value": "a8d641e7a863d5886f02fe8589fd28e17c556795b75c01dca26b466028790e8da0cc546e846529f8a485cb6f2e96de30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709224, "uuid": "222aead5-d32a-4700-bfa6-1b8aed4f7f0d", "value": "T18306017C266E5E4CF784947CB1794EFF27A2B82F05A774F7900CB2D70AA9BD05502226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709224, "uuid": "978cd632-e92d-4d96-ae5b-0e5e257089da", "value": "4443ba86c457722dd58af4e4410113ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709224, "uuid": "eb05a8e1-58c4-4758-9035-a3298581fb09", "value": "98304:XpEdtLiNZG93jfpSP1atPI/nRl+WY05grrYyr:XpETCZ6TA1oPcnpcrlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647709224, "uuid": "f5292d45-a075-4cb1-992a-f2a5c0d972cd", "value": 3883256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647709224, "uuid": "e288fe35-88d0-4167-afbb-5b1375b97dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709224, "uuid": "8dd3e104-affc-4213-b7e2-32b3f1691220", "value": "bccc4de44c19008b6db1153db2f90600.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965aa35c-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648458, "uuid": "b6bfa9da-31ac-4e01-b971-e652026d5b0e", "comment": "Malware payload (Heodo)", "value": "5ca944c2fb5b00606df148225588a8ff", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648458, "uuid": "67ff9419-c225-4047-aea4-b5702e0c8364", "comment": "Malware payload (Heodo)", "value": "6b1c05e705d90d85dcc30374f64c2ba66bb50baca9539ead1194d634742d9d44", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648458, "uuid": "26a71fae-5591-42e9-8cec-a42b2cf7c89d", "comment": "Malware payload (Heodo)", "value": "73dfa3384bde468637f2dd7d5f5473a149da22ca", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648458, "uuid": "0bcda6cb-06c3-4d5e-88d6-ed27b4ca3af0", "comment": "Malware payload (Heodo)", "value": "45c23c9eabd8f9e9c71a67bafb6ff9d8e3f39a09a2b95c32595ad14eb032ec89ffa3585e089d920eda83af80c5e7f774", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648458, "uuid": "6246cb65-b0df-43fc-b8b6-77218eb428fd", "value": "T18DD45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648458, "uuid": "cd807fd0-e210-4af1-863a-a1ca8d33ba6a", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648458, "uuid": "4a8c85ef-f2a9-4f84-9b73-81e3fd59014c", "value": "12288:UWBpwupxl0OeL/grxMGzO+r9AjCb/XKh:Psupxa/gH2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648458, "uuid": "5c703581-3722-4a3f-93b3-6a2bd70131aa", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648458, "uuid": "d11aad13-a736-434e-a2a2-9a439709c67e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648458, "uuid": "b7efeff3-0973-4d83-a700-fdabee0aac7a", "value": "emotet_exe_e4_6b1c05e705d90d85dcc30374f64c2ba66bb50baca9539ead1194d634742d9d44_2022-03-19__000730.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e7dfb5-a744-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647667280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667280, "uuid": "cacb61e0-8ef0-40a5-b8c0-a6eb5420bb57", "comment": "Malware payload (RedLineStealer)", "value": "b6f2555de57ae3c6f90cdf7821e0f4a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667280, "uuid": "41d19f86-0c15-4f98-b855-8597cbdc01f2", "comment": "Malware payload (RedLineStealer)", "value": "6c027eb8b1af49f359019eab464156cb24535b599b615c0f3ca7d0e29d07879f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667280, "uuid": "7c291a50-22b8-4323-8040-9227f1a12fbc", "comment": "Malware payload (RedLineStealer)", "value": "b38e95021f8e21276cefdeb414d7acdd0df7401c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667280, "uuid": "e7319573-360d-41a8-8d7f-32f15e73c07a", "comment": "Malware payload (RedLineStealer)", "value": "ff3e9d2ed4fc48a88538461a6ba0294f5c20433013f2cee39e3849794d0caf3d2f5522bf55fb3c48f99d115c27565477", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667280, "uuid": "6ef85424-83e8-4635-8218-6098f5695e22", "value": "T11445238AF39C5730DC55B8B335AF816F9B0A2D794385638738C6F891AE71267093ED18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667280, "uuid": "30f13db8-c6d8-4dc8-a329-39bda6b00f07", "value": "8b842341cb1bba7a38c9a2cfb5ecc182", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667280, "uuid": "98a6e2ba-71b7-4d0f-bd6c-dc97f708f945", "value": "24576:z3X1BJKt9PdNb6KQTiohofsQEiXK/aYTuasMScTxeaVll:z3X1BwfPv6KQOf0Q2/aY6Olll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647667280, "uuid": "dda72721-7de7-447e-9755-a3c1df542a26", "value": 1208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647667280, "uuid": "ce91a66e-74a3-4de7-9d74-fb0f677537b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667280, "uuid": "cad63fb8-b971-44da-a327-40a274821ca5", "value": "29877925.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0713cd3c-a7a6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647709206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709206, "uuid": "c677e997-1a15-415e-a6ad-02380050da99", "comment": "Malware payload", "value": "2b5710da87377cfb16793feb21f65c5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709206, "uuid": "7b3b5c4a-a77a-4c1e-b999-70a80d50b08d", "comment": "Malware payload", "value": "6cead30add35289a2d7b1a20b522255315d96470a00797d0d552001460e51524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709206, "uuid": "f217b946-b063-463e-8dc2-b17e6e30224d", "comment": "Malware payload", "value": "c5b3a30cd095f1df695ad4360011db65aed8810f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709206, "uuid": "b417e191-2775-49d4-afe2-363e226dd135", "comment": "Malware payload", "value": "6ed9a36abcb3d7a3e232923d4ff8bbf35d43023a72209b810b36e7727eb40c9b84a72a8c2619fe29aaa3e5763a504343", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709206, "uuid": "171b0247-30ab-4310-9e29-e07410bc30ed", "value": "T10556123BB268713ED4AF0B324AB39250997B7765A81B8C1E57F0090CCF665711F3BA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709206, "uuid": "b1ece7f5-071b-49f4-bcef-bf7d6346cf9e", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709206, "uuid": "8351bae0-8d15-4307-8eaf-f2c394260fd9", "value": "98304:USiS4CRYku1rLpox2aHtvs9pcqwI9OGmze+AadWbbe7a+5f6IFKLZijuL:/ylL6Qqq9pc9HG8e+AaO+aIfrFKLZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647709206, "uuid": "581bbb46-6802-4a68-bf24-10baec90f9d3", "value": 6366087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647709206, "uuid": "90c1ce41-5b00-4d2e-b9b7-26c5fa954f3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709206, "uuid": "7890dc93-96c1-4011-8ee3-97a31bac66e3", "value": "2b5710da87377cfb16793feb21f65c5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878f85a1-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666472, "uuid": "5825a074-aeb9-409d-8d20-143b6edf57c8", "comment": "Malware payload (RedLineStealer)", "value": "2517887609a3c30a9ae97fcb50533140", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666472, "uuid": "9c447118-747e-433f-8065-4121df669610", "comment": "Malware payload (RedLineStealer)", "value": "6da391c3c8d84ac6d656e36a1263d03491022a7fb7aaaa8d2764742a36a3c2a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666472, "uuid": "12cae450-ecc9-42a4-98e6-ff1fe043b039", "comment": "Malware payload (RedLineStealer)", "value": "ff285fb0ce83bffd2606ba056d1ec1460c8f2b83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666472, "uuid": "d7b18d56-0c91-49dc-b961-2535535f6219", "comment": "Malware payload (RedLineStealer)", "value": "de50bbf6dac0ab8907b13e6c5e908cdeb0012e0b85e240a1466f3dd0ea725519685293d522184305a5ad16c4e2fd5885", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666472, "uuid": "22c8400d-7bd4-496d-a568-1161f575524c", "value": "T1B0B4B63839FF5019F2B3AF75DAD47586DB9EB7633607E44D204103864A13B42EE9263A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666472, "uuid": "9ea26510-f860-4c81-84e9-63cfe2e0f266", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666472, "uuid": "238a3190-c408-4bd0-a56f-94335b3722fc", "value": "12288:nlAwJfVkl/pTbVAypWMKl06yRrnyQhJotEzR/06:nlPJGlBpjyc2M/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666472, "uuid": "4467ae82-9b7f-40ab-8e1e-5ff90154ebb9", "value": 496640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666472, "uuid": "69d4216e-174a-474b-90df-7674b09cb338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666472, "uuid": "c6396f17-6a66-47e1-b7de-6f6c54382912", "value": "23933383.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fbc0178-a7a4-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1647708550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708550, "uuid": "e1f9d29e-8125-438e-aa41-9f636450773a", "comment": "Malware payload (Smoke Loader)", "value": "6b21f12d4e97379630aa2adc942fee65", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708550, "uuid": "c2e5aaf3-9042-48cd-8c3e-e36520c6020b", "comment": "Malware payload (Smoke Loader)", "value": "6f938b90ce6bd3ae088cafc99fbac4b934e01c3cb4ccf4381eec9cec1864aa31", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708550, "uuid": "82d35b6b-42d9-411f-88d9-bdb0f10fb1ea", "comment": "Malware payload (Smoke Loader)", "value": "65b831dc1970013c0e6329ffa21ebbd25874bf7b", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708550, "uuid": "37a9fc22-a1f8-443f-be74-4481cd92ae28", "comment": "Malware payload (Smoke Loader)", "value": "d37a6223206aa7bcdc79714e44588ea0e1f9c8be7cdbb9f96f5a13630593a8ef5baf47b73df91e669b376fed593a71c9", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708550, "uuid": "54732734-9d99-441f-937d-de1034f1c025", "value": "T1BC549E40BBA0D03DE1B312F8797AD3AD653E3DA15B2064CB22D16ADE16306D0DCB535B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708550, "uuid": "30c1e595-f5cf-4132-a397-cde20eebf1ec", "value": "4afe698a4ff3f157978858a4a5de1db8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708550, "uuid": "707bb307-6d36-4a5d-89c0-ca91bef4038c", "value": "6144:24b9PevMiE4BMr5oRaMsbrU3BlElZjn66:xb0vMiE4BMr5o7S0q7jn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708550, "uuid": "0c0fe431-2c1c-4b4b-9dde-0e4e7b7400ac", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708550, "uuid": "953056d7-ed81-4960-aaa2-4b25f862ee14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708550, "uuid": "7e1bc4e2-2c9a-4c35-afa8-7bb2264b7893", "value": "6b21f12d4e97379630aa2adc942fee65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "618ffc5c-a740-11ec-9275-42010a9c0029", "comment": "Malware payload (Hive)", "timestamp": 1647665549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647665549, "uuid": "8a7139d8-f076-4e44-a857-366afeffb05e", "comment": "Malware payload (Hive)", "value": "514b741214951b9d39d66688839a223d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647665549, "uuid": "e0a93ce6-0674-410b-83a2-e85e65d418e3", "comment": "Malware payload (Hive)", "value": "70014630f792eaef394f6efd9d0908b48628e11aae3686be939ad6eabd3f81e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647665549, "uuid": "1ce844c7-0605-4e17-8c8d-c5f7213b1d70", "comment": "Malware payload (Hive)", "value": "9eb2d3dc933f7b7990dff2e1edd3bdfd57d827f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647665549, "uuid": "ef43e9d4-8393-4195-b811-c65c8ee7c582", "comment": "Malware payload (Hive)", "value": "700ff1d0882339ea0f537c97f41a91fabd790ccd147fe9f29def6376fd5554220f696ab5f498ad7afe747e5f9dac493c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647665549, "uuid": "ba82d433-20ac-49b9-8d32-d8405205d67d", "value": "T1EA4633BA840371A9B9D57C24A23DF8E519DB71238E7B35704C0BC8D5467A8D3EAD2B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647665549, "uuid": "7530e7f0-b273-4695-b81d-04d072cae1c7", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647665549, "uuid": "246bb362-ca6f-4203-a93e-5a7553d0fba6", "value": "98304:zW8Mo3GkNiszpkbVXdA88ND4Ux6l40lEZEORKCRH+CV1tODjIW0YkTKiy8Ezfd4w:Yo3GkNhpkWw4PEO1hV1twjRiydT25AXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647665549, "uuid": "55e40854-b392-4fd6-b38f-a95def08f9c3", "value": 5636096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647665549, "uuid": "7a5b4fd9-129a-4e2f-95cb-f6bb175b3d34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647665549, "uuid": "389e356f-129b-4e97-acab-f20dd415b900", "value": "99608309.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a333cd1-a71d-11ec-9275-42010a9c0029", "comment": "Malware payload (TeamBot)", "timestamp": 1647650451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650451, "uuid": "f1e5f057-d7a5-4958-aa41-0bc40b700d8a", "comment": "Malware payload (TeamBot)", "value": "c5a2bd8d056dae49330b8fcfce048d9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650451, "uuid": "7d4c2d7f-8f07-44af-80d5-683e620f09da", "comment": "Malware payload (TeamBot)", "value": "7010e15402dd81b0e1501490be034e92dc706ba28c38b6925dbd33e9ff45a5ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650451, "uuid": "62a0f8ea-e0ca-4270-b7e7-5d8666f4d8bc", "comment": "Malware payload (TeamBot)", "value": "9212c07c41a041412970a6bb5a116a758100fa8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650451, "uuid": "07ee1ad3-0748-40c2-9b71-a5ea8196d246", "comment": "Malware payload (TeamBot)", "value": "7ab95af8ee9fe389a88668b7716e21a8466b85850c258d398d2684ed88318fb485d518628575e28beada4eb92adff1c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650451, "uuid": "7ab01ca5-fbd4-4c99-a0e5-b5a1e95135d1", "value": "T19B9633ACE1BCE04EFEF9507399535D78B07A32BE05749E8B1B64D28C2DCB69848C41E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650451, "uuid": "e68f544c-e2d3-4d3d-9208-5289539c215f", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650451, "uuid": "417ecfcb-ea0d-4e05-ba44-5b9b789ee4d9", "value": "196608:JOqxe9kFys1a0zNvQsQIbgKyuo9Pw4g8+m/SB2Z6RgQ:JOqxeON1lRvQsQlFu+w4laB2QD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647650451, "uuid": "5e29ae50-bfb9-4f3f-90de-396d5f21dc38", "value": 9125188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647650451, "uuid": "4080ea72-44ff-4061-a6e8-ee5477033772", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650451, "uuid": "974e8c15-ed6b-497d-91dd-6594217a98f3", "value": "c5a2bd8d056dae49330b8fcfce048d9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c16b488-a7a5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647708866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708866, "uuid": "847e54b2-e313-424f-a990-bcdfdadd15b8", "comment": "Malware payload", "value": "1d8034d9d81636045130c8a328c47c86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708866, "uuid": "b41ee332-78a9-42a5-bf7e-f5e2411ae561", "comment": "Malware payload", "value": "70b2cf11f68bfb9f86b70d10ae3d96cfad549325be311e477d9ee4a7f67f28fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708866, "uuid": "56ef6675-8445-435b-9547-5d46c50a4c54", "comment": "Malware payload", "value": "7ce1e2a4093e2ff2fc2587b0dd0cac1845e6283a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708866, "uuid": "64ca130a-047e-4ca3-b9f0-617f391a5778", "comment": "Malware payload", "value": "435630c97d8e77ee06a473d6ab5d583e7e67441de1db8c2e60493354127a4677bab1972cd542547343f0515b93cc94a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708866, "uuid": "f1407f54-03c2-443e-82ee-e79760065c5f", "value": "T13FD4F7BD316872AFC877C0728A681C68F651A4FB631B5917E55307998D0F887EF840BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708866, "uuid": "6c31a91b-7da1-47c4-bd41-36fe9721d8c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708866, "uuid": "79f6fc6d-036a-485e-9b9c-9088a31a3c43", "value": "12288:DC0aOH0zel+xQU/fhWlNrB8dj13p8zMIDRm3l/J7DvBJFjVqeIcf8S/zBuB8t:uPp7tJFjVD1E2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708866, "uuid": "faca23e0-b2d4-4792-81a9-dacb1207ad14", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708866, "uuid": "47c43d80-e380-49c7-bebe-4698ed0bcaad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708866, "uuid": "8b50aa81-6117-48de-a412-d59ce4d18194", "value": "OFFER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3719cbc7-a71e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647650875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650875, "uuid": "2247d829-33de-4346-8048-0e323d654b48", "comment": "Malware payload (Heodo)", "value": "3e0e2da81bfbf36a538068a02f0de72b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650875, "uuid": "cdbd5215-ea2d-449c-b135-08be6f18f767", "comment": "Malware payload (Heodo)", "value": "71f79acdbefd92b9aa739884d9ea81f56bd74db4e04f610c43f9430e00004ee3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650875, "uuid": "242f7c02-4938-4501-9b9f-36ab8a8a1590", "comment": "Malware payload (Heodo)", "value": "97f9e607b78b6deb29917c2f409d725be32a77af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650875, "uuid": "0bb60405-34a5-4015-aa7e-3ec808124c0e", "comment": "Malware payload (Heodo)", "value": "fe0bccbad0653c80330032507abb15a14bf57bd6f7b95dc894b8c0585daba4c17451457e43e91fc860f953f8d5edf689", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650875, "uuid": "2efd5989-b80b-459a-8b32-b670aae58a9a", "value": "T11DC47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650875, "uuid": "8415c492-89b8-481d-9dfe-cd355ce6983d", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650875, "uuid": "1b3c2190-df2e-42f7-b3e8-a6e99fa0523f", "value": "12288:S54yM33d3q3Z7BogKreNmF+U/9JckIAGfUeb:SKh3831BocN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647650875, "uuid": "68ee8cd7-291f-45a4-9cd0-d5670d26076f", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647650875, "uuid": "2c9201b5-5439-40f6-8ec4-c8f824da31a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650875, "uuid": "7d780dea-01ef-4fad-85f6-d0e51cd0ff8f", "value": "3e0e2da81bfbf36a538068a02f0de72b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39593bf-a769-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647683404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647683404, "uuid": "d2bdfd39-b0f0-4ced-8386-b121c20725c9", "comment": "Malware payload (Mirai)", "value": "b6dece80a87cdc1705a529c7e01d6f85", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647683404, "uuid": "c989529d-1cb0-4337-a374-e497215f8a75", "comment": "Malware payload (Mirai)", "value": "72012267ce84b5630dac2d1099eeabe000e788cac6d605f22e1dc269c6acf392", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647683404, "uuid": "a5f502ba-f4a4-460a-90ba-1440c468e426", "comment": "Malware payload (Mirai)", "value": "7e3900e757d73f9fc9ca6255d05e930863fe8b13", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647683404, "uuid": "d82727f7-6786-4ec1-b232-6955e2ee044a", "comment": "Malware payload (Mirai)", "value": "3b36c87b84305fb7f9ab1d53fe755c8d5377ecb0cd8139128561c7b49309b0d0da3eb03234412b0a4fb7aff795eb2367", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647683404, "uuid": "6ae85888-2191-4203-aeb4-49531f49fc18", "value": "T1D6F34C86EA418B13C5D71776FA9F414A33229794E3DB73028D286BF43F87A5E0E17909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647683404, "uuid": "7018256b-7dec-4f13-87c8-577ff9757083", "value": "3072:2S9b/5D8yKMhMtn8hxaGGLKWojfBV68YE3PqJ6M/9FnMqM:J9VD8yOJyxaGGLKWWfVD3PqQM/9JMqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647683404, "uuid": "d72297c2-28e3-4fdd-994b-7c368181f809", "value": 165387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647683404, "uuid": "e9ffb30c-3b5d-4b3a-93b6-7ebc246a72a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647683404, "uuid": "d9e3168c-ab1f-47a3-94dc-9be5d29c007e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac71257-a7bd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647719171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719171, "uuid": "1aeab61c-c36f-4ae5-a916-d48fa7f456a9", "comment": "Malware payload", "value": "bd21f9df6c64a54ee6b688678dcd10b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719171, "uuid": "b225940b-b26e-41b1-8c92-58426cfb8ba8", "comment": "Malware payload", "value": "7320eb9fef53b7977739af25476e983bce30af94468e0506db0b00e24b3dc735", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719171, "uuid": "8aa306dc-e441-493e-919f-57b9ff090ee8", "comment": "Malware payload", "value": "c638a00f5efcda144f62d808acbd1c72de5c656d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719171, "uuid": "1613336e-f103-43ea-b199-088b7d84ca3a", "comment": "Malware payload", "value": "9d9e1d527c217c80e307e735b40eeb8deecd81a997b103764a75d51a7af527b3cdf64473569f315010dd01eedc9064cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719171, "uuid": "00daea31-cf4f-47ff-b0d6-c8c67ea17bc6", "value": "T1EB52A6E2F906ED79F80EF73FC40685057471B64A52425A36677B293ADDB32880873F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719171, "uuid": "8d3dad38-0a16-40ca-b2a8-e968360357c4", "value": "192:zpEWlSqdoiyoCQ1PZ8koTKvku/FjxWyQB02Hx261/A9ywAIMnrZuEkaanK:FE7BWCSZhoMku9iO88HAtryPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647719171, "uuid": "50b5c8d5-3011-42d4-b706-99b0b665b9a0", "value": 13780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647719171, "uuid": "378593aa-6064-472c-a132-cd021f162b5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719171, "uuid": "fba17ec4-c9ba-4b48-a3c0-cd66f9ab8a40", "value": "bd21f9df6c64a54ee6b688678dcd10b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e96c440f-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "b32fae71-f969-4c6f-81f4-d3ad77773b01", "comment": "Malware payload (Heodo)", "value": "c5e391f28fb7bab62b0be1b70f76bb7d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "9c70c8f5-ff80-414b-93e4-c728d26c8876", "comment": "Malware payload (Heodo)", "value": "739b3e5aa5136ecfad806f7122a7b38f3b99c3e9e89414b80f162c4f4e531980", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "da21178b-ce22-45f8-82db-c0d8913005c9", "comment": "Malware payload (Heodo)", "value": "33091722885842f2796296587b5fd687b3add784", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "3c0aa7d8-e2b5-4ef6-8b02-45268eddb537", "comment": "Malware payload (Heodo)", "value": "09c312febe0b3062cb2887a25fe2f26c73d412869954a8e34c9d79cd29972884404a18737d06b5fcde37b878fae00550", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "78260d59-64c9-4ddb-954b-2779b0af1e13", "value": "T13DC47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "b60c2b41-7539-4bda-8530-dfa46c13780f", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "c1ba9072-abee-4cab-aef3-be54a787ceb7", "value": "12288:S54yM33d3q3Z7BogTreNmF+U/9JckIAGfUeb:SKh3831Bo5N6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648597, "uuid": "ee56d45b-39f9-4b4b-ac8d-9f28d18ab31f", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648597, "uuid": "9c413d51-85fd-44db-a020-6641a460dffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "3773971e-8620-4753-b222-3154ddf007ad", "value": "emotet_exe_e5_739b3e5aa5136ecfad806f7122a7b38f3b99c3e9e89414b80f162c4f4e531980_2022-03-19__000951.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2beef574-a7a4-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647708409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708409, "uuid": "21e4d0ed-19f0-4b78-bf84-f60618c96b66", "comment": "Malware payload (RedLineStealer)", "value": "fc894efe39b4e0f03b3693ca4ac280b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708409, "uuid": "fc42ef85-ffcc-42e6-bbe1-aa57ec990a60", "comment": "Malware payload (RedLineStealer)", "value": "7466275d0e34cc238a41d92e1e86d231d1c82af720f20bd4a1f2d0a4c529406c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708409, "uuid": "4de9d25a-62dc-4cc6-82be-2a18a0189855", "comment": "Malware payload (RedLineStealer)", "value": "2bb985e5a172dd0da9da506ff6120f506a5d6caa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708409, "uuid": "dace1029-4c43-4fce-9bc2-01a788ceae35", "comment": "Malware payload (RedLineStealer)", "value": "55693d6f9fb9bba94605e0754837b9959820108a82510ed7e0f5868012497d636abc3952bcc3ac3413d5cbb59ceb0672", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708409, "uuid": "73cb94f6-325b-404e-83e0-119426a100ef", "value": "T10B352336EAC55F0BE5648335C673DBB33DB2F300423DAFDA6289151DD832A253EA0A55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708409, "uuid": "85708676-5fec-4a2f-b5ed-68fc3ebaf947", "value": "22cc77f0399a6b76150e226c5eefcaee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708409, "uuid": "f854be00-0481-4c09-af2d-829c18c0963f", "value": "24576:w0G+n8SBVWgqDRLSvDeqLvAOmvN1pA1wyCmF:w09wgpvDehO81pAC6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708409, "uuid": "514dc4b7-be4e-4c3e-9b41-a37f2e9ab911", "value": 1058528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708409, "uuid": "73198ca9-3fbd-40c1-be01-81234c11fab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708409, "uuid": "38bcb571-a861-409c-9e32-7f2f45bc833a", "value": "fc894efe39b4e0f03b3693ca4ac280b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed677d0e-a7af-11ec-9275-42010a9c0029", "comment": "Malware payload (Pony)", "timestamp": 1647713458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713458, "uuid": "c191cfd9-914b-47a8-bb07-8deae0a59b36", "comment": "Malware payload (Pony)", "value": "4dbac239fc8b5448a1cf438791ec3304", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713458, "uuid": "a4724893-d640-46b3-9303-7ad7ec390940", "comment": "Malware payload (Pony)", "value": "75183addcbedac606f43840375c159b3939bb223a1dd53fcde51e74e840ed561", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713458, "uuid": "fbc2db48-0acf-4cca-ae28-6fb2567262e1", "comment": "Malware payload (Pony)", "value": "80183f914ffa1946571592c1630d4bde85c7f849", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713458, "uuid": "ce84051e-7924-4ba1-b7ef-1d07f306f135", "comment": "Malware payload (Pony)", "value": "a7335475d119db2e957c0051d93c2b97a0902826a2f7e7e980fb69c3b575a0894df520903d03d881fd145a1ec5656da4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713458, "uuid": "212d05c3-57d5-4eb4-ab15-64458daaf116", "value": "T18724CF4262EC9221ED31D37C4482E2E057E6A8E1DA9447CFE735FA5A3CF27427786352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713458, "uuid": "9f141edf-c8f2-4070-85b8-a9daa5c40977", "value": "b1c8995d8ea2a32b0a4c684fa5fade17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713458, "uuid": "0eab3c16-310e-449b-96ae-d0413dd897ba", "value": "3072:2w4A2KUqAN0ESi1opCAbC7oY8Y6UgH+lYXvIIy9QLIGFCWcow:94fdqWaDbCkYCd+ChyShQZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647713458, "uuid": "eb73880c-22eb-4f86-9817-1c0dda137862", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647713458, "uuid": "5f0219af-d32b-4ab8-be83-40526be587bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713458, "uuid": "d6285611-143f-4ef0-999e-ef9a6aab69a8", "value": "75183ADDCBEDAC606F43840375C159B3939BB223A1DD5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a2a9c6-a744-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647667224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667224, "uuid": "3628d198-7267-4989-ac37-032cbdf122d2", "comment": "Malware payload (RedLineStealer)", "value": "4423332549c07ab8c699c83fb311dd17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667224, "uuid": "09926aba-a391-4276-b9d4-0b40bd7217c5", "comment": "Malware payload (RedLineStealer)", "value": "7a2e6a9408f54df1e14f84ff63edc0c2e38786608411db6501d415aabba24676", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667224, "uuid": "094b7333-a0e1-44ed-86df-20567ac4aeef", "comment": "Malware payload (RedLineStealer)", "value": "b48495820c4fe506e9971e980be4de85e22477fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667224, "uuid": "5e626384-819f-4207-a233-4533df0a6774", "comment": "Malware payload (RedLineStealer)", "value": "2d3ba79859ccae4e54ab07078aa34050337651a28a498d5a78b3d7fdea39e3cb59e810f3a9bbc2e6532e947594d7d0af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667224, "uuid": "f22d6489-a0d1-4cba-aeaf-906c0ce0b44d", "value": "T18A26334D65FA3D4FF029CE76B2BC2B04473528BE9AD6F0A492EC38435D9C097625CAD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667224, "uuid": "65713158-52f5-4ce5-a43a-93317c9d9fb3", "value": "dfec469ff9e19f9df882decc3c09398f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667224, "uuid": "84833b48-1a6b-49b1-ac59-0763e0c934b7", "value": "98304:o5mF+fD7kwrxsWXlwZwgEiHhdEkZkGefGHGx2aQ6Fw:J67kwrnX0QineGefqGcz66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647667224, "uuid": "c6249389-017c-4655-a3e4-a49c4b96206d", "value": 4851352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647667224, "uuid": "0ad619ba-345c-44bb-8f64-97bb4676bebf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667224, "uuid": "2b04336c-30a9-4d8a-8f84-8386a0e98b40", "value": "29746868.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb2c9ab-a737-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647661808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647661808, "uuid": "ec665c27-7c5c-4c4e-b6a4-8538f6d1818f", "comment": "Malware payload (Mirai)", "value": "9b5659a181e3ccb95a2d767256ec8538", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647661808, "uuid": "b2b4ac0e-b678-4966-ac33-72ec5e0b6d7b", "comment": "Malware payload (Mirai)", "value": "7a4df1693ff2cf9e5e494f21d644b4c714b0d52bade6def5d2cb6c9023c9321b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647661808, "uuid": "c1c03077-52ec-47fc-af8f-b7bd796a939f", "comment": "Malware payload (Mirai)", "value": "a56ff6fa07b8b20ea5f327711923d7c285bece1d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647661808, "uuid": "90b84a64-985d-454d-bb8d-f78da9134d84", "comment": "Malware payload (Mirai)", "value": "e7ae4ed5ff121f7b4188c63b4680915b8703915ee4f7f2d29baec5a497a44dacf062ae45baf5f37f677405c564acbab2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647661808, "uuid": "e0fef340-8263-452b-9d1c-3400087b5804", "value": "T156B30A51B9815621CAD722B7FA5E068E332553ECE3D732079E351FA073C681B1D2F94A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647661808, "uuid": "e8a06194-a0d5-43be-99a7-6e6540208631", "value": "3072:W7/YyCIoJJx3caMrqgJhAnV8vU8xNFxyVivSsRXvR:W7QyCRwa7V8vjnyVfsRX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647661808, "uuid": "8005b301-ad0d-4455-b867-be63e862e4b8", "value": 115876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647661808, "uuid": "0fb60829-b4f8-4d70-80b9-08518f114a2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647661808, "uuid": "0a13dbf8-effd-459a-8ae0-0a92e797f717", "value": "garm-20220319-0350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec8b53e-a741-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666162, "uuid": "f371f986-c303-4ab7-8427-4591a41bdd71", "comment": "Malware payload (RedLineStealer)", "value": "4052497e8d0498582cad282f82ce3e79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666162, "uuid": "519b4b2e-e4a7-41ef-ad4f-6095d10c7302", "comment": "Malware payload (RedLineStealer)", "value": "7aa28b5c119faba2ed8722cc180dd4319602a5925d0f535d739bb644ed63f834", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666162, "uuid": "15ea130b-86da-4fd8-a74f-e28ebc3bb69e", "comment": "Malware payload (RedLineStealer)", "value": "b1b36bc5f640513cc0fc74069660f83ce8c0c2d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666162, "uuid": "d621d935-344b-41f7-8f7c-9110293402d8", "comment": "Malware payload (RedLineStealer)", "value": "9577ae832211760547709f5e0338472d8b30f20eb4f69e8f8ba996f4dac4b571b089b0748c8a5de1574a09b1e1ce0efd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666162, "uuid": "d5627f5f-5eee-4c65-a292-309e0d8ace7d", "value": "T1F326339A4AD8FE31D09D7D39A79BB86E34C0AA7D86D731F40B3CC83015E45A06BD95B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666162, "uuid": "1ea77026-ca2d-4cd0-8751-0e7419848f38", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666162, "uuid": "433c78d0-5dac-4378-b504-9bfb6c044f93", "value": "98304://ZpH5cit6Iuf5eWwo9hurqaLpxoZOdbASyFFWkvp://5cWOck6/oXWkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666162, "uuid": "cbbe213d-e6c0-4033-89b5-68f2b8650493", "value": 4426240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666162, "uuid": "6093ba4f-1428-4b64-b244-974e7adbb42f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666162, "uuid": "8a18d75b-d183-442a-9d5d-9081a64d4368", "value": "21390026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0487cf-a741-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666104, "uuid": "09f4f005-9657-4944-b23d-bf45b3e4aee0", "comment": "Malware payload (RedLineStealer)", "value": "a28ad6193c5bb5935025575e148ceee5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666104, "uuid": "16140824-442d-40e9-a340-9e4d6073a532", "comment": "Malware payload (RedLineStealer)", "value": "7bbfda59f3a8047518a527c00e4db313c1c5dda039bea1ba133a65f57bd50c97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666104, "uuid": "4bf89ede-a324-4b85-a0e9-5773d53b6279", "comment": "Malware payload (RedLineStealer)", "value": "91e70d3ab98ec5c61264eafef8734c80cb62752f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666104, "uuid": "8d30af36-cafe-464c-912b-0bf77f5eb437", "comment": "Malware payload (RedLineStealer)", "value": "b9eec19a087de7ff1d5d40ae59be01d91b0a9dc7077ceedf9fd4b3825ed00bc5151ed7ce38087b8f2e3aee516a89f982", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666104, "uuid": "4dee010b-992c-4b59-9a98-ac8e5afe3dd2", "value": "T1DF3633A4F701CD2BD141EB71F32A7EC76A845D1E6001368C269D3D8B74F626BFA18CA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666104, "uuid": "dd526a5a-8dbb-4ed5-bd13-fbf4a26a1605", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666104, "uuid": "9f15f119-9d7a-487b-9379-115b9dc4fe75", "value": "98304:pvE5ofuVHOQU0qWOE/SuZ2Mf8VIhTit6pAbLZCd0s3xX:kofarWj6SWJh4bLMvxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666104, "uuid": "6fe618ec-b1ed-43e1-a3ad-c4c4bab102a4", "value": 4989384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666104, "uuid": "0f7cf262-2577-4ba3-98e2-f70b596cc9fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666104, "uuid": "f6a147c4-e376-4ddf-8fe6-f80562046c05", "value": "21188125.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "812c388a-a725-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647654006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647654006, "uuid": "d6bd0499-8b81-4d24-9f57-d79e00df70b6", "comment": "Malware payload (Heodo)", "value": "dc250c1fa23f3702afc29e72d75254fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647654006, "uuid": "81133579-4610-48a2-8a41-926d3fc5ff49", "comment": "Malware payload (Heodo)", "value": "7e049fefc2f81b57fe14c74364118e6c52da513b5bc45381d8b25e2f60408b49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647654006, "uuid": "b0e8ed6c-2666-4697-bda1-da710e289c9f", "comment": "Malware payload (Heodo)", "value": "bfb231ac56cf6c38a99bd7bf85f21e671e20b740", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647654006, "uuid": "0a7100f2-15b5-4ba6-a1ba-026f8690103a", "comment": "Malware payload (Heodo)", "value": "b27af74718528a9959ce214831f5ee3d68d7e2d89b7f314fe39012be88b282c5afc59b5e55acca95754d01b741b88920", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647654006, "uuid": "e7179f32-9011-4111-a80d-95c6cf37a254", "value": "T10ED45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647654006, "uuid": "7c4c4533-78e6-4109-95c7-d480df11b346", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647654006, "uuid": "4e9e0970-10de-4483-88ac-6213bab89da8", "value": "12288:UWBpwupxl0OeL/grxGGzO+r9AjCb/XKh:Psupxa/gZ2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647654006, "uuid": "d3033b07-8dfc-42f3-9db2-52310bb83c2c", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647654006, "uuid": "22f87394-0a1b-4d41-abe9-350316d790ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647654006, "uuid": "48e3d2f8-d681-4062-ae72-abee7b62f1ab", "value": "dc250c1fa23f3702afc29e72d75254fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d50c1d0-a7a6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647709217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709217, "uuid": "37ddd3fa-0151-4436-b580-2fe5b48873ea", "comment": "Malware payload", "value": "f1ef39cf734ed32c60a50e980e7e12da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709217, "uuid": "b2abc029-4c2d-4faa-81e2-734766915194", "comment": "Malware payload", "value": "7e1c5e6aea240977740eb07ceb6258c8b83d0109de1cfe59b0beaac3422d2dff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709217, "uuid": "874dad70-801c-49a1-9ec1-31022a958159", "comment": "Malware payload", "value": "7ad1456c82cdcc3d5e3932b6143037913a336ad9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709217, "uuid": "212b722a-3d00-4216-8aae-eae389d097b0", "comment": "Malware payload", "value": "31e934efc18cf59bdc293c1615c838a67547128110a7ba20c13889fa963db7d37351b11aa0b087a0ddad5002e098b05f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709217, "uuid": "9231bc86-3ec2-41b0-acb9-c9613ad56c8b", "value": "T1B12633A7C1B08863D2BDB179006B21B432C3A7854967A6B34C1CF53E6ABF55ADD72C13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709217, "uuid": "bc302bd3-f4fd-4f31-9a6c-7a7e58e707d1", "value": "98304:u/Tdbg8K6VID8cOLfthn5FXHcVZnSqJq8aa94BPVS7GRVQcVJ/hXZ765CJdTSckb:EtgYuKLVhn59cT74BdS7GRVQaTJdTNkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647709217, "uuid": "7dd7ee3f-e6f8-456e-9516-6139bd40e566", "value": 4727599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647709217, "uuid": "6691ee1c-6ed1-48d6-92d1-b0be82801bbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709217, "uuid": "1faf173f-4b4e-46b1-8ffb-9cbcdade78d6", "value": "f1ef39cf734ed32c60a50e980e7e12da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce7f8fec-a729-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647655854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655854, "uuid": "6f739482-1494-4931-8077-d9ad840f087e", "comment": "Malware payload (Heodo)", "value": "e50e5beeb94e2f326761fb08ebcfa3bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655854, "uuid": "da1d39f8-40b4-4416-b035-7292e3f175dd", "comment": "Malware payload (Heodo)", "value": "7e25f4379e0ea7070164e009aef2f1beb8da8346f5f7de464ee66786e27826ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655854, "uuid": "d01d216b-72fd-47b0-9670-0fafd20fe35a", "comment": "Malware payload (Heodo)", "value": "108e4d8a90bde22819da05327d2084290a877f47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655854, "uuid": "7866eee6-1d07-4e71-b40c-4e19a015450f", "comment": "Malware payload (Heodo)", "value": "31494f590d20e6816dad892426a6a473e52557649369d1a0f9971feb2fc9d8455d6efaa968912527542e05d03cda6a43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655854, "uuid": "d0891120-1b29-4055-a15c-e2d2f2a3d143", "value": "T1A2C47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655854, "uuid": "1420d22d-0b6b-4289-b3bc-11d444432670", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655854, "uuid": "44b77719-a33d-4160-89ab-9942bc2f325c", "value": "12288:S54yM33d3q3Z7BogtreNmF+U/9JckIAGfUeb:SKh3831BojN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647655854, "uuid": "4e992450-3514-45b7-824f-1e182f6d0251", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647655854, "uuid": "6fdf7cd8-bad4-4964-91a4-4ff6ad200a88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655854, "uuid": "7331755a-b309-4117-9a81-832d75fb4493", "value": "e50e5beeb94e2f326761fb08ebcfa3bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43267e0-a769-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647683405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647683405, "uuid": "b77e5e32-b6e0-41cb-b725-e2db3a835016", "comment": "Malware payload (Mirai)", "value": "eeba10285a9715cefb3708dab1b5e147", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647683405, "uuid": "0b608e99-583b-4675-a649-9b270adf7d48", "comment": "Malware payload (Mirai)", "value": "7e88ed156792b237a9e207088d7498a6df44b573c06a822748e410ce113804a6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647683405, "uuid": "76215c41-5f52-4091-8c90-48c625d308ee", "comment": "Malware payload (Mirai)", "value": "7e554aa7731af4269aedf7b1131163be8cce50fb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647683405, "uuid": "129bed3c-430b-4f57-832c-b52546f87918", "comment": "Malware payload (Mirai)", "value": "e66f7908de821d1e1aa7c966b18aecf4dced2b8acc8c784328ae7502af11609e4be84ec5912910ecc9fbbc8dec467d5f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647683405, "uuid": "048fd758-c59d-4ce0-b14a-cd35857cf7ad", "value": "T1EB735BC4E1C3E8F5EC111978307AAB729E77F13E7139DE9BD399A1339941202E60625E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647683405, "uuid": "29679565-d163-4820-b7e3-e3d608d9c3f2", "value": "1536:b/DYQYs1ZokODich0N15UzOHIt093fsH18ruUGDKVQSi:zDhzUkODich0BUzk40N0V8qbGVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647683405, "uuid": "d270f5dc-2268-4ca2-ad18-9ac673af1563", "value": 74640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647683405, "uuid": "058a0d17-f73a-4907-bce0-07db323d3f60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647683405, "uuid": "1a28f8fc-9e43-4e51-9bfb-7ad5b6073c88", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57fde545-a77d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647691733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647691733, "uuid": "2389d261-51b3-4559-b1ed-e7a39adebfb6", "comment": "Malware payload (AgentTesla)", "value": "8d33fb481d04094532badc93282d6758", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647691733, "uuid": "bff19ec8-0fc6-4e19-9136-9f720286479e", "comment": "Malware payload (AgentTesla)", "value": "7f16b454ec10a4bfa7c90edb9dea06faf3099fa926e2defbebb261826b1fadf7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647691733, "uuid": "42ef22ea-eb98-4120-be65-bd64514796c9", "comment": "Malware payload (AgentTesla)", "value": "c354e5b2c6b6e6432a2d2a8ea01fa61d676d5ad3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647691733, "uuid": "73acf844-75b8-4aa5-b6a0-63d88bf7f463", "comment": "Malware payload (AgentTesla)", "value": "d5086cedca80dd270976ae812b0e0f5827edf43662960855abe9216b2af6eb9f5f2709813dcceb3e3c49f7dea3d1870e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647691733, "uuid": "eb69d3c6-7162-40ee-b47a-d6df8cbf9476", "value": "T1D8353351F3B504F7C5B2A2BC506F1C55F36AFECE8ADF22E693204A7A4125C798E0E254", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647691733, "uuid": "1f90a9ca-785f-47c6-bdf0-2bb3a9214395", "value": "24576:0LEoei+69sOYF19X4LmRDwIIMHNvysaDv4wnOf6Yd9d:04ovuOYF17RDwIIaN6DwwnOf6Yx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647691733, "uuid": "33fc189c-9741-4bcb-8a87-8e1c024aa4b3", "value": 1084917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647691733, "uuid": "5fc36d10-cdf3-4014-a906-02da964cd3d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647691733, "uuid": "507d7cf3-7889-44cc-aff5-45c3caf7a5e3", "value": "MBL+HBL SHIPPING ADVICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a55c8c-a7b6-11ec-9275-42010a9c0029", "comment": "Malware payload (XpertRAT)", "timestamp": 1647716477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716477, "uuid": "341cb1b4-4060-487d-8b74-e7b3d8adb12a", "comment": "Malware payload (XpertRAT)", "value": "82690988d795de1d62ef07fa292a5660", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716477, "uuid": "7bb2797f-f102-49b2-9f33-f9a4238a02cc", "comment": "Malware payload (XpertRAT)", "value": "808e6e938894d045a0046ccc43b5351d0d1130ef689aa1162fd4dd91d4b7c782", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716477, "uuid": "02471d57-aefb-4bce-b962-1dc2b7b1a29a", "comment": "Malware payload (XpertRAT)", "value": "08ac3592a891045e02db63e2ce93366cc04ee4b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716477, "uuid": "38a15bd2-d78f-41ca-a07b-294f8c22e98a", "comment": "Malware payload (XpertRAT)", "value": "532f16d7b84c5a4a31530d8d541591627bcc2a4c695a8ce38fc8cf9c10491db7345519078204e6597ab49fb7bcc75c5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716477, "uuid": "0406eb41-acde-42ca-97ea-f1773e14f522", "value": "T1AFF412ED36896BA3EEB5C3FED6BAA41813B5B4719462E104DC8221C741E2FCC2954F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716477, "uuid": "7da519e6-4f38-45b9-98bc-803291c80dfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716477, "uuid": "62e49a30-4d1b-4140-be66-ef1cc053e0da", "value": "12288:3IuwOEfkOqaCRBP+irkUFn8hvoPmXLEAgET6LngwXLpuQeEzYfh33maVOD39E:4uwOtdaPigon87XPIgwbJX0tmaVEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647716477, "uuid": "6cfd1d24-46ec-44b4-afb1-ea6b2b49fe0f", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647716477, "uuid": "fc747bd6-b7df-4609-a826-f9ed7b53c85e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716477, "uuid": "4bf06b73-f5fa-4895-adc9-8d4e30b026a7", "value": "82690988d795de1d62ef07fa292a5660.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a355a8-a7b6-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1647716129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716129, "uuid": "babdd4d3-e4fc-45de-94de-d202f5caf8e2", "comment": "Malware payload (CoinMiner)", "value": "79f3143ac8ecd0876d303b852620f479", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716129, "uuid": "e6720e49-ce79-4ae7-8467-45c333ff25d9", "comment": "Malware payload (CoinMiner)", "value": "81ec5293c1be63d2bdb173f258830914b3dfd094159211f1703b4666eeca1cbc", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716129, "uuid": "fc46bd3c-afd1-400c-8e08-ea321be2e49a", "comment": "Malware payload (CoinMiner)", "value": "63b39e7cd8afd8a26d3c984d4e6fa2beaa87b9a2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716129, "uuid": "436abb92-6d75-4ced-8378-4e314934d393", "comment": "Malware payload (CoinMiner)", "value": "7fda4afffc5fbcc6a34d4134e3837076c9b4c65f5323dc8d64fff84d199ecab9ddd57204a7bbf78cad45b761110935e4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716129, "uuid": "0deebdf8-f0f8-408f-a150-311dec20e723", "value": "T10E34BF4976C1C0B2D5A319716870A6B1593EFD300B659EEB73C41ABE8F312E1BA30E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716129, "uuid": "3ca5ad27-261f-4bdb-83da-b427ca48bb6b", "value": "a09fb7ac37c6846f86e7eae4dcb32d14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716129, "uuid": "9de97573-c3b0-432f-8047-6fe5a074522b", "value": "6144:oTxLfvl8PmgNJPuir/t7XhId0InOiABjUhgaQ:oViPbuir/5XWdBnOiWjkVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647716129, "uuid": "02f63604-1d5c-4db6-abcc-54dd1b5a48a2", "value": 235008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647716129, "uuid": "cba7fc59-6e9d-4ce7-9121-f2e13412a1ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716129, "uuid": "b033f382-dae7-4dbb-9df5-d4e65b3e608f", "value": "79f3143ac8ecd0876d303b852620f479.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde4000d-a72a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647656255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647656255, "uuid": "8e50f1d8-994e-4dc9-b0d7-bd172ae1aa77", "comment": "Malware payload (Heodo)", "value": "5f94ffc9e173c4be33081bd388bbb8ea", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647656255, "uuid": "879e02e9-401f-4c0d-9968-863b30ae28ab", "comment": "Malware payload (Heodo)", "value": "823cf0935c664e10d843f2f3bfe95f9782051ae339bb0abce374177a4a592c15", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647656255, "uuid": "08c885e8-19ff-4384-bdef-d08183452e2e", "comment": "Malware payload (Heodo)", "value": "9d02474f567567f73fcc5999d8a0d725173febbb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647656255, "uuid": "49abb066-a3ff-4d9a-a529-4e155497db13", "comment": "Malware payload (Heodo)", "value": "01baf02b710e30605a31e951c712a7d86ee84cec0c75765e216576c2eb5e3c54d95645025e324aa7f557e1c9199a5b44", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647656255, "uuid": "de85b33d-7d99-45b9-98bb-fcf59228ed2a", "value": "T11574E651A5538073CBFB25F2C7F552B76AD59B91C72B452E02A8C03F7A28E437762E20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647656255, "uuid": "581d834d-9c76-4775-adb5-1af37021059a", "value": "6144:U/L5tYtXZ1BpFHyFjJmP/RbV1M2lvMOeL/grxM:UWBpwupxl0OeL/grx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647656255, "uuid": "01b64f81-aaa4-4bbc-a9c2-d8b2962ad561", "value": 359964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647656255, "uuid": "d5f64878-d2b4-4396-ba1d-6a6196ef2f93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647656255, "uuid": "cbca2595-753f-48ce-99f5-0b9b1ef7c340", "value": "emotet_exe_e4_823cf0935c664e10d843f2f3bfe95f9782051ae339bb0abce374177a4a592c15_2022-03-19__021731.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429ffe48-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666356, "uuid": "1ab79411-0c9d-4746-a42c-e60d0269c29b", "comment": "Malware payload (RedLineStealer)", "value": "e04f6cf651fe11131d06392feeebad12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666356, "uuid": "b4b05bec-f91e-497e-912c-ed23c3d30057", "comment": "Malware payload (RedLineStealer)", "value": "827dcd6eeff67fb8fd1322c9eeccc9558713bf83b4353669b3d7cc826cadf2f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666356, "uuid": "1170b39a-9d41-4550-aa25-cdf77ba42f54", "comment": "Malware payload (RedLineStealer)", "value": "9fa7f7ff7aaa0c62940c8cef149db5bed19d59c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666356, "uuid": "c8ed4b48-3ce1-488c-8857-8f9a5c74173f", "comment": "Malware payload (RedLineStealer)", "value": "1291b1580220a5ce1e1d17743578f4b0fabda6ff32e35e0a4f7ff886d9706d2b963a61b3cf0ab6390bdfbe5c2846140f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666356, "uuid": "55c33045-e0cd-4a52-84bb-92c48e3a7a9c", "value": "T12784E1113685D833D152623C8D72C6754A7EBC71EA32E69B7F98072E5F712E2EA31342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666356, "uuid": "51c60050-3cf7-448e-95b6-4e9d6d92375e", "value": "8d72d9e8390e0a6fb409a21cc742651c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666356, "uuid": "1c6bc6bb-1d5b-492c-8b1b-ada852fd8dce", "value": "6144:LC/2d0pg26H/u9U7ZwZuM1BKp4/elj/h60VM:LCumg2o/u9UqZ/Bwlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666356, "uuid": "3236394f-2180-4e0a-a7f6-813a2e4bc04d", "value": 388096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666356, "uuid": "7f1e7185-6810-4888-bcc4-5ddc29a65529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666356, "uuid": "568bcae2-7c91-4ddd-851e-0ad602fdb805", "value": "22817028.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8804a7a-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648596, "uuid": "c521d102-4cf6-4a2e-987a-ec8fbc21fff9", "comment": "Malware payload (Heodo)", "value": "1e23626a7f5989e20934c9365f34df20", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648596, "uuid": "12d2da28-7032-41e7-8e17-f1ad02188389", "comment": "Malware payload (Heodo)", "value": "82cdbc18175c378b1398e7d21c4956ee77cfd33397f9b1e2f57aa878fd160623", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648596, "uuid": "1c86eabe-b7a8-4239-90d0-d537f5f06d80", "comment": "Malware payload (Heodo)", "value": "3d386f4e093041929b5b805a51d8280a4d07e411", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648596, "uuid": "721dea4b-8a30-4933-9e7d-246ebfabe1b9", "comment": "Malware payload (Heodo)", "value": "73a51c769cf9bdf73fca15b5b3b341b8327e0ace7ab2fe1a53a40c40b2e46f26a142fb0699ce6f03d10cb2dd40afa59b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648596, "uuid": "12730a13-b0da-4208-ae6e-38defc23be2c", "value": "T19DC47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648596, "uuid": "95eb8bb7-c628-4c7a-b34b-3a03fca20c37", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648596, "uuid": "c6a3fab8-cafe-4f37-ad12-f4f590603122", "value": "12288:S54yM33d3q3Z7BogmreNmF+U/9JckIAGfUeb:SKh3831Bo0N6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648596, "uuid": "22ff76da-c031-4a6d-b4e9-1d59cd2232aa", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648596, "uuid": "568c04d4-30fa-447b-b884-56b7b2530e2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648596, "uuid": "ab5c52c0-6bc0-43cf-82a6-d048fc6c5943", "value": "emotet_exe_e5_82cdbc18175c378b1398e7d21c4956ee77cfd33397f9b1e2f57aa878fd160623_2022-03-19__000950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b266bf-a7d3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647728937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647728937, "uuid": "f4e2732f-f68d-4caf-ab67-8181d56b9f10", "comment": "Malware payload", "value": "4659444b7bbab080d3234579ad0998b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647728937, "uuid": "8dacd196-3844-4505-b193-f0babc066547", "comment": "Malware payload", "value": "89a9279a31e78ceb036d8be5b2e3c7aeb1021a05cff7bbd5e5025250c911234b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647728937, "uuid": "d17ee528-8208-4d94-82ea-21c9e67b9728", "comment": "Malware payload", "value": "f0744f0825f967180eae995ce733d7b82ccb8db0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647728937, "uuid": "228c0abf-8e23-4b77-abb7-71115a9297a1", "comment": "Malware payload", "value": "7031d52b61777785d143c787e3fed5fd76145fdb4746fb14d5c10328f01d8273043097c1c375fb778a726e8bb9c694f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647728937, "uuid": "a1b262ad-565f-4382-ac13-e7ab74462086", "value": "T14F16B747B8F5A6E4CCA183750D5151D8E970340E27A8B2FB56B153602BB2FE46FB3B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647728937, "uuid": "7e8f9f22-fc13-4b03-b2f1-92993e51fa7f", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647728937, "uuid": "3ff68f65-49e3-47cc-b2a6-727c3aca2ec1", "value": "49152:DLiMsbfdZ+trb/TbvO90dL3BmAFd4A64nsfJABau/oYPqQoCHK+Prsbg11VgYAXP:DLSZ+3BDgWq7ZiluEkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647728937, "uuid": "5d37f4e4-04b2-45a4-b301-b8bfb447d972", "value": 4148736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647728937, "uuid": "576a1673-251d-4d4a-ae0f-76a2c8ef7815", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647728937, "uuid": "6362b89e-e278-4158-8487-62ae0f1c4164", "value": "89a9279a31e78ceb036d8be5b2e3c7aeb1021a05cff7bbd5e5025250c911234b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c39408-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648459, "uuid": "06df8508-dfef-4652-acbd-4912275710d3", "comment": "Malware payload (Heodo)", "value": "ef63464aaa4477dab2f1ed94951669a3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648459, "uuid": "f50ef8b6-f67f-4e45-8d90-49d915b42159", "comment": "Malware payload (Heodo)", "value": "8ae3515e917f5b18997474af86f0a4801931d5f815d4fc367cbace51c167b343", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648459, "uuid": "278545bd-e6c0-436d-8fb7-ebae3abde76d", "comment": "Malware payload (Heodo)", "value": "31b278573fd5e00a134bbb2f6d3f9d3889499cda", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648459, "uuid": "5bf44c2a-59c3-432f-9c4f-4077197d00c2", "comment": "Malware payload (Heodo)", "value": "f95b271f57385b82729b53cf491ddc9ce89eb53eded6489729817b87f321f8e3ad841acba1e6e54ebfe319720b853379", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648459, "uuid": "c73d05ed-8d1b-4659-85a5-f2f25389a283", "value": "T162D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648459, "uuid": "488e5490-ffab-47db-880e-e5620d266a45", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648459, "uuid": "fe4d51de-30e7-4802-b7cf-7d4362062c06", "value": "12288:UWBpwupxl0OeL/grxVGzO+r9AjCb/XKh:Psupxa/gc2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648459, "uuid": "75eb481d-36e5-4fa8-8c61-c88657897a9d", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648459, "uuid": "0c5174fb-20d0-4069-8e10-ac64a4718a7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648459, "uuid": "5e7563b8-e9e3-45a5-bdbe-735ac46b174e", "value": "emotet_exe_e4_8ae3515e917f5b18997474af86f0a4801931d5f815d4fc367cbace51c167b343_2022-03-19__000734.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0acba9f-a726-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647654488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647654488, "uuid": "3a8b4ee1-4870-45ca-b1d8-066fcdec9f9e", "comment": "Malware payload (Heodo)", "value": "76aea9da6e95dcc85baf17cb8b1ba58a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647654488, "uuid": "c1e09c8a-d845-4e62-862a-ed821d8b006f", "comment": "Malware payload (Heodo)", "value": "8b7b4b62e0619eb1efb6c26ec821f303423d2f77272373a47b4b170e4546a6aa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647654488, "uuid": "bb2379cb-e6f9-4601-971c-9c8e2ca512c9", "comment": "Malware payload (Heodo)", "value": "4c3d07837578d2177d6b311eb13a2fe08a218c33", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647654488, "uuid": "27fd73aa-8840-4445-be5d-831f9399eb6f", "comment": "Malware payload (Heodo)", "value": "4f80f97dfc97e0515218c9cb853137df8c3da72119632e2feed0aa09ceee48eb0e1542bb37c7bdd6440bf872735db3a3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647654488, "uuid": "ec06380a-1701-4942-a564-23d472152619", "value": "T16CC4AE11B6D1C07AC1AF02711906D25E73F2FA508BB99B83BFD44F7E7EB41928A34295", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647654488, "uuid": "b4ec15ca-f3d2-4144-9f50-7a07c761a0ec", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647654488, "uuid": "33e0b4b9-4a5b-4c47-8626-a05ebc077826", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPoXvkgKtuJ:WCBAdKV9Xf0kf3KMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647654488, "uuid": "9bad279a-5eb6-4361-ab9b-a31792c65029", "value": 549670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647654488, "uuid": "cb4fefc3-f29a-45cf-aa3d-181173290ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647654488, "uuid": "a6877a67-1d7c-4404-ae42-98efb214b7f2", "value": "emotet_exe_e4_8b7b4b62e0619eb1efb6c26ec821f303423d2f77272373a47b4b170e4546a6aa_2022-03-19__014804.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f0f9c0-a7a4-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1647708612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708612, "uuid": "9e4a2064-0c69-4b3f-9dc8-251190a9cf5a", "comment": "Malware payload (CoinMiner.XMRig)", "value": "d6086d22fec991d902cd78ccd9b661ae", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708612, "uuid": "5744812c-786a-4fbd-beab-bca6e3909b6c", "comment": "Malware payload (CoinMiner.XMRig)", "value": "8bccfaeefd6d38b32e7fd9fc4c2da22ab352a42c483c729b128ea83a7efa9dfe", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708612, "uuid": "26fe51d5-95ad-4c1f-bc33-d8616e41999b", "comment": "Malware payload (CoinMiner.XMRig)", "value": "21b85acbad75a789d40d7f1032b8e1646beddc73", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708612, "uuid": "28e8139f-cc4b-4ae9-8db2-a379332b9661", "comment": "Malware payload (CoinMiner.XMRig)", "value": "86ff65b8d66a0534ba453054738ca36466f607ad216de0777e9276362f75424bf8efdafc41fd0701d9ca8a6e1bd98810", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708612, "uuid": "aaefd4dd-ec30-4ebf-a7ce-34ecfc3312de", "value": "T1EEB6236E624463A8C46EC4348423BD44F5B1342E07B897DB71E7BBC13B5BDB4E52AB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708612, "uuid": "2e27ec89-819c-4916-b7e6-2fee6e37f751", "value": "f41bd45d825b0e2e44373b89f24d3e52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708612, "uuid": "13365357-8560-4e2e-a22b-3f6db43cfb05", "value": "196608:kSAfXEencg2j+LZYizGHERUMhKGpvNnzl8pt18ER8Ve3hve6OtfNavK:Y2g2ilYUGHTmKGpvspj8S8kRW6KNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708612, "uuid": "17ba85bb-f3d1-4ea7-84a0-b828c3cceaa4", "value": 10852864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708612, "uuid": "bb2b431d-9037-4e6f-a4cb-2250b6d21779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708612, "uuid": "2ce2367e-2dae-4665-836e-c712540c3db3", "value": "d6086d22fec991d902cd78ccd9b661ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e3d25f-a7af-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647713424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713424, "uuid": "98c9fafe-c31b-403c-b791-2bc4484ec164", "comment": "Malware payload (Formbook)", "value": "7b4d174a575529a97b30c52e8db704b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713424, "uuid": "8794b65c-7aec-4715-8ff0-595392b77092", "comment": "Malware payload (Formbook)", "value": "8c4f00c6fcb7b6821fc4dfcd80b00bda915c5a0bbe8ced7fed6faf9d1b883e52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713424, "uuid": "2bafc669-c2b6-4def-aeff-d95dafcb125a", "comment": "Malware payload (Formbook)", "value": "0d8e2125ef2aa02cb4dd87feadc85bb6b201af8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713424, "uuid": "8bc0fbc4-79e2-45c7-88a4-1040cc1c666c", "comment": "Malware payload (Formbook)", "value": "09b2a204f6a70896cbc4c3a77f853a2979202f4f7cf296c901ed9da770ff6384ef332960048206d48daa8e9ec6e13c20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713424, "uuid": "fc48241f-24fd-4fa3-bc2b-f045e1e4868c", "value": "T1E225AE8033CCBE28D2B6373F777891D16134BA32F6A596593090515F60AF3A3EE452B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713424, "uuid": "1d02e295-9a01-4bca-b9e6-5d8371915758", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713424, "uuid": "11e57d88-cab8-494d-b91e-0b9a95198fd2", "value": "24576:7waSWMGaAnSnsYVxW2gZxN/ojQ3oIdDb:MYMGXnI3e2gZUjIhd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647713424, "uuid": "29e6a2a2-0bf0-4249-9b1b-9bc6577bf136", "value": 981504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647713424, "uuid": "533f044c-0733-419e-a061-828bb8bfef9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713424, "uuid": "2bb44875-5735-4b4d-8a3d-1daa85e5da54", "value": "7b4d174a575529a97b30c52e8db704b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f163376-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666377, "uuid": "a5395a59-4642-468b-9ee5-f6c34c705950", "comment": "Malware payload (RedLineStealer)", "value": "7474ca359a6f69e5bfe6839221d9a3f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666377, "uuid": "32a218b1-e3de-45fd-8017-6d368dfd2fb0", "comment": "Malware payload (RedLineStealer)", "value": "8c6fe3f6ccabc290b67f2f9827467d821fa319078e44aa142cade32c99919bf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666377, "uuid": "77142945-bbbc-4eb1-b105-7b9310e1e9ea", "comment": "Malware payload (RedLineStealer)", "value": "2fa26b8095cd3cb53ca1ef695b75be729298bbee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666377, "uuid": "2b1dd6e4-0676-49ee-a460-f345834534a6", "comment": "Malware payload (RedLineStealer)", "value": "58ffcc5610df3d66a513269bc4e294aefff4db2221d0a9ca6a2a117c1f6dc999c0ef14e79318d1af0203012f1f065ef8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666377, "uuid": "22d5742c-b6e5-425e-81c3-19fd646dee4b", "value": "T1C816336C3A457A9BE53DAF7336321627B6AB71993A0C74E737CBB0834B9100942E13D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666377, "uuid": "b0314d4e-f22d-4cac-b67e-00ab978b7843", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666377, "uuid": "a283fc20-78b1-4511-a855-9ef40adaed68", "value": "98304:BJc0RfVI/Bz57cKutgcLq//tIpYBdhnb2hzt:rc6I/H7rceHtaO0zt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666377, "uuid": "ff090ac3-f9e4-44b2-9d6b-9dc6d9320fc1", "value": 4146328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666377, "uuid": "b8d5dbb9-c0f6-434d-9a77-399262dd0f63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666377, "uuid": "b7640a57-ea67-434f-be53-b6e48d4057c3", "value": "22954079.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326f86e4-a744-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647667188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667188, "uuid": "958857f5-8d55-4606-8c6d-179049fd3b09", "comment": "Malware payload (RedLineStealer)", "value": "6d1a477609f66763c5caaabcdb2b2973", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667188, "uuid": "273bae07-6c40-4ec5-be84-372df965ff05", "comment": "Malware payload (RedLineStealer)", "value": "8cff110aad7676956e6cd2bdf96d05aa5e3f7bfa10678298b85b0f2e1a05eb60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667188, "uuid": "d49b809d-7c2a-479b-a3f4-70e33e8f56c6", "comment": "Malware payload (RedLineStealer)", "value": "a55df9ed5926b103c4255cb1d201427a1f6a2c23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667188, "uuid": "12e7a229-4aaf-43e8-a432-efdf16eca330", "comment": "Malware payload (RedLineStealer)", "value": "267dbdf10be1063414969a58bb8ed03eb72d19de51961ac6d9f748cd3cde3077ab0ed987dc1fb2e31eb0090ba442be1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667188, "uuid": "ae1f7145-47e5-4103-887f-0892a3de59ca", "value": "T18726336AF48D5C28EE5F9470F0AB627F6C58A04CE5C4D0ABC27723DB96AC581C104BBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667188, "uuid": "3ab9592b-299d-4800-9ab8-0d053117a097", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667188, "uuid": "3bff276b-e0d2-4726-afa9-8040be86de35", "value": "98304:smWpYdSqvspslF91RkxcOmQRC47XsxJvbK:NWpYvNjrqnC47IJv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647667188, "uuid": "3edd8fa4-bf4d-41c0-843a-9ca526ba1413", "value": 4442112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647667188, "uuid": "e15566a1-54c0-4333-b45b-c29e961650f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667188, "uuid": "32d9da5c-8427-4cae-a9e3-8da0bff0bfe0", "value": "29073088.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34dd6449-a7b1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647714007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714007, "uuid": "45bf6864-54cc-41b5-a034-5b24b5d6941e", "comment": "Malware payload (Mirai)", "value": "da5a024e03cac36fd97a66c5082e7434", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714007, "uuid": "f54700b9-1bf7-46bd-8b68-c9d4f4e4e666", "comment": "Malware payload (Mirai)", "value": "8d1521e4e871cd8ac336543b5fcc106837927fd49abe8be7bfe2df6af0ddff24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714007, "uuid": "6511414d-9535-4e53-8765-5cb41bcf1601", "comment": "Malware payload (Mirai)", "value": "9ef08f14af3341e99a36c76c24418759567dbb1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714007, "uuid": "903e1520-413d-4a34-ab96-79e42402a0f4", "comment": "Malware payload (Mirai)", "value": "e982b7684eb885c830e2914e1a497217b93e1f0d7b4ba1e959d332f189fde6b1aeb9161132757703c41ff36385e78ba7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647714007, "uuid": "05c328a1-51ab-4674-9dc3-83dbdf3703c3", "value": "T1C4B31877A4654F73C045A5F125BA9A310F12AD931B1F1A88763CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647714007, "uuid": "94b7ec50-76a7-4f76-b9d5-5fba903648c6", "value": "3072:MDVLSItJP+Xsp4JlN3HKjmH1cuEgvniuN/:MDV+ItJH2l3HKjmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647714007, "uuid": "5192625d-669f-4906-992a-2ecc55831ff4", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647714007, "uuid": "e72fa0cc-a132-46a2-a1b8-bf783812499c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647714007, "uuid": "d457e2e4-faef-4fda-8dc4-5f207f1daa3b", "value": "da5a024e03cac36fd97a66c5082e7434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969ba9ba-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648458, "uuid": "2979effe-ed1e-4dd6-bbca-eb7d84dd4d00", "comment": "Malware payload (Heodo)", "value": "a8868c24faa000ee646c0d400da6354e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648458, "uuid": "ca6acc1b-3b7b-4c74-a55a-92c1623047da", "comment": "Malware payload (Heodo)", "value": "8d365001ae7c7df68809999574f0e08f76ba995a4d815e4cc7ff4262d878d04f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648458, "uuid": "b842b5c3-36db-4eab-8476-d3012476d082", "comment": "Malware payload (Heodo)", "value": "c4ef8f4ae8ea8a93c795ed52669bd3d40d25cb60", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648458, "uuid": "91d4c308-93cc-4bdd-9cd5-e1e57e48cfb6", "comment": "Malware payload (Heodo)", "value": "0f8771a7f83430cf469913d7630dd5b8e685914f9d3914c1bfb1d32426e900b5891290775fd350f9dacc338ef1f35e25", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648458, "uuid": "23b04ff4-a298-49e6-b1e3-dd20f7907430", "value": "T164D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648458, "uuid": "b257db5b-e88c-4dad-bd44-d9a19aa22d37", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648458, "uuid": "83ea9867-52bc-47f5-9ecc-69930be20ff8", "value": "12288:UWBpwupxl0OeL/grxpGzO+r9AjCb/XKh:Psupxa/gI2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648458, "uuid": "626981f0-702a-4fae-b455-c82994e81c10", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648458, "uuid": "c836e2e6-2804-495d-9d11-4d721bdd2d3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648458, "uuid": "fa4460a2-58fb-4258-a534-c65704ba7491", "value": "emotet_exe_e4_8d365001ae7c7df68809999574f0e08f76ba995a4d815e4cc7ff4262d878d04f_2022-03-19__000732.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34bc8722-a743-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666763, "uuid": "de1d9fd9-9dc9-4c59-a051-36ad8ae11d9b", "comment": "Malware payload (RedLineStealer)", "value": "dedd7bdc4e3f856b4ff869169ea6c88a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666763, "uuid": "a5b0a869-7b4c-4a83-ab82-105c74640f30", "comment": "Malware payload (RedLineStealer)", "value": "8f23121219c33d3cc2f33575db9c3f30943ae87eb9c011ea5d2712c4529ef33a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666763, "uuid": "1c117f51-8509-4b02-bddc-7dc6a7507130", "comment": "Malware payload (RedLineStealer)", "value": "a04a13bfa0bf1c5268dbac735709fc29ed6c4739", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666763, "uuid": "73a21d12-081e-4872-9e93-3a5bcbd11cad", "comment": "Malware payload (RedLineStealer)", "value": "31c4cdc4ab4c5197686a6c31a61b1339932fb9e4a1b9d992aa5833c54607006cd89734480f5a54189fd3e6bb3e8f15a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666763, "uuid": "beaffde7-6418-4043-82e8-89b4234cc193", "value": "T18424BF2175C1C1B3C4B7147444E6CA399A7930710BBA92D7B7DC2BBA6F113D1A3362CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666763, "uuid": "1b38ba2a-f7f6-42fd-8e71-79a58f00bc2b", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666763, "uuid": "8fe64c19-0e35-4cde-9389-32f8bbcea996", "value": "6144:wDKW1Lgbdl0TBBvjc/f07SWsxWaTTf3HU/:Wh1Lk70TnvjchDfHU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666763, "uuid": "9d6d6072-4a43-4f47-9314-fa2e31799345", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666763, "uuid": "5efafff6-860e-443d-a314-0962a4a6c82d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666763, "uuid": "ae5a6046-b0ad-4115-a217-b989c038ad02", "value": "26682355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae397bb2-a7b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647716359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716359, "uuid": "4c6139d9-71d9-4354-9164-6888d0cec691", "comment": "Malware payload", "value": "f821289cf064347edfba0e74392d75de", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716359, "uuid": "e7751ed5-9ccf-4d0f-82c6-d95503fb52dc", "comment": "Malware payload", "value": "8f3c56c9b12a251d0d5b005e55707c90db928f06e00c0184a94e235e0006370c", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716359, "uuid": "ce20611a-62be-4866-bb1f-d1823c852ef9", "comment": "Malware payload", "value": "d777230c86f529dc74b0b1d91812b81f7766a280", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716359, "uuid": "cce6d692-0a57-40b5-a72d-9034f01937f5", "comment": "Malware payload", "value": "c7f01fff905f078f737434b79a1e196ab7db0bd34184a941d1fb14f3955486f4606a8e7885e7404b224c1bd704c05491", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716359, "uuid": "05b1d054-0e7b-4644-a9c8-1faaa470636c", "value": "T1C1B423C2D52DA363BD77DECB4DCEE90441B9B06F2370861006C20BE6CF561DE6A0966B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716359, "uuid": "7ac62762-4b4e-4b17-9a57-c0587cc23b96", "value": "12288:7G0LOjifDeHSMGaMliUZUoX7o+GZ6RESIErdDKKd:7G0mMCy1li25Ri6dGKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647716359, "uuid": "794afbc7-083b-4980-8049-7982d6e1775e", "value": 496294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647716359, "uuid": "57058fa9-5bee-4a57-9802-820813f60046", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716359, "uuid": "b5774d75-ff3f-44c8-937c-98b16250e533", "value": "20220317143046766.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e6e265-a7a5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647708909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708909, "uuid": "8a9676d7-bd6b-461d-a6e5-2d61397e9825", "comment": "Malware payload (Formbook)", "value": "3596db61e6777bd7eb8c25e106f3fe7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708909, "uuid": "c3703a37-03d3-40f5-83e0-93d4febed622", "comment": "Malware payload (Formbook)", "value": "8f6c3613cdccfdb0d7fd02b33e0afc8c13c640d305b2fdc3319135a18e3ca73c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708909, "uuid": "72fef4cd-f75b-4232-b412-ad7c2ce2b575", "comment": "Malware payload (Formbook)", "value": "36c3d6319228770511a9ed80b9e2c17365cef7b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708909, "uuid": "d9f2a959-6445-43c9-82af-9ec0b4e5bcae", "comment": "Malware payload (Formbook)", "value": "9c1135b84e558db72dde878d87cf608be61690723c566f5ce6cf7575d99121782aa8946773f6960ffe20d4f8894a1859", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708909, "uuid": "99a18e83-c4d0-40be-ac94-1c4cc717497f", "value": "T17005BFA2F6D04973C11F1739982756B8992A7E103E68DD466BF57C0E2FF83927C26183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708909, "uuid": "342b8071-9aba-4f70-835d-09ca7542bb5f", "value": "b206566e7da331ee048d7690553b17ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708909, "uuid": "e933d9a7-444f-445b-9036-1b75fbb54073", "value": "24576:OpxxqeYu2ABLCIfgwNlb93ZZpQwzOJDnVinUHCP9iWvj:IKgbYsZZpQwzOpVinUiP9is", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708909, "uuid": "61e9585b-2532-436f-9ced-8a5d82762f26", "value": 874496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708909, "uuid": "d711cf37-8b35-4f42-b28a-2aefd7b9f5f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708909, "uuid": "97dabe5f-6f39-4382-977f-d7de8ad8e8ae", "value": "Proof-Of -Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb8a2f2-a751-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647672975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647672975, "uuid": "088e8d2c-1ee2-415e-93fb-12472dd27faa", "comment": "Malware payload (NanoCore)", "value": "c9cc7cd25b422cbb03d395d66a2f3efc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647672975, "uuid": "bbb6f956-9a7f-41cb-8cda-e90b3863843f", "comment": "Malware payload (NanoCore)", "value": "90cf8cdc99b4983083ea82c3c0841b76d3139172888d22a63406e5a56fc06e16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647672975, "uuid": "9a30cef7-3cfe-4659-b8b6-b487a547fd40", "comment": "Malware payload (NanoCore)", "value": "df452b85a2104b181761644eb88bf44bbd16eff1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647672975, "uuid": "e3a2e5a5-8d5a-41f1-9c89-3dd133b6c1da", "comment": "Malware payload (NanoCore)", "value": "ed312ce5b4e1b280be6a0d32bbb44083e4cf2d0ccccf09db557e9aeb89e4a17e5000637febc2f05412f5e31f0ed8d8d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647672975, "uuid": "c88bd9ee-32c5-4f1e-96f4-e4983c40c6be", "value": "T1B005CE1024AF66CEF0768BFE5DD8A9B18BBAF43A3519F1BA18811EC70741B41DD11A73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647672975, "uuid": "4932654e-82d8-4d1e-9b47-f967b59b4b64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647672975, "uuid": "57c846dc-bc6e-422e-8c26-1db323a9cbd8", "value": "12288:kx8cEJgYYz0fuHt3eMOhqVqaXti4RrCKIB4it7o/tepmBvVeqL4Ku7pilkJ940iJ:Q9+uN+cVCSCU6o/gpmBvVeVKu7SkJar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647672975, "uuid": "839beea8-9c75-4898-8675-a785bef33a70", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647672975, "uuid": "5196851b-708f-4ef1-9457-7952930356be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647672975, "uuid": "b66774e3-625a-41df-921c-58276b00a532", "value": "c9cc7cd25b422cbb03d395d66a2f3efc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4f5f53-a729-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647655879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655879, "uuid": "03898c7d-588d-49c7-a6d0-50b9ce368c32", "comment": "Malware payload (Heodo)", "value": "e59935832486bf2d1c15d0b72e76c2d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655879, "uuid": "74ba3be3-cb29-44f2-b917-f844b7e9d46d", "comment": "Malware payload (Heodo)", "value": "920a6c6aeaf083ede556af3b79cabccbe70ca0422ac151a832c3bc55c561749b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655879, "uuid": "f7857691-9c80-415f-810d-02e9284675e4", "comment": "Malware payload (Heodo)", "value": "8f376025dfa90d9ac47eacac7bdaad21501a6751", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655879, "uuid": "c32fdd45-ed1e-4571-af8b-ac2904c0764b", "comment": "Malware payload (Heodo)", "value": "2e36f909356eb7a6d3c15d64e4fe4584f5b658aa15ec5218fba18339f067144eed10555711bee6eaa78c1382ace38f87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655879, "uuid": "c5a07f8f-1d59-48c7-8104-5549aa0fde70", "value": "T182D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655879, "uuid": "eecf62c8-e0b0-497a-a4bc-73a0bb76416f", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655879, "uuid": "ea2414d4-dd0c-4c91-8d21-5963642f942d", "value": "12288:UWBpwupxl0OeL/grxgGzO+r9AjCb/XKh:Psupxa/gv2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647655879, "uuid": "430581c3-e3e3-4fa6-9bee-e3975f48233f", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647655879, "uuid": "f0d31656-835f-4e1a-8c68-ff9758188406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655879, "uuid": "e0953efc-01e7-499e-82a9-518196269134", "value": "e59935832486bf2d1c15d0b72e76c2d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ae9524-a7b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647716405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716405, "uuid": "fe4bcd4a-4780-4523-8f6d-606bb8904d75", "comment": "Malware payload", "value": "93da50aea11129ff8364dab8c17ad04b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716405, "uuid": "b504d88b-e8a1-4e3f-bfd3-4cc2344f1dce", "comment": "Malware payload", "value": "930cf0d3282d1c9cf19a57b5253f7c7a2718a491720dad6f57d9fcee14301c8f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716405, "uuid": "84048f0f-ede9-456c-ac7b-a4a2d650409d", "comment": "Malware payload", "value": "9a635b7d7b826a4441a16552a771b0a7347c5243", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716405, "uuid": "c0de4644-dc7b-4a89-9429-06c6f4f2a2e7", "comment": "Malware payload", "value": "372bb25420cf593caf33ca4322e2ef7c72324024abe0c4a412e5495b0e92356213fab7d19f652568a3736405e79f18c7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716405, "uuid": "54460aa2-7251-4388-befa-bf454f36373a", "value": "T11952B55BD48184FCC89DC2F41196B979813B743B1AA6B34523D8F6379E9B91B0E28847", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716405, "uuid": "47d18013-73c3-48d4-bc9d-5c05aaaf2bb3", "value": "384:P30Z1F9ulAltg6B1mUkg/vdXRzVL04aHeYTRf:P30ZtJlTzVo4aHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647716405, "uuid": "42dee2ff-309c-457e-9a3a-bf7a4c49306d", "value": 14216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647716405, "uuid": "f73e54ec-62ae-4236-a804-9cd4de1ae44a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716405, "uuid": "6387153c-e20e-4517-97a8-3c21afa88afe", "value": "Y29kZWluZQ.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da5ef11-a7c2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647721350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647721350, "uuid": "741aeb5f-1fdf-43a3-a4d2-6659d8a69cef", "comment": "Malware payload", "value": "ea23148d45cf68fece64c0a03a1d0f1b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647721350, "uuid": "955f756f-c95a-4c3f-b4f4-cbb34cc1d33a", "comment": "Malware payload", "value": "930d29987fab32411d1a71989778dd77270fc1c6a41911895c1839bc31a8cf42", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647721350, "uuid": "c766ba40-7be5-43eb-9342-5024db7bfa4b", "comment": "Malware payload", "value": "a74465b3683af2db22ca1bc6574c51faa23881a5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647721350, "uuid": "43de7165-f6af-495a-bf66-42b7a68aa4ed", "comment": "Malware payload", "value": "d2b559054333b4918e621dc6df2d0ab975153a7edb538b5a3b063f67bd7629aa0cb52622537c9789509c0cd0f9025caa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647721350, "uuid": "ce367c50-be30-45a8-84d0-4a88891a9ec0", "value": "T14A212FC61299067BEDA6EAD73679840E79C0E0961CD6AF046ADC34EA40CCD18385D7C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647721350, "uuid": "72521b8d-7343-4019-905a-0211aeb34552", "value": "24:1K+KzaCUdZKWKfCRQvUK2mLA53KyKuKgNIn:1K+KzaCUdZKWKtUKk3KyKuKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647721350, "uuid": "ea7445de-6f43-4e6b-af2a-b01fd0529b95", "value": 1219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647721350, "uuid": "5600e62d-d861-41c6-80dc-3d59976edf06", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647721350, "uuid": "a5ad163b-782f-4bb6-b333-d9c9e245ecbc", "value": "snype.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a23e70-a7b5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647715804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715804, "uuid": "7f4513e1-cb78-4336-879b-60bc7e570c04", "comment": "Malware payload", "value": "6352cdb6f19ef2380a069de03054edd4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715804, "uuid": "7c46fbbf-ab79-4012-956c-dcf5d9214220", "comment": "Malware payload", "value": "936917506c5f05281bc045e8542246836f99710ba98a7c0fd9b611b52acce01b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715804, "uuid": "d2bef05c-7c6d-4df6-ac18-86557c6fae16", "comment": "Malware payload", "value": "e216598afacae6bf6581308b2c0fac1d38d05625", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715804, "uuid": "b60b88f8-25ac-4e1c-8b25-078571dda725", "comment": "Malware payload", "value": "020c5c96db62362519e2021e5e2d5573d8293b28b1387388cc42b04b937f1987519c2acbc31219eab491dba6901bd857", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715804, "uuid": "043474aa-52b3-4bef-aef7-693a7ab6461f", "value": "T11953A4496F21AFEDF218833487B71B35D79822D166E0D6C8D29CF5051E6031DA4AFBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715804, "uuid": "18070983-89ff-484d-a50b-4564543ba386", "value": "1536:CNIRncXsj3ih9yZ3jd3jj6jQkn6W9ta2xmEiLS9c8lUAtu/EengW:CC5uhN6W9HmEiLSK8lUAt2EygW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647715804, "uuid": "318311be-1650-490c-a876-448e95275fe3", "value": 64956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647715804, "uuid": "5ae33038-e42a-4d5e-81ed-8e574becb06e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715804, "uuid": "f849dd0f-6b71-40b1-b1cb-bd666c3d4561", "value": "mips-20220319-1850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca6f49df-a766-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647682046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647682046, "uuid": "6f0912f2-f322-4b96-97a2-bba12a2aa78f", "comment": "Malware payload (Heodo)", "value": "5c85472601ed162217c9a0dfce689b6a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647682046, "uuid": "be5c1118-26ff-4d6d-bb9a-28b63bc04d6b", "comment": "Malware payload (Heodo)", "value": "93b856ce171764abceb0f5ab477482215a65f7bfe108936d6a7345c0de80b39f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647682046, "uuid": "32fe4296-986e-413a-b462-129b50442674", "comment": "Malware payload (Heodo)", "value": "5d378da749f46cf49d396315ca700cc7e61af30b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647682046, "uuid": "6fed2cbe-d38a-4098-b4a4-d679d7ef3ed8", "comment": "Malware payload (Heodo)", "value": "8de9bda68d88da53d619f1ca3786f2fe8f199a9db4076de4e371f9b68a3fd471070de60f2d3c3d7b947669a16ffdaa33", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647682046, "uuid": "c6f2d18d-ebe3-4562-b10a-f8b5ba94c9c2", "value": "T181E45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339977A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647682046, "uuid": "cb5929b0-5b3e-482c-bb7c-c027a13bf1db", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647682046, "uuid": "2858772e-3323-446a-8ee7-7b72ad9df28f", "value": "12288:jc899XKPmN4WMkoV6ZPJSFTdtXlcIL9v6O8:7GP72gFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647682046, "uuid": "0cdabaea-8cbf-49cc-9e20-f6bdf682a0a2", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647682046, "uuid": "6cc7294c-6b03-4b35-a477-ee72236f072b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647682046, "uuid": "93efcd47-294c-4d2c-a8c7-76d0e18a8bb1", "value": "emotet_exe_e4_93b856ce171764abceb0f5ab477482215a65f7bfe108936d6a7345c0de80b39f_2022-03-19__092721.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "258d4980-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666308, "uuid": "7247e68a-9add-4a24-86ba-abf7f43055ab", "comment": "Malware payload (RedLineStealer)", "value": "2f3e6024b45a6c2d4678b2e40d7fbf0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666308, "uuid": "8e59f330-350d-471f-a420-4a67be7c832b", "comment": "Malware payload (RedLineStealer)", "value": "961aec659e2ddc95e3d1fd34fbeb1de7537e63d49715abf4120a17bd25d37259", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666308, "uuid": "c712e8de-c85d-4530-bf26-c7f757ee398a", "comment": "Malware payload (RedLineStealer)", "value": "844b0588ce0fd863520b3f07398d513c734f3e7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666308, "uuid": "eee2b652-b51c-414e-85dc-090cb29fa0c1", "comment": "Malware payload (RedLineStealer)", "value": "ee1c3531b879299738dbde276b56460190cca4d8ab5ecc3921ddd0946560f6821fb83f944358f8b12a4a576642272bde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666308, "uuid": "29c0a6f2-d28a-48b6-8576-7941f221b8eb", "value": "T15116333620C0B87BD3E24D7CA3093BF2399753A92AC595B69FE193FA4E122F51810577", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666308, "uuid": "09d907ba-b229-4b70-8fe0-6bc870650a6e", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666308, "uuid": "e1e58439-3aca-4d95-b296-2199765e17d0", "value": "98304:SCmEWsF5fVyS9XrQ78T5XVKD7sJeo2/a0LOeekCIj:MTuZVycXrQ72cscof0LTIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666308, "uuid": "54af3f17-9f78-41a0-8784-0fedf71c1de2", "value": 4120216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666308, "uuid": "c7871663-071d-4443-9408-1b407094c164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666308, "uuid": "50b2d123-dd62-4327-81a6-8be0d978bdd0", "value": "22367949.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0687b851-a7b1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647713930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713930, "uuid": "b2f3df84-0316-4887-8378-09040477d5ac", "comment": "Malware payload", "value": "007a07d4f3510d4497b914a83915528c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713930, "uuid": "0df2c367-fdb5-48d2-8e14-8f266cc1b189", "comment": "Malware payload", "value": "967b19617b05154cfdf34b5548ae62838223f91f30807fd2aeeba9948e22bc9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713930, "uuid": "83c5fadf-5434-4bc0-8b90-58a49eb4b3fb", "comment": "Malware payload", "value": "fbc97948263effc53b2d45dec4c677df96bde469", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713930, "uuid": "5f8cd5f5-44c2-4262-85d1-c2da7dd54c7d", "comment": "Malware payload", "value": "9d98f04d50cfffd9d55a988e1c4f3783c2edf5b7f39615c7282a2af8ec89db5978b7984b2b6db3049ee70a1371fbd2c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713930, "uuid": "1ea563b2-402c-42a1-a116-db741ffe597c", "value": "T1E3630201AF25ED46DF000C6336CD9B9D8E79AB4E4AAFF07558D1988F53E11CAAC53300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713930, "uuid": "e098910f-93d9-4faf-80f1-3a316d0d6c8e", "value": "1536:pxpJNlEYvXndUt/afLuZmVelu9eoCtcCCzNbC4RWC0J:phNlHuBafLeBtfCzp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647713930, "uuid": "5ddf4430-748b-466e-9f31-17b8bf108d8a", "value": 71400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647713930, "uuid": "bb30cb83-bad8-4717-832d-a454f3fa4b6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713930, "uuid": "a4acd305-921e-499c-a724-80d8f4c56a7d", "value": "SecuriteInfo.com.Linux.Siggen.4218.223.22821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b91a7d4-a720-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647651688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647651688, "uuid": "831c806a-ab87-4ac4-b516-5591504e0585", "comment": "Malware payload (RaccoonStealer)", "value": "c610a36e4a0c83a477ed35bcaaa0a29c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647651688, "uuid": "36a78679-3100-41b6-b12a-beb886bda151", "comment": "Malware payload (RaccoonStealer)", "value": "97003b8337aa2cf6a18e8c252afb1d57938091541fdf54a549fa3ab3c3832c3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647651688, "uuid": "155a8164-7b5f-4efa-97f9-540b9de5ce32", "comment": "Malware payload (RaccoonStealer)", "value": "e8e364fbb3c76304b461dd7b5efcc1749463aecd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647651688, "uuid": "1935adfe-0a0c-4a28-a52b-9aa1cd3ddcdc", "comment": "Malware payload (RaccoonStealer)", "value": "596507bfdd98cb7d4011e9472e661fbe3c2bae4073dd7901253784541cbc4b656c4f6753a55f9682af0b801d59c1f27b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647651688, "uuid": "61d2fafa-38a1-4d71-8f96-ae478b986aa1", "value": "T19086DF32A620C879ABE38935D13B785E39F14575C2CF746737D91CC08A5BCBDCA86A42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647651688, "uuid": "684dd887-95da-49b9-85b4-32b4737b21b4", "value": "8d9385e915ba457c4cd1015b2fd5405a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647651688, "uuid": "b3512b82-69eb-44c7-94ed-9cc8d7e4949a", "value": "196608:TvGurSI+skG95SOW0kfOsS4r6kNiERxf4vw5lG9jYiQ:TvGurSIXoOW0kGW8EjfGrdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647651688, "uuid": "b350300d-52e8-44fd-a216-a95d59014b21", "value": 8494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647651688, "uuid": "1bb711b0-c521-4245-8941-0b085b2c2f2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647651688, "uuid": "6b71a66d-f578-49e8-94ba-42275850007b", "value": "c610a36e4a0c83a477ed35bcaaa0a29c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a04079b-a7b3-11ec-9275-42010a9c0029", "comment": "Malware payload (Pony)", "timestamp": 1647714956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714956, "uuid": "93d4db50-f0e9-490c-826d-27d15cb9e015", "comment": "Malware payload (Pony)", "value": "5a55e6c092cf553188e2f6d8beefe93f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714956, "uuid": "2a26a386-d5d0-4b6b-89b8-28f476316b7a", "comment": "Malware payload (Pony)", "value": "971443aa3efcab7657935b3346d329d957612209f634bbda0203376dddf15512", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714956, "uuid": "910ca6b8-d25c-432d-acf1-cd979777e01f", "comment": "Malware payload (Pony)", "value": "e273a97c430dff0097d37417c302f46fc6a85027", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714956, "uuid": "9cb75ff6-e777-4dd8-9d2f-8c269f2b197c", "comment": "Malware payload (Pony)", "value": "17a7e36c8673be53cb559d4d2893136c56ccfc21319e4f626564c6dc09432742c682779d4e344ee897a1e00f1d6a71a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647714956, "uuid": "4e9a1f18-c106-4237-84c4-43c29fc48859", "value": "T1C734F162769160F0F0568E30F632DE95ABD7FD29C2429AA1FCD46016DC3CA41DCB97B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647714956, "uuid": "a6449061-419f-4235-ad7e-e985a5032fe5", "value": "68b91263b3f01d5dd26d1803ca3f807c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647714956, "uuid": "37545efa-813a-48a7-9f9c-2869362911f5", "value": "6144:kzXI+ABsxXZ9IF2hCXJ81LUSdKy0eC9o:aXlCF959", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647714956, "uuid": "4437f73a-f715-424a-94b7-a23e742a1f3b", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647714956, "uuid": "3712cd3b-b11c-4835-a033-0c8e8a9eeb4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647714956, "uuid": "75d10dc4-3694-4181-b5fd-128f7e7690fa", "value": "971443AA3EFCAB7657935B3346D329D957612209F634B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af44b9ca-a76e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647685437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647685437, "uuid": "1790849c-e499-4dcc-a7a9-7b9f8567e9d6", "comment": "Malware payload (Heodo)", "value": "a98825a52a0f8bad8e5a96b0806d2eaf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647685437, "uuid": "d15e62ea-1dda-4e8b-be89-58bfc1085860", "comment": "Malware payload (Heodo)", "value": "978fccfcb710d02d60052a94f108f4af0e121df2dbeca76b7bad219a35de69cd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647685437, "uuid": "8cda075b-b26a-4af7-908f-86f369581a3c", "comment": "Malware payload (Heodo)", "value": "193051c153ec6d9e5cf63080127fe47053fb7929", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647685437, "uuid": "9ef97e76-af3d-4088-a1fb-f67db82d79ca", "comment": "Malware payload (Heodo)", "value": "c72e75aca0c3ca82a97ec5c3be2e5e319b8502a4024325fc3331d02b8b041ab7515a22379a57d35cc7d8c6a10a8181c1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647685437, "uuid": "71fe819f-e4f5-4439-a1d1-2126847f52fd", "value": "T12DE46A22AF5740F4D89F0C3945513288AD95FF46EBA8B77ADA39728D35B20534E3884F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647685437, "uuid": "0d0d634a-b670-4fae-85d3-4d54005a2f09", "value": "b39d2fd2d18c2cfe493a1e089561b46e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647685437, "uuid": "af288c43-0771-4b4e-8ba3-34af894c107a", "value": "12288:aX5mvP53RTqtl79F+Unrymfxbm1nB0hoxxUI/:Ac53RTk5Jxi1B0hGxUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647685437, "uuid": "298a4aac-9832-42c1-a6d8-49efc4570b8a", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647685437, "uuid": "50ecb757-783e-47f9-971f-de4f77a95fb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647685437, "uuid": "25f7593d-7104-4d09-a430-f4e01aec7746", "value": "emotet_exe_e4_978fccfcb710d02d60052a94f108f4af0e121df2dbeca76b7bad219a35de69cd_2022-03-19__102351.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484184e5-a7a4-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1647708457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708457, "uuid": "69af985d-c1e2-4361-b6b4-d6e5d55c1a68", "comment": "Malware payload (Smoke Loader)", "value": "871c9bb340aeecf6e1fc58cb6c92f118", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708457, "uuid": "38e769d8-5000-4df3-bfe5-f077c17803b8", "comment": "Malware payload (Smoke Loader)", "value": "97c090248e9c4bff5f867844b21d5637b176eabc32d6ef6013b5dd23e76d8081", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708457, "uuid": "26b4445c-4b63-4714-87f2-7374cb1ba7ce", "comment": "Malware payload (Smoke Loader)", "value": "4f1a3ef0a2c1d035c4c507b1eb7a5f8503e1d3e4", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708457, "uuid": "0fef1e61-1f0e-4c30-9875-618ec35143bf", "comment": "Malware payload (Smoke Loader)", "value": "01e63911458f5842a3986ee978cdb1e4cd5687c9e1a1426307766c0724c71aebe1b851d9d8900a10d05ab7bf3b78e2a7", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708457, "uuid": "ee26437d-9b56-4efe-a2d2-2b356579ee00", "value": "T16D34C0213791C832C49295707929C6B1EB7FB43266B0C5777B950B3D6E313D2ABB6306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708457, "uuid": "4d670471-8485-4516-ac94-f31fffab0844", "value": "9cdfd67576839b3ef23c2c4c35e8861a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708457, "uuid": "825ea0f4-8898-49cb-ba8b-219ef4a1a955", "value": "3072:WKjJZSrpfw99wjo4tsMJcNB5O6rfsLs32B:RFZSrpfwAo4tsiqksG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708457, "uuid": "4accf901-d0b6-41d9-9192-657cdf84e667", "value": 243200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708457, "uuid": "109cad6e-9821-41f5-9cef-1be0defc7f33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708457, "uuid": "d582a597-d148-4eb0-943f-6ba87f6df765", "value": "871c9bb340aeecf6e1fc58cb6c92f118.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfca9285-a75d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647678163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647678163, "uuid": "3f9dec76-5fc5-481e-bb0b-4da6467161c7", "comment": "Malware payload (Heodo)", "value": "9d7b1e58fc4321cb1eb826dce5a849d1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647678163, "uuid": "affa7a93-f6cb-4902-ac7a-b47f5f3bdff6", "comment": "Malware payload (Heodo)", "value": "9874c5e49a99baa1ec325b802c0f2854cce381a7c4d2086220ea1f6fd27878a7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647678163, "uuid": "ad120d51-0565-4c8a-bc0d-ba12d8010e40", "comment": "Malware payload (Heodo)", "value": "79f1f4859c4f6507fd019f2251f296516bf694c3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647678163, "uuid": "a908b368-c4f6-41fc-b22f-6f4e1c5eefe5", "comment": "Malware payload (Heodo)", "value": "d4425323d7afa9f7c1b0a62af8f708327452bbe603c5329c40ec1790536c30dab4c900493e7d4b28b40594fe76a480c9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647678163, "uuid": "2a0b2184-7114-40af-863b-10ec3dd2219d", "value": "T1EF84190173C390F0C657A574840FD525ACB7B87C6B18857EB28BA26F4BE78D09A346F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647678163, "uuid": "770fdd1f-b732-47ab-a255-fc2533709a64", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647678163, "uuid": "a294fb89-3220-47f0-9c98-ddbceaf45bdb", "value": "6144:S5uok8qcKhyMlSXVKfKGS4Tp3wb8iZ7B1yarh97ArkqBW:S54yM33d3q3Z7BogSrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647678163, "uuid": "30d2e4a9-8f1e-40c4-9363-8d454373f1b8", "value": 396189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647678163, "uuid": "4d51cbb5-bec5-4e34-afd7-c58595bec564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647678163, "uuid": "5ea2d8f4-425f-43cc-9d32-661eb14f30f0", "value": "emotet_exe_e5_9874c5e49a99baa1ec325b802c0f2854cce381a7c4d2086220ea1f6fd27878a7_2022-03-19__082239.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a30486f-a71e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647650880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650880, "uuid": "48a33a90-9184-41b8-b4e4-468baca667b5", "comment": "Malware payload (Heodo)", "value": "29ac94faddbb56be3aea4b622fb7ae8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650880, "uuid": "1e4de882-ccaa-4408-9e58-3d39a85087e5", "comment": "Malware payload (Heodo)", "value": "99e7fd5b250c07b980ffc369dd3df6849309b3114aef06ed0f99a93e8dbc57c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650880, "uuid": "b5db665f-ce8b-40a7-b102-6e9ec1a85ea4", "comment": "Malware payload (Heodo)", "value": "cbacca0ce88236aee6779151460666e420eb3ee9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650880, "uuid": "0b9e5d37-3802-4991-aae3-be17de273818", "comment": "Malware payload (Heodo)", "value": "eb8461396a7f5d173837ca4650ac0e8d3cd36f52d6cb324772093959572b5040900c982e2d302c39d4d227fcfd3163b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650880, "uuid": "818b7d37-f6bd-4710-830f-2ebe42be69e6", "value": "T125D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650880, "uuid": "eb52e28a-ee78-4104-a3bb-d102bd89e926", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650880, "uuid": "3493ec92-f9d5-4a3e-a487-02d39271d5cd", "value": "12288:UWBpwupxl0OeL/grxZGzO+r9AjCb/XKh:Psupxa/gE2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647650880, "uuid": "389ab4ae-a70f-4465-86cf-0329411aa0fb", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647650880, "uuid": "b0910b14-a3c6-4f8b-8527-3f9973d2155b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650880, "uuid": "bc4969e2-4068-448f-b3c2-f82c6f853940", "value": "29ac94faddbb56be3aea4b622fb7ae8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d99efb-a7af-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647713392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713392, "uuid": "313ebce4-eee5-4a05-8123-a296c082ef5d", "comment": "Malware payload (Mirai)", "value": "3ca6156f515c87e5355277887e5af20e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713392, "uuid": "9f82357f-085a-459b-9def-dd2c19d3d3f2", "comment": "Malware payload (Mirai)", "value": "9a31bb1f2f945e4e0d5f5bc29fc3b5e9477e57d53073fed68b2544d12c831c8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713392, "uuid": "79367748-e4cf-4574-880e-7e2a7dc523b1", "comment": "Malware payload (Mirai)", "value": "1ee3025ef67610afaa2be32e43684951b875936d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713392, "uuid": "b17469d5-b126-4d2c-b30b-d0be0480a122", "comment": "Malware payload (Mirai)", "value": "56d31ffd4610151bb10677857426642f49769374691ef891d788f511d64085ac00e97625ff02ffd05e8209ce38d7e5dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713392, "uuid": "0aab7eb8-9ca7-4b61-9816-9df1dee114aa", "value": "T1B1C3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713392, "uuid": "6178ef01-5bc8-4e6d-8f4a-7e2535136e8f", "value": "3072:4jDy/+mh1vtbPIKaEbpcUPium7/L7QsvmGfIiNb:mOJ1vxfaEbywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647713392, "uuid": "92945338-e4d9-4a5c-a46a-812431540ecd", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647713392, "uuid": "969f9c75-7c0c-47dd-9060-c584c671ed3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713392, "uuid": "dfa4a8d7-cbc3-4167-898f-0c6a3d8e154d", "value": "3ca6156f515c87e5355277887e5af20e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0eb9696-a7b7-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1647716766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716766, "uuid": "0ee98a2f-8f9e-40d9-8953-6160d3640d72", "comment": "Malware payload (Vjw0rm)", "value": "85ed4ca41df72e39d732b34c1dfbc3c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716766, "uuid": "9ac8f383-fecf-4c99-a0eb-d89288938597", "comment": "Malware payload (Vjw0rm)", "value": "9bc179211df1495b972c87dc90029973085cca4fea0c26630f33d5dea2a9137f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716766, "uuid": "2b1ab028-af2f-48f1-87f9-44722ce45552", "comment": "Malware payload (Vjw0rm)", "value": "a7834c3d4cec9de41ec05bd004019f8f0efd1b28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716766, "uuid": "dd2927c4-daff-47f9-9ad9-d9d55560b8b5", "comment": "Malware payload (Vjw0rm)", "value": "56a25574446999494c8a35161fc20fbab61dbff3f103e2dcfb2f9ec1b10485dec25b4537f404b65eb36a38b4ed714b61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716766, "uuid": "53b11022-b4a9-49b9-81b4-71b54ea0d08c", "value": "T1644423C507636279DB64E3321470387FA9757AFF2E283BDC5A4046212A13CBDADAE315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716766, "uuid": "76edf8a2-2ef0-436b-ab6b-ca910e69dcdc", "value": "7d2806726bc6ee08578ae2fe66ace5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716766, "uuid": "b24c134b-c591-4a3a-9614-17296056c70a", "value": "6144:syjHSQxXXq84QYm7NbNkmWaGkQ8/tgKPEpYsBlzO6EpncbK1h6JL6U8QR:ttXqJxz8/tz6K7cO1h++U8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647716766, "uuid": "2dd5a826-cc58-47ad-8b68-d9cb7ea9bccd", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647716766, "uuid": "46345493-368d-4f5b-8d48-ba89d9934983", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716766, "uuid": "51a6f7f1-5392-4c4b-880b-1313f5fed23c", "value": "85ed4ca41df72e39d732b34c1dfbc3c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d292049-a71c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647650053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650053, "uuid": "ef06de31-0ee5-42ea-9d37-4e64ac8f7a6c", "comment": "Malware payload (Heodo)", "value": "2f121212fceb5dd4f4701fa4b9852672", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650053, "uuid": "fd6f2d56-58de-4a94-a14a-ff5c46631737", "comment": "Malware payload (Heodo)", "value": "9bd49d9ccaf004c97486181042025978b82e4c98d899a43b90ed8d8411933965", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650053, "uuid": "9e8e01ab-76f0-4a40-a2ed-dfa2a491ab90", "comment": "Malware payload (Heodo)", "value": "3c34bd9f1bf51f30c0b8388de16d2ec6bed93c1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650053, "uuid": "3e56160c-3653-415f-b4e1-0c2b5ea4721d", "comment": "Malware payload (Heodo)", "value": "ad43fb5c0274c2dd3dcd356a32f7f08651c651bdb12149384eb3dc056d664a1d01361f24a1ea4999178c0730973f6733", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650053, "uuid": "d85a36f2-85e3-4496-a979-156e627301ac", "value": "T1E3D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650053, "uuid": "b408fab5-129b-4035-9610-a0a82959a251", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650053, "uuid": "9a3ceadf-cebe-47b5-86a8-6c88b16bd70c", "value": "12288:UWBpwupxl0OeL/grxcGzO+r9AjCb/XKh:Psupxa/g/2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647650053, "uuid": "231e3918-2b7e-4e11-ae80-61d88c53378e", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647650053, "uuid": "fc5db08d-703d-4b99-a7f2-ad0ac57e537f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650053, "uuid": "d1ffdd71-eff6-43d9-b60e-27afe0ce5abe", "value": "2f121212fceb5dd4f4701fa4b9852672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e61a749-a77c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647691341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647691341, "uuid": "0f228aec-9462-4e6f-929e-0f5748f08324", "comment": "Malware payload", "value": "091fe4ddeadbf0e731e1c0f762f444c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647691341, "uuid": "d9ded2c0-a584-4f3d-8011-6abf71906df4", "comment": "Malware payload", "value": "9c21b977acef57ad64a9b518f1469b60e5d566cb1d5a89b245b975157f7c8aa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647691341, "uuid": "622072a5-361d-4f59-9423-7721b6391bda", "comment": "Malware payload", "value": "94219af65727a9b704c007350bace4fb2d6c709d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647691341, "uuid": "83a9de05-e429-4b3e-a54f-7f4bc5b80c98", "comment": "Malware payload", "value": "baf189d98847b5fb858f68f65c3f2f5739a4841973fb8b9a9fba5468979f01ccaae002615cfdef6be00542a2e62ab5d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647691341, "uuid": "eca33b9c-bc98-4166-8fef-9900571f3f17", "value": "T15966E11577C4CA22C87A013A0D29F180FB31297356355E9B328C59DB9F7BBD14ABBB90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647691341, "uuid": "645c793a-8713-413d-a7be-358e6af152e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647691341, "uuid": "e367aaea-af1c-498c-b6a4-91feb8baf803", "value": "196608:73Nc8zPhzP5qrKtE9E3lG6MZOfyJM8T4lEakcH:TNcAhzhqrKtE23ldVfbqiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647691341, "uuid": "596a0f6c-4665-44b4-9561-457b86ee2133", "value": 6602240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647691341, "uuid": "de5bf59f-bf36-4f31-a7d1-b65d81712139", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647691341, "uuid": "9a1af1a8-ebd2-4104-8ea9-3cb42ec7ee89", "value": "npp.8.2.Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426e66c2-a7b1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647714030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714030, "uuid": "d14ae84a-04d3-4a3a-8060-46c88d3ce039", "comment": "Malware payload (Mirai)", "value": "5af9cf529e1f1f0d1c6a44dbb1f44206", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714030, "uuid": "90aef130-2a4a-4298-81c4-202d23f84f2b", "comment": "Malware payload (Mirai)", "value": "9e91835ddf23eb6a6f54369153e37424f8583240ddedef718e4c4306c3b1ae85", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714030, "uuid": "07a87e67-0c9e-4413-9ee8-5f05b04fb6ba", "comment": "Malware payload (Mirai)", "value": "65dab3feaf297801ddfb8d062dd07bf0008fd1d4", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714030, "uuid": "b9a31540-f8be-4816-aeea-fd872d5d304b", "comment": "Malware payload (Mirai)", "value": "89dd5726bea03d6f50635ee5cda10d5dbebc12c1973c89e0d83b348e5b21618c88e6cbff2bc3e7878577b3cf19f0a2a2", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647714030, "uuid": "2f866eb4-52bd-4a46-8d76-81933fd71f09", "value": "T1C9B33B376251C97AC08356F427EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647714030, "uuid": "de7d2075-fe8d-4e0c-bfaa-122749bea35a", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAA+TRCm7FnVqfJXFWbNb:T9a2aLqkrMPsm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647714030, "uuid": "12fc6385-7356-4eb5-8c58-73d606b85832", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647714030, "uuid": "14e3fd2a-7f2a-45a3-80ca-15af641e155c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647714030, "uuid": "130ed163-2dda-4ee4-ad47-4ef8cc57e978", "value": "5af9cf529e1f1f0d1c6a44dbb1f44206", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be5bda2f-a752-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647673436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647673436, "uuid": "856994fe-bb7d-4a74-8af9-63ee62963c37", "comment": "Malware payload (Heodo)", "value": "333ba409140ce21a5fe61c9e7e2014a4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647673436, "uuid": "bbaf50a0-58e9-4538-bb15-576b9d8accdf", "comment": "Malware payload (Heodo)", "value": "a03bf9c5cd9d2f84701ff1038b7bb8380eb5c6aac7f815b1bc68faae02e74539", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647673436, "uuid": "b0bb1a70-2093-49ab-8f9c-292588119dd5", "comment": "Malware payload (Heodo)", "value": "5a8bb46b2a11df1f463e9a203ef46dd2e384c607", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647673436, "uuid": "86288622-7225-4edb-87de-c6b2ecaf6549", "comment": "Malware payload (Heodo)", "value": "d43100c56cd195c192c3cd65595c84c072d0c85a9d25d04dc4c681abe7cf231f0a7ab5287b91bb51b829b051781eaa76", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647673436, "uuid": "baa7f929-70eb-4073-a34f-c1e94fefcf20", "value": "T130E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647673436, "uuid": "336d8198-633e-4372-a613-9f4161a627ef", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647673436, "uuid": "7a65a790-7fc4-4884-bef2-c79671913f79", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eHxS332d7t5hT/hexLx:Kanana8qGBGuoNxEtxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647673436, "uuid": "e40e5625-6ee5-4f5b-aef5-4eb0ef38e9c7", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647673436, "uuid": "66b8f26d-acc4-4c2a-9c4d-b36a79ea5687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647673436, "uuid": "7def9f32-89dd-4e07-bcd3-76140b7141db", "value": "emotet_exe_e5_a03bf9c5cd9d2f84701ff1038b7bb8380eb5c6aac7f815b1bc68faae02e74539_2022-03-19__070350.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e3fb2a-a755-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647674542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647674542, "uuid": "4aa7d84b-4d0c-4c34-9378-b32db5513e0b", "comment": "Malware payload", "value": "ac29ceb3a93aa3a6a232c8bd7f276009", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647674542, "uuid": "24145463-4ffe-4487-b419-697534413b4a", "comment": "Malware payload", "value": "a17eca0bc5d2d4934c60474f505d86bf948279e42851b20f73e9e98f67549076", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647674542, "uuid": "b1c2203d-cb49-4db7-8d40-957de17a8bc3", "comment": "Malware payload", "value": "6de32fbaa4a95c07522826c20c61a3918fe15fba", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647674542, "uuid": "69158af7-3e2e-4ad8-bab1-fb6a6b548bfb", "comment": "Malware payload", "value": "a68d63a7d89267cca23b277c380f766e1931480ff1b8513b138d66f28c05a5a9c2fe5840f8bee4abec61890a72b1f8a0", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647674542, "uuid": "86cad3af-e5fc-4ccd-ab6c-b4d2c023c8d9", "value": "T1B4C2E01CE7B1F3C9BC908FF84C07A67B9195C8B1E85A73074682ABE4939F4947B45A84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647674542, "uuid": "a2cf9402-23d5-4e51-9e29-8a1261a77fb8", "value": "384:722MSva7HGRYMbITBnTcLTVx7mQ4fMGUPzBgTnsJG/018IqrSxFrHQMSoku0gqV:7dva7H5iQpUTj7mXU9SsI8QrmlZpkRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647674542, "uuid": "42c6a644-c599-48c5-a281-3be51651498f", "value": 28228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647674542, "uuid": "ae10aaf0-bc6f-4e89-8ce7-14f420dd4556", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647674542, "uuid": "be453016-a864-43ce-a7ac-cbbee104bb94", "value": "Purchase Order 611542.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e135db-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "b90ed9ad-3728-4b39-99c2-3dee19c9bb95", "comment": "Malware payload (Heodo)", "value": "59d3bfd69272c968b046c77157bd184c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "3b08d703-5ae5-40a7-94e7-52bdc382962c", "comment": "Malware payload (Heodo)", "value": "a1972cffc319f953311ec8484593a2bacd0c978d28e51e253c1fff9d35bff3d6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "42d6dcc8-e680-4f62-928a-cc90a409f338", "comment": "Malware payload (Heodo)", "value": "f78cc515400234230e3bb6a838a51688dfe63e21", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "15a4ccde-fbc4-48ee-94cf-3a620a1ca04c", "comment": "Malware payload (Heodo)", "value": "051ba8b577054aadd558fdfba1360efbb6464ca58b8839c14e2f91383b1586061cf2a2443792d31d70b618dcc2f852aa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "541ce898-1581-41be-992d-5e29311a9545", "value": "T1F1D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "ddb07f79-229f-4311-a05e-51770bed1ff3", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "ad87ff81-3b30-4630-bc0f-1cd77fc6c36c", "value": "12288:UWBpwupxl0OeL/grxqGzO+r9AjCb/XKh:Psupxa/gx2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648457, "uuid": "ac3c19cd-7d6b-41b2-8cbb-4a2127a149cc", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648457, "uuid": "816e5a23-584e-451b-b999-2a1e168bd524", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "ea41118a-9cf4-40dc-b644-ac1f86371429", "value": "emotet_exe_e4_a1972cffc319f953311ec8484593a2bacd0c978d28e51e253c1fff9d35bff3d6_2022-03-19__000730.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35f435b-a729-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647655862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655862, "uuid": "abb75a33-5689-4606-acce-ddb0c6089360", "comment": "Malware payload (Heodo)", "value": "8c4137662b6aa3d65ae2e1ede4f3415c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655862, "uuid": "aaf79b13-ecd8-4128-93c8-74bafc833888", "comment": "Malware payload (Heodo)", "value": "a2d0ee86a318f23f468ebb29e994fae6af0207b2c188690235e68d1a92e7f67d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655862, "uuid": "66b7130d-40a7-4241-ac8f-4f4a81fa5cff", "comment": "Malware payload (Heodo)", "value": "51f21c8fcd3b2dd9681893b0061e4c7278b21c03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655862, "uuid": "832ac2ce-5317-476c-a9a1-751e03335466", "comment": "Malware payload (Heodo)", "value": "239e79075e6fffff7a01c885c5a224a3d33f983cd9df8fb63c67a0ccff945961a0fa55081e4cd617d067d582cac3c2c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655862, "uuid": "c183fed5-6029-48d7-8cf2-a6165ef1f355", "value": "T147C47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655862, "uuid": "ccbff8bb-27ac-48b4-be80-171c0a33eb94", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655862, "uuid": "9c22d2f4-9a98-4f60-bb35-0e5dc3039a5e", "value": "12288:S54yM33d3q3Z7Bog6reNmF+U/9JckIAGfUeb:SKh3831BogN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647655862, "uuid": "9b271a45-a9ba-4c58-bc94-fa4bc390095a", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647655862, "uuid": "0ba18dc1-27b2-42d9-8945-62796bff466f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655862, "uuid": "c9b1702d-db45-44d8-b54e-6de071ba2dd7", "value": "8c4137662b6aa3d65ae2e1ede4f3415c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d9bbab-a7a5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647708847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708847, "uuid": "c63c6cdb-dfd2-4bf3-9ff8-a6827acd2311", "comment": "Malware payload", "value": "628f097900d7ca725a6f5e9e4f60f660", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708847, "uuid": "1d16e194-d76e-42ce-9054-49152fbaf92c", "comment": "Malware payload", "value": "a37f4df1dffb4ae55043f2e798ca54b2cdbecd9fdddf64ba7799ada2c790b728", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708847, "uuid": "134d7a73-abff-42ec-9cbe-5125a15cfb6e", "comment": "Malware payload", "value": "2812f2f1640ee6e52e6a6bb0cd42637c66903bf1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708847, "uuid": "6086efc1-b7b5-4cb5-a1b0-17e4b3592d03", "comment": "Malware payload", "value": "44a631db477f732bf787288ec45dbb4657022da476b95bcddab49555f2a86191d1aa9b411762a0f145e2a136f4fdd6c9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708847, "uuid": "e20e7679-4dcd-4f58-9831-7240fb8906f4", "value": "T19C82C00811B85902603F9A8651ECAD1F20B72EBEB914E542A5F5DC5B5BFFEC2118FCD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708847, "uuid": "f12b9726-46b1-42a1-81a5-5918e704b228", "value": "384:uzM1hyu077HZY3H5karwP9gXQw1vwPKPSbH9znwTojsZ9:PYu8FykaTQoAx/k9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708847, "uuid": "cc2c765c-eb81-49b9-b179-293b04c809a3", "value": 17773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708847, "uuid": "b030d551-f8e0-4354-9caf-96ffca19505b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708847, "uuid": "24ffdcb2-fafe-4d06-aa70-0626f445aead", "value": "Label_00000125434.doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c85620-a7a3-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647708325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708325, "uuid": "d5f1479e-cccd-499c-9033-ad61c07f5874", "comment": "Malware payload (SnakeKeylogger)", "value": "0e45d5818687e1e446af7f1d8c10052f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708325, "uuid": "d644cdc6-3922-454f-85c0-a962bef7e8ee", "comment": "Malware payload (SnakeKeylogger)", "value": "a38add9c7fd272318d88c4ffa52166e6d698c5e4e6b8b3d9bbf2cfcf9df3f0eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708325, "uuid": "27a50d49-5e13-4069-91e3-8fa0975f2971", "comment": "Malware payload (SnakeKeylogger)", "value": "c237c22261260bbf5c415f674361ac66dece9ec7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708325, "uuid": "31058c45-7a78-4a7c-b5ab-92299ccd0043", "comment": "Malware payload (SnakeKeylogger)", "value": "d1491acdac898366e5913f8f15209898d7f7d06096c17e619c74afaef53c1606e500d090efacdd2855aacab419ffc6ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708325, "uuid": "af2b9bed-b010-4332-b584-09520cee64bc", "value": "T1AB752205B2E95F96F8BBEBF78836954483B1B198120AE2484CCA30D764E3F514729F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708325, "uuid": "eaa60faa-0964-4b29-83ae-167baf8fa4fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708325, "uuid": "0df960a1-f74f-42a9-9cef-05085c58be58", "value": "24576:8mBwOtGxNGbDYNaUjaP5W3ffY0RLwt2W0bwqFRXoSx/mNYnElxeTxIQqaxQiHHKu:8ofEAHY816AwwTW4amNeGxiK57jEle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708325, "uuid": "e85a2c90-f599-409b-af28-cd1c321e846c", "value": 1667584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708325, "uuid": "6e1872ef-0660-444d-9a9c-e715a6358d13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708325, "uuid": "b2d30a26-a59c-4e91-a148-aa33b5c8aec6", "value": "Sample1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221d17b5-a77e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647692072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647692072, "uuid": "6e556a30-4457-4407-b60b-25ea2cc46f53", "comment": "Malware payload (AgentTesla)", "value": "eb12bb8f655f130af852880da20809ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647692072, "uuid": "cfa5ef68-905f-433c-bb0d-54003fbc4380", "comment": "Malware payload (AgentTesla)", "value": "a5aec78d095b6dbbba90ffcccf1ba27b92221a7dfd26ac8d821976a6192c03b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647692072, "uuid": "0cb39cf3-d153-4e90-bfa0-ca0b9b2d3058", "comment": "Malware payload (AgentTesla)", "value": "f97ad7f247e312f2f70c8e00954e5e6b2db1abf9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647692072, "uuid": "c2f6f68a-e0fb-4f49-8354-9ad40d82f4e4", "comment": "Malware payload (AgentTesla)", "value": "078bc063d33319b0d104df19c571ddb9569cd07072aa28823fdfe124abbca68fde1ed6b788120aacade2d853ac68565c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647692072, "uuid": "603f1154-35b7-43fd-b771-ef3d0d0e6cbd", "value": "T14D55332E5EE39A43720B99FEE59D2B2427CD0400971D7F4BD2465F3EC14822DD99B2C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647692072, "uuid": "33a4b83c-a72b-4b06-af4f-2f100eebc294", "value": "24576:K3yK2tdEcNmlE+uzaKNwIpuJvkZf1FwfvcRN26ef2xkcLKW7g:NdEcwEr5weZf1FKkRaC57g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647692072, "uuid": "ad205643-26a3-4ee2-83d8-5059d1a8cefb", "value": 1281721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647692072, "uuid": "9c203716-517e-45c2-a703-af77d73f9f88", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647692072, "uuid": "96197ce5-980c-445f-b16a-669d8145dd23", "value": "FIRST DRAFT COPY FOR BL NO.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4efd4882-a754-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647674108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647674108, "uuid": "d0a28717-7189-487a-a00c-1aa18e1df31c", "comment": "Malware payload", "value": "279f843cbbb1669c156cc58d7c448ca1", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647674108, "uuid": "a6693776-e4a1-4e08-aa29-de462ac451e1", "comment": "Malware payload", "value": "a5ebcef0b521d350444699dac8798d290c14fd5696c8ffc3f3a094c05581c25c", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647674108, "uuid": "883e7fe7-49f2-4af7-bb9f-4ad1fd3e8bcf", "comment": "Malware payload", "value": "c136e50b0b9a72b9bd286b22ad3258db8f9f1f51", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647674108, "uuid": "f3e78999-d139-4985-a920-00fee67013d7", "comment": "Malware payload", "value": "ac10d516a24a92d239bbbcf19521e5c660b5d9061563a51d9afbdc0eca496eb6d57776f5c896bda454b00c8b1f925d32", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647674108, "uuid": "6c48970c-1e22-42ca-86f3-bd57fe465c10", "value": "T15DC2F11CE7B1F3C9BC908FFC4C07A67B9195CCB1A85973074682ABE4939F4947B41A44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647674108, "uuid": "98ad8ce7-3124-4c31-9b94-f2ea76a155c0", "value": "384:Z22MSva7HGRYMbITBnTcLTVx7mQ4fMGUPzBgTnsJG/018IqrSxFrHQMSoku0gqV:Zdva7H5iQpUTj7mXU9SsI8QrmlZpkRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647674108, "uuid": "2a04c003-5ccc-4704-8af7-ac56d79414e8", "value": 28220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647674108, "uuid": "2b4288a4-7870-4bb5-a66d-3476c5412165", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647674108, "uuid": "65309975-61a6-4b72-8f14-c64e58372513", "value": "BL DRAFT COPY.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aabd683f-a737-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647661807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647661807, "uuid": "1f76a32f-e879-43dd-8e4b-b26592ae23b4", "comment": "Malware payload (Mirai)", "value": "377fc7102afb411fe7976bf44502b952", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647661807, "uuid": "0ac3a1d2-1ff3-41ae-bc4d-6390b3f70703", "comment": "Malware payload (Mirai)", "value": "a5f87626df82e3962c52def053768b0374b5966a3281c666c0de586410abe222", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647661807, "uuid": "5218b8df-ef89-4a08-a7bf-e62782d80b63", "comment": "Malware payload (Mirai)", "value": "d383d8930e7120751a735b0494581a0ab90b8a11", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647661807, "uuid": "45680954-b555-4975-811a-83455ec5a5f7", "comment": "Malware payload (Mirai)", "value": "d48081ac38da3ae84fc7e52b0bd41dabb6b3b8c2b6ca0d309b15d594d8a1db763a4844e9f6637332fde76498b87c0e1a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647661807, "uuid": "8c11d5ae-6851-49dc-8f38-efb5948853b8", "value": "T17F043D46E6405A53D4C31776BA9F064633239BD4E3DB73068D246FB43FC77AA0E52A0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647661807, "uuid": "48bdb2fc-1776-470c-a265-e5d94f48ba17", "value": "3072:/j+8fxWXVy/Jwf39W3mv4rywajkhL5JdFs97Ph+SwuXlc9M/9zUrmXwE92U3V:/ScqmmfYsXwajkhL5JHsnwuXlGM/9QrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647661807, "uuid": "164f3a4e-eaed-4955-9150-a06758506f77", "value": 184086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647661807, "uuid": "a66957d9-bf1e-4c44-86fb-50e3979cda23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647661807, "uuid": "4df2f11b-e07e-4eb8-9dad-5abecd547d7c", "value": "garm7-20220319-0350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d117217e-a7a4-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647708686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708686, "uuid": "484e19d2-f6d2-4705-a900-ab7a7d6c521a", "comment": "Malware payload (AgentTesla)", "value": "ab3b8da0d377a88580bc8fcc782cb353", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708686, "uuid": "5ca8e1b6-0832-4217-b858-b8382886f23a", "comment": "Malware payload (AgentTesla)", "value": "a6654ee4b05c7ef1bc411888d4ba4e3c1c816b562f52888e12df7d05cb8188c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708686, "uuid": "e3773b73-98ec-4aca-9c17-025da05debea", "comment": "Malware payload (AgentTesla)", "value": "4c83630998a39b00b63b367b2bb43a59ce02435c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708686, "uuid": "9875fdb2-8105-4211-8411-46f96120b156", "comment": "Malware payload (AgentTesla)", "value": "85b1f77185dad96ba741d363f544e89e43139953afabc156bb980107bb6158859d899bd8bbe6edc4e8dcbf61c7a8bd61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708686, "uuid": "c36d5bbc-e401-4e13-aeae-87050ffae41e", "value": "T1DF140227B39C17BAC903E6F0410F0AD277ADDE4263630615B627B1AABD772350D0BD26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708686, "uuid": "1344d02f-f7ef-4026-8f14-2c78dffc4649", "value": "3072:EfBdjdvkqYtuUDjHFqNjxNAx6E04iRy0w8xlRtoQNbW31ttw9dmbr5Y89x87bSwG:kDWlmAx69eq5k3zKT6zx8XSwKndUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708686, "uuid": "265dc919-de5a-4d75-9c68-b9e944d307eb", "value": 190824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708686, "uuid": "a46784c5-d3cf-48a8-8f82-7777f8a6040e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708686, "uuid": "ae9555d6-7f23-4b52-9ced-965eb97e1926", "value": "Preorder2022031800285.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33d1d22-a741-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666196, "uuid": "320416e1-ff80-4c28-85a8-9aec005b23cb", "comment": "Malware payload (RedLineStealer)", "value": "669fa0ba715518774ef16ecc9ba1dbe5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666196, "uuid": "5ff65033-47b6-4cef-88e4-babfa18b4022", "comment": "Malware payload (RedLineStealer)", "value": "a78c6b44fa48674f8dc9572fd7ff9b15347dca01f9aa38d34fc18d688f92c4a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666196, "uuid": "235ea7d0-2cfe-4dfd-aeb0-97d53d1d45f0", "comment": "Malware payload (RedLineStealer)", "value": "5b2394b991441c54429d97b81c74cc73e2a0bbea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666196, "uuid": "73d4a9ac-27b5-478c-8b7c-d8fe062ba512", "comment": "Malware payload (RedLineStealer)", "value": "e33b30fc0d47253962dc6e28d83379c130c60a5ed95b9feaa3bfc4a43f376104907f3f20d7c63ae90514a2326f101320", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666196, "uuid": "5e1ef820-dc9e-4e2a-8062-c234c1f1e6ce", "value": "T173353359D7090C3ACBE1E4F47C35533628AEF9EF825D472CAD2D193E985E1067720A8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666196, "uuid": "12be4336-bcc9-4888-b40a-e491317ab0df", "value": "61747f6f466078d67d1a5eafc213eb8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666196, "uuid": "364d1073-1684-4914-9525-82b07536d403", "value": "24576:UJI3ZMKbpSsKNGI4oEy/VdT8oDSvCls2jDEc7az580NyNii50qmzkzWS:bZMggsKLVvVZf9DD7eN0CqmAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666196, "uuid": "1e55f53b-fa36-4e4b-8a25-db1f80f7c3ce", "value": 1136368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666196, "uuid": "44fbe47d-fedf-4457-a96b-80a69518f540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666196, "uuid": "78b99e9d-da1c-459d-a999-9ddf512d478d", "value": "21617261.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28afa9c2-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666313, "uuid": "a847262a-695d-46a1-8de0-3f8f278a22ea", "comment": "Malware payload (RedLineStealer)", "value": "24b8d255d4dc47ae3d4677134f928a44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666313, "uuid": "d8a8d922-4df3-4e5f-ad32-c49ac7e57a13", "comment": "Malware payload (RedLineStealer)", "value": "a7d5d2fc396f4df8b4009a293b66a3e002b331fdc8fadfc5a1ac447f169b7162", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666313, "uuid": "8f122a93-c8d6-41f7-91ba-0b5141280bb8", "comment": "Malware payload (RedLineStealer)", "value": "000eff0f39d27da737fdd6b029e57fd924f0c8b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666313, "uuid": "b196235c-fd7b-486e-b384-14c08a714756", "comment": "Malware payload (RedLineStealer)", "value": "32ae17fcac0b84f2f4216318a7149214ae195834a452029e4e5b8d5425509fb258ad37db44d90558b68cf8a16881009f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666313, "uuid": "0818af9f-25ff-45b0-89c3-47d894b01b75", "value": "T1FCC5236176AA9377C4E3233428C0A7A979F6BC301B2795D362C4392B7D7A3E1C735099", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666313, "uuid": "aded8924-29c6-496c-bbee-2837588cbf13", "value": "9c61e193ad83beb9c6707bb817822229", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666313, "uuid": "a603da3a-a1b5-4dc3-9a90-d06dd92cfe08", "value": "49152:JNYkRAokh2BHN4EMA4QaJC9TSrCfO/lldEDpYY6eJEURfIxWiD0jB1:JNfAokhmMwYC9sRHY6eJEaIwiAB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666313, "uuid": "3debc107-bcda-4af6-9def-37f01b80b82b", "value": 2628393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666313, "uuid": "659be0f6-f76d-4949-87a1-d6dccda6a67f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666313, "uuid": "4c88bb19-1fec-4e2b-96da-22d05a65a7a1", "value": "22502256.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3ca047-a7bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647718877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647718877, "uuid": "8fd88a35-e676-4590-ae39-d45cdd73e2ad", "comment": "Malware payload (Loki)", "value": "a30fcf64b94221504119d77f7eb8fb70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647718877, "uuid": "9bf74f08-d42b-4b77-9c3d-fbeb29652b19", "comment": "Malware payload (Loki)", "value": "a80eba5a91dfb1bbbcf6cfdf9014a4abc654902a6664ee6d157c6cc857708009", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647718877, "uuid": "2f90eba6-11df-4a61-981a-df2ef7da1173", "comment": "Malware payload (Loki)", "value": "7ba7a1584ef6046e0d2e3a06e3a95a62625f92ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647718877, "uuid": "b6d8143f-aa9d-4a60-9cfc-79d6d2b039c3", "comment": "Malware payload (Loki)", "value": "c0d1cf321477a7c143c6fc34032ea5c7aa17a6be2ed52177388f5591ec901a3c50412a8508125435154d79a7303aee5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647718877, "uuid": "96435aea-c1ed-4a9f-bbf8-aca5b1db8ffe", "value": "T1574402A0DB8185A9C8590AB7D826D5140732DE1EF496C60FBBD6393A3DB334350E3E5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647718877, "uuid": "c6f621e4-88dd-430b-9f9d-1a4f7da8cdb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647718877, "uuid": "f6d3d87e-37f7-4c13-9deb-1c012d38d29e", "value": "6144:qlld+mEczuNl4QMONTHYH8Ug4LwSODZylCRey5:cld4H34ROlHM8UnLSRRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647718877, "uuid": "86bd9174-5f60-43be-b63a-4fbbf078f3e3", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647718877, "uuid": "7d38ead7-fbf2-4b3d-8b87-3d4faaa2f370", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647718877, "uuid": "3f511c2a-e6fd-4175-823a-d741ecc71e71", "value": "A80EBA5A91DFB1BBBCF6CFDF9014A4ABC654902A6664E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5d87bf-a7af-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647713372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713372, "uuid": "be56d12a-e9d1-49ef-a0db-a75b0a6236f3", "comment": "Malware payload (Mirai)", "value": "dc9529bc9b6f92f528fe9267661afd0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713372, "uuid": "41d0d1cd-a11c-4459-8748-53d88f8db598", "comment": "Malware payload (Mirai)", "value": "a9bd5b3c202d76e0785ae3be70c9aaece23810df65472374db1d35d9ac932ed6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713372, "uuid": "4a350ab1-fc21-443f-9a62-b24fe1769eb5", "comment": "Malware payload (Mirai)", "value": "3e2202e4c0a3736f51837e8b2e254fe8e465b21a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713372, "uuid": "8f4b5990-c63f-4d09-94fe-0ecd410d20d9", "comment": "Malware payload (Mirai)", "value": "9e76fa9568ef4ddafa0c12c4daafbfe38fe19eec45dc3b8b4d06291583d3e554fac217e7e7ffb752e8d9124612012475", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713372, "uuid": "fa52d531-cc2c-4b2b-8f49-e2c010421922", "value": "T16BE38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713372, "uuid": "7ef615f1-8c41-45aa-8045-3dd430a31819", "value": "3072:dgZc9h1jlnLA2PiXYeyCc4VNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZ4VWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647713372, "uuid": "fa506df4-037b-49b7-9ff5-e81f83450d5f", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647713372, "uuid": "d7f4d74c-cbd4-4f0b-bbc7-91449f79a421", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713372, "uuid": "fd2510d5-19c2-4e09-809a-55d16abc24b2", "value": "dc9529bc9b6f92f528fe9267661afd0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a2f089-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666622, "uuid": "278fd3d5-68c5-4589-826b-0d23f8e47f28", "comment": "Malware payload (RedLineStealer)", "value": "4e220c31882b8b6208f7a566b7fac4b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666622, "uuid": "a7a83f73-ae79-4401-b81c-423723e1d42a", "comment": "Malware payload (RedLineStealer)", "value": "a9fc8ffea81c831010b0927662021666cf48e943bb3385bd85bc89324a94dabc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666622, "uuid": "a0d8f705-018d-44d7-a9cf-9903e53e65d8", "comment": "Malware payload (RedLineStealer)", "value": "cdfd1b48830eef06f4f41ce41e0b3a03a6a9eb38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666622, "uuid": "d313fbf6-2cd1-423c-b1ad-55a88debbdff", "comment": "Malware payload (RedLineStealer)", "value": "facc66d89d244b7f2cd4779dc30b12782618a95a67288d5357bad1004679f33629a16f856446381f939dc1cca2d33b39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666622, "uuid": "7b485932-d818-4575-9aed-4831f187ee32", "value": "T100A34BA167CD8624E2FF4F706CB8119483F4E043A502DB8F5DC560DA1F76B90EA667B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666622, "uuid": "818ae84e-3f62-46c1-8ddd-63aadbaf67b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666622, "uuid": "29ac229f-c78a-4364-9440-5849d87484e5", "value": "3072:LucUJyCCzYS0HMOVfypaTzrXv3+JhCJNKf:LucMBnHfux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666622, "uuid": "a7a348d6-aa9a-4c86-b7f0-dbf52cf4dc82", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666622, "uuid": "5ff1280a-8e55-4977-99f6-8567885b863b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666622, "uuid": "aea18a23-9c50-441c-b182-1b3cb76dc2a1", "value": "25292642.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2bd9ac-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648599, "uuid": "e63ab4f7-cc24-4c9b-9240-665443097ca8", "comment": "Malware payload (Heodo)", "value": "02c417593d0b1a0f4c3b6e0598c5c779", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648599, "uuid": "d109d83d-cd6f-4a58-9339-54737908a8d7", "comment": "Malware payload (Heodo)", "value": "ab1636ec33c7da618baf9c6d86323d40a0a7b069875af5ac14011af8600c1fc0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648599, "uuid": "6cce418e-395b-4ea2-b0e8-afb334ec8e46", "comment": "Malware payload (Heodo)", "value": "36a121eae2ea625e7786f4d13b204751b0ca0c03", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648599, "uuid": "8e84f20b-287f-4056-af79-975ad132f47f", "comment": "Malware payload (Heodo)", "value": "7c3c894142dbb518caf2f4c049d89f570be33e1ced7f15f7c3d9479c16aed03079a603b3556adc093a9d8a8a51072721", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648599, "uuid": "3ad4a1d6-3b14-4042-a9f1-58417757c102", "value": "T138C47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648599, "uuid": "27c38717-b84e-4630-9b3b-af94855e9974", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648599, "uuid": "94a3f3a5-fd33-4c83-82ff-345f49019517", "value": "12288:S54yM33d3q3Z7BogPreNmF+U/9JckIAGfUeb:SKh3831BoZN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648599, "uuid": "732d8db9-1bd7-4162-9b56-2de8a040b4f9", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648599, "uuid": "445c6792-2aa0-4ebc-8a32-1166d5aabf1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648599, "uuid": "21b523b4-618c-4838-bf44-c077f6d154e6", "value": "emotet_exe_e5_ab1636ec33c7da618baf9c6d86323d40a0a7b069875af5ac14011af8600c1fc0_2022-03-19__000954.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a0827f-a7b5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647715814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715814, "uuid": "5adb2f7b-7a1d-40d0-aa15-f4812b777ada", "comment": "Malware payload", "value": "f958a98b3eb8cd97beef37eec042b424", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715814, "uuid": "f4c99202-09dc-4380-bf26-bbae892ed371", "comment": "Malware payload", "value": "ac9685567c34bdd88d27c48e5e32cd34719abd933e91875b0b3f43ec49793e9a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715814, "uuid": "d82abe63-2df2-4d51-b4c0-72c38a8bd40b", "comment": "Malware payload", "value": "9184b4068d7afcbb051393913f5f026f587a3a75", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715814, "uuid": "92ef376b-4419-49ec-8925-a97b32c65e37", "comment": "Malware payload", "value": "b8cc4d9d92b0c3139a9e52553d8a13a7b1e5a3b35a88aca33870b349bae58b924a782ee84ef938329ed5e7cfce26d0c7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715814, "uuid": "1c0e4095-51a5-4655-8908-466b761f9330", "value": "T100531956BD429A00C49041B6FF0E110DB317C7A4E3DFB777DE686A90668B1A78F2F419", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715814, "uuid": "b7446796-f3d5-485e-8482-bf4d1e32cfae", "value": "1536:zDn7nWxUU3ELcLIBiFt+IZocIlUARnUQDy+KQ/U:rsNt+IZocIlUAiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647715814, "uuid": "39585622-5b35-41f8-a18a-313ac0b9b25b", "value": 64304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647715814, "uuid": "0876ef24-8e02-48f1-b379-9e5b82a7b75e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715814, "uuid": "ca4699f5-b2ca-4a43-b301-2ee0c697612b", "value": "arm6-20220319-1850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa44f04-a7af-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647713400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713400, "uuid": "f3ee95d6-1acc-44b9-8830-d838bcb73edf", "comment": "Malware payload (Mirai)", "value": "563c17de19f856508044f32a9e2ac207", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713400, "uuid": "fb6ac912-e1d5-4952-80f4-7818b3cde19c", "comment": "Malware payload (Mirai)", "value": "ad4c3cc763edfa82c4bfe0be1397f8a48151c0c218268285a55643f1486f1162", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713400, "uuid": "68e31e0d-606a-4783-8638-e8358c8f6dbf", "comment": "Malware payload (Mirai)", "value": "cca56ac220a4c7a23a15023357a88a603792202b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713400, "uuid": "7a40d393-21dd-4310-aff2-635fcf8aa058", "comment": "Malware payload (Mirai)", "value": "cb01ca2b80e3cd4ee52e60f819cafc9627d77ee1a4cffbd50e4c1127f0654e04969cfa87f9bfffbabfaba607b10ddca6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713400, "uuid": "eb9183b7-3d78-4cb9-b08a-ccd092a0371a", "value": "T1ECA3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713400, "uuid": "5ef98429-941e-47c6-9189-3080a2485d88", "value": "3072:VK1z13U6HzHoXRtmTUhQogMEmmFVcqq0GnDZT:VK7DDeKlogMEmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647713400, "uuid": "9cad5659-ee1a-447e-839b-8469f9cb5d94", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647713400, "uuid": "4cd1293d-3292-41f3-8885-98d53568f430", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713400, "uuid": "2d34972b-9c8e-415d-99fc-d1a56ba9d116", "value": "563c17de19f856508044f32a9e2ac207", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ab1c3e-a7b5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647715811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715811, "uuid": "d33fe30c-ef08-4d75-97e8-096a65ab5cc7", "comment": "Malware payload", "value": "9877abea3dd262a542f230096b990969", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715811, "uuid": "7ef4cb52-6c37-4dff-b4f3-a19b059bc515", "comment": "Malware payload", "value": "ae5859fae426f8a43f5aba862e69d2a3688f1b475e7c1e3266ee1405a2e38771", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715811, "uuid": "ece1614a-56d8-462b-8926-58385e95accc", "comment": "Malware payload", "value": "7b59dc659eff62d77ca0eef40fbe67594f68902b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715811, "uuid": "290c9fa5-9ac7-401b-bba2-f149c9c13f1c", "comment": "Malware payload", "value": "7fd21aec555f0ea7c8f6f31ce12112000c46e2f0d3e30af1d8c9d858f0404658b474f90817cfc7b47f5201e7393ee95d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715811, "uuid": "dc835c7a-096b-4064-80b9-dc5a62ee1215", "value": "T1C1730846FD419B00C0D121B6FE0F114A3317E7A8E3EAB356EE246B64978B66B4F2F415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715811, "uuid": "303e7d08-31dd-4b11-8182-9a5bb22e3877", "value": "1536:+vin1XjaVmanq4H3Mbk+NlYUiUPy/ypUlUAIZK/d7W:JObnq4H3Mw0y/mUlUAIA/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647715811, "uuid": "5dea4a97-b26d-4f3e-bece-12f5635ca9b8", "value": 77236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647715811, "uuid": "9047a2d5-2b2d-4c78-99e0-98832c3afbc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715811, "uuid": "37627505-7bf2-474e-923c-99be64b79dda", "value": "arm7-20220319-1850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5985e029-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1647666395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666395, "uuid": "86ac3e6d-5fad-4d8f-859d-481fcfc3152c", "comment": "Malware payload (CoinMiner)", "value": "d3645328e097eff3c9f08202394159c8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666395, "uuid": "2214ac4d-7e32-4ae0-a941-c3c0dab7e6cf", "comment": "Malware payload (CoinMiner)", "value": "afe63d885189002afc769724d179e239b7ca0f80277c64c89a5c1b5bfe54c3c4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666395, "uuid": "047cf6a5-ee41-454e-94ea-a578bb672585", "comment": "Malware payload (CoinMiner)", "value": "5040065ebebd1961d8997337634dc4ad6750dd62", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666395, "uuid": "2bf2826b-5027-46cd-a646-51ecb426ec1a", "comment": "Malware payload (CoinMiner)", "value": "eafe973e16e5adbe029530d65512b5fb457ff5a047e330952bd1369faef3182292d373e8c8cb77b906adba4c45ae9ec5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666395, "uuid": "76bfa233-cb1d-4fd4-a377-1cd4d0718caf", "value": "T171453347185F28B5C88225BDC278C1F6EF9540F16279C926AFF52DC9324A3B7850E1EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666395, "uuid": "9c17eb18-a19c-4a85-b2a0-ab04e0502aa3", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666395, "uuid": "6ccce101-d91b-46e3-ba06-f9568b8b50b5", "value": "24576:iEx1P/P+rQGcV7ejXOQ0W0C/oWEyTHDRAThas83LqrsvQ:nx1nPIQp7s4W0hj6VAThUJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666395, "uuid": "437433c2-97b3-42f2-8313-d08dcc46c64c", "value": 1189376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666395, "uuid": "45d68536-30a6-4f9f-9ecf-689b681f0a87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666395, "uuid": "4e581d15-5042-4d88-ac56-7f9106cf9281", "value": "23327112.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9672aa91-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648458, "uuid": "b04f0ff2-cd54-4f5d-88c2-3f9d3ca909f1", "comment": "Malware payload (Heodo)", "value": "2de2ad9cb6b9637abb036461f0b72ba9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648458, "uuid": "88acd896-c8e4-4f27-ad7a-de0ad50de854", "comment": "Malware payload (Heodo)", "value": "b090ac5ea8f6035685fcfe2ffecc9cbd557b539f678c632dda6c4041727cfa67", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648458, "uuid": "3fb75059-2bb5-4043-8fae-8a90a5d70715", "comment": "Malware payload (Heodo)", "value": "192df2efc97c72ef569f9f6270049524bb7c364b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648458, "uuid": "cbde531c-f9a7-4aec-909c-04ed43f96730", "comment": "Malware payload (Heodo)", "value": "cb4dbc4d186d0491fd36711f2ae1ba8fac8338c1e8d0c669b219d20a963b7ec529388650a028a475e5a6dcfb24a4d801", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648458, "uuid": "99eaff4c-feee-48da-b910-9b0811083770", "value": "T133D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648458, "uuid": "09931c86-383c-4bbc-9d2d-7e2ad917b693", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648458, "uuid": "34477406-27cc-4212-80ec-11c26caf1ad6", "value": "12288:UWBpwupxl0OeL/grxpGzO+r9AjCb/XKh:Psupxa/gQ2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648458, "uuid": "33820c83-9362-4242-92d6-3505ecde82cb", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648458, "uuid": "6d0730cd-fc37-4f99-950c-af3c0d6d255a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648458, "uuid": "b1999134-34dc-4e62-8e0a-154aa8a222f6", "value": "emotet_exe_e4_b090ac5ea8f6035685fcfe2ffecc9cbd557b539f678c632dda6c4041727cfa67_2022-03-19__000730.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78258d12-a723-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647653132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653132, "uuid": "7a52cb79-f4bd-4def-be20-e9c281d25d4d", "comment": "Malware payload (Heodo)", "value": "4f7192887ff210dce701b1538119a7f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653132, "uuid": "9057c272-95d2-43ee-8350-5313970f3838", "comment": "Malware payload (Heodo)", "value": "b1e9fc76dfb1081b99665261e25b6d5bf1c34193f1c0a380a7d64e1102d6a7f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653132, "uuid": "de7985f7-c7a1-4329-b685-e552c515864b", "comment": "Malware payload (Heodo)", "value": "10449897047f08c82111c30ba53a75ed33fe4445", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653132, "uuid": "c865e8d3-bfcb-4f3d-9479-b49c99513dae", "comment": "Malware payload (Heodo)", "value": "d11c7bbed5f5df80ab7518c1c72dbff73c8975d963253e5e2b6dc2b6672dd6b35462c5092f48f37067244f5ac24fa008", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653132, "uuid": "ec20a9d6-ed1a-408c-aabb-d5c986400773", "value": "T1ECC47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653132, "uuid": "6eb0784c-c015-4229-bcff-1d5a387d1247", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653132, "uuid": "1885be1d-ec59-426d-86be-b32b687a1d2c", "value": "12288:S54yM33d3q3Z7BogXreNmF+U/9JckIAGfUeb:SKh3831BoZN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647653132, "uuid": "19e3c038-7153-4502-8bcf-22a33c8e7901", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647653132, "uuid": "e4c9aa14-d9ef-4a19-8973-43fbc107f81d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653132, "uuid": "09dcf3af-8187-4e44-aa64-dfcc187f2720", "value": "4f7192887ff210dce701b1538119a7f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8136bf88-a7c3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647721866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647721866, "uuid": "3078cb58-2ca6-48dc-bc75-f36fab83f9fc", "comment": "Malware payload", "value": "5823b77d9b8a0fe528098a33e8c928df", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647721866, "uuid": "2959026f-8f06-4fc2-a3ff-134663410f93", "comment": "Malware payload", "value": "b348212ed687185f16eb65185bd8910cd2899db65ebb21d6562666c51aef08da", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647721866, "uuid": "5c3ddbb2-36d5-47f3-adb7-9a4bdaa60537", "comment": "Malware payload", "value": "c626b49d96ba918d0a2c7ba3049c7f739fcd8fdd", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647721866, "uuid": "8e2d9d56-ad20-40ed-80a5-e5d5da50f746", "comment": "Malware payload", "value": "67fca714b5aab8d10506e0166da038f9cf380233e4bd3b8880abd184023975c9e281d17a30bfbfde69981f55ecee2bb5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647721866, "uuid": "c3beb465-41a5-4247-b083-15d92b49b407", "value": "T1ADA423815322C6A757837318EE52EED54680DDA0182837AC71E9D6DC476CBE25ECBF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647721866, "uuid": "7d7350a2-6aa3-4908-8a5c-cd784b8a50d8", "value": "12288:hOOfTxWUxZW2mwzIIGzawf6LNWBYEEL+Lon3ef+DhAR:hOOfTkYZx30ewf65WBYOofdAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647721866, "uuid": "eb8b8f41-0976-44ff-881a-f27331bfe641", "value": 486773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647721866, "uuid": "cfa131d8-7017-4a9b-8b34-4d9a9a23fd5a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647721866, "uuid": "8bb13096-9e13-4d25-89cd-99b44c005256", "value": "SOA PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9a8de1-a7b5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647715816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715816, "uuid": "a6869647-f385-470e-bbd8-a1e151049861", "comment": "Malware payload", "value": "2f5d3eb696b35ff6d1a0a585cfa63061", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715816, "uuid": "a91ae9b5-1885-4f96-8b34-3568bb09ca35", "comment": "Malware payload", "value": "b447f642683305f31b596011dd15b3dec97873cdeea9e63dce50c4384d475862", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715816, "uuid": "221eeac3-edb5-4e30-b59f-4150db5d9b57", "comment": "Malware payload", "value": "11ce4f7e43706f4483a70d556db1bb158c5188b5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715816, "uuid": "ac36a1cc-1df2-4bce-85fa-d060b31057a4", "comment": "Malware payload", "value": "7b6c26d12a97b403e4aa85ece7fa418b11a00bbaeefed9b2914b92e8126b492fd640e389c6fbb37d1d5285a0584f1451", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715816, "uuid": "72fbd67e-4593-49ec-927c-114f889d9936", "value": "T1F6135C43FFCA9620C0C052B2EE1B874A3366E3D4E5EABF478EA4534429C74566FDB548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715816, "uuid": "e1dc1361-2aa0-44e4-b676-c55beb41148c", "value": "768:Bw1lkSXdX/iRoPFIcjE9WHgNaSiNlUZyUq/+y8Uocw7Lf5Fu/7:BHuviRgAkVlUA+cuzXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647715816, "uuid": "efe2cc93-c0fa-4d42-8177-ebf8c66b1985", "value": 43572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647715816, "uuid": "d145669b-70d1-4a46-af98-ce2c7ba89373", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715816, "uuid": "c5e7b75a-820c-4b40-86ec-16f5f75081e3", "value": "arm5-20220319-1850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d27ffbe-a741-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647665998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647665998, "uuid": "97d0d7a3-cb39-4a1a-9f23-b62cab224c0b", "comment": "Malware payload (RedLineStealer)", "value": "f50b7c68c38204a622b0b0623218fe15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647665998, "uuid": "62045a12-6062-44a5-ac41-77a3f14b6aad", "comment": "Malware payload (RedLineStealer)", "value": "b502c0b8059208df8701163289d1c1b8a8d3734104755497093c4bb462e42594", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647665998, "uuid": "d9c7dd8e-34cf-4ed2-9fc3-079fae7ceac7", "comment": "Malware payload (RedLineStealer)", "value": "1e557364be9a983ad18c327e34516c53e6a04af4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647665998, "uuid": "b280d060-c301-48c3-b919-31b35f4b10cd", "comment": "Malware payload (RedLineStealer)", "value": "5cbb1c513e5cab06557b9f43ffcf92be702c0361e1d77471f8ee5d0c24b4c71ed7450d939093b2b9b415ef3cd5a65456", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647665998, "uuid": "eabada6a-1664-47c9-a639-685068544898", "value": "T1E1B4A4343AFF9019F1B3AF75DFD47986DA9EB7633607E85D205103864A03A82DD8153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647665998, "uuid": "0c792751-9cc4-4557-8051-25b596c4999d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647665998, "uuid": "d16e8553-a779-4ab6-89ab-e0734441aac5", "value": "12288:lOjhsK/cCWkaGt3e2tfWGkbMJrkIWc46jLhbVsbI593K4s/:lOj1cDaLx335h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647665998, "uuid": "82f55269-5c54-4079-a8e1-6b401f6984cf", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647665998, "uuid": "1d339174-f789-457d-949a-1b1cf9cc43fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647665998, "uuid": "b3b3ca70-505f-4be1-a503-317bdabafa97", "value": "20426151.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bfce95-a743-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666786, "uuid": "24c2ef5e-7034-4d26-8f65-eb737e6980e9", "comment": "Malware payload (RedLineStealer)", "value": "6f4ba41c9ddfa6193c923253328e7878", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666786, "uuid": "328bb752-673f-4a3e-8246-6f8d6af13d4b", "comment": "Malware payload (RedLineStealer)", "value": "b51537f13956be6badbaea854f838dc0f8494e907a97dcbb10c11b1739bb5fb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666786, "uuid": "88e6c61f-ad2f-4b50-937a-5414fdcbd483", "comment": "Malware payload (RedLineStealer)", "value": "b8055c11a3b942376e2e9533f7ce52d536e2bf2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666786, "uuid": "4b2cf4a1-0b48-4428-bc8d-1001c2b95b84", "comment": "Malware payload (RedLineStealer)", "value": "3fd13f972ba5c7859fa51aa85a763524c60f60ca6bae54dee7d4aa3b81ddb66728815eb5e01ca7037e5269aa88d1cede", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666786, "uuid": "80d665d0-52b3-460d-be55-9338a31dc4a8", "value": "T1FA3633DDE071FE74C42D65B8B93DF2F2FEAB8958C842BB11732A450F8D94A39D04A419", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666786, "uuid": "be933509-2426-41d4-911b-06e5d5aee8d6", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666786, "uuid": "d2802f35-ae2c-4539-b54c-f61f897a7dc7", "value": "98304:4+DpvboYNOCHJ3DMlua0pWubRLnmHD58WLt9b+APtzh29jTfFw:5Dpv8Y4CHJQNylG584PKISfFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666786, "uuid": "4e01b6f1-1467-435f-ab93-86b9af3bc474", "value": 4891800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666786, "uuid": "bad71f56-5683-45bc-a209-b7f42a05c9b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666786, "uuid": "4f596249-d726-448a-9a11-6e6ff13b8929", "value": "26865723.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ee54e0-a71c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647650043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650043, "uuid": "3d1b5fd1-62c5-4d49-909e-954221f7b24d", "comment": "Malware payload (Heodo)", "value": "258d8904ffa811ee13412ee318a1e43b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650043, "uuid": "86489150-771e-4bdf-9620-ee90e0719165", "comment": "Malware payload (Heodo)", "value": "b55b6882e929d8ac6080627463886318558976fe22082d1340efc9afd16b40e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650043, "uuid": "df09bbf2-88f3-4da2-8e95-cf55359f135c", "comment": "Malware payload (Heodo)", "value": "aa7016f6a02691dd9dc8e186a3f5f87e5cde5c59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650043, "uuid": "5967db35-0b68-4ebe-9153-595455eeead1", "comment": "Malware payload (Heodo)", "value": "2b98e3450981ad18f398fef749af5e5b3001e31cf911ea4df728875a93ba8820fdd715425b157f90287bdcbab6ca2776", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650043, "uuid": "4856743e-afd3-4df8-a745-6484a22f7764", "value": "T1BBC47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650043, "uuid": "d96b72ae-3a73-41f8-b736-f81631c9629a", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650043, "uuid": "fd210109-43a2-4dbf-bdd6-524298742fb2", "value": "12288:S54yM33d3q3Z7BogxreNmF+U/9JckIAGfUeb:SKh3831BorN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647650043, "uuid": "8de20aba-e84f-428b-a379-f43bd1c4fa4e", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647650043, "uuid": "28b6d1a6-73ca-4ad7-81ee-cfd94768e94b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650043, "uuid": "08cb0c6f-d7e3-4837-b0ef-1deeaf40cd7a", "value": "258d8904ffa811ee13412ee318a1e43b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d503d72a-a7af-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647713417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713417, "uuid": "0350e439-d3f8-4ac2-a6f3-1254031c0823", "comment": "Malware payload (Mirai)", "value": "a67286fd44fb2d35913c5ff97ccb137b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713417, "uuid": "1b11160d-5c3c-444d-9810-49c7d56054f1", "comment": "Malware payload (Mirai)", "value": "b6c955ecbcd8209f4ac8258efcde762a54ef8292042c99b76586385e393eeb18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713417, "uuid": "5216d7dc-40d0-4e3e-83a9-f76398e06f9f", "comment": "Malware payload (Mirai)", "value": "90ef59658f7717350ea0069e0efede27db824773", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713417, "uuid": "3a565170-a51f-4b9b-bb1e-0ce95ba24cc0", "comment": "Malware payload (Mirai)", "value": "9c31d03c7dae9e89e282137b528697aa02cad6418e235d6ab81f35f927898f52cc4ff481fbc15253b0483544e48cbb06", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713417, "uuid": "066e8366-81ad-4e24-b862-c27d57c950a5", "value": "T116C3C63B67170E23C0CA50B101E34332AE75DF9B34B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713417, "uuid": "49652da6-4edb-48a8-b16e-45974c83325c", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqPNL7ymm/QMurB1nKGNb:SMQplVNamm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647713417, "uuid": "6d056776-395d-47e9-a68e-ce6b77a4173d", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647713417, "uuid": "28f1b4da-9627-431f-a76f-926c0b373b6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713417, "uuid": "9fd3fdb2-8ea7-4415-a5b0-f60400b1e9c3", "value": "a67286fd44fb2d35913c5ff97ccb137b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247f9a49-a7bd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647719134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719134, "uuid": "ebb336cc-0f70-4a8b-90ab-2da325aafba0", "comment": "Malware payload", "value": "ace6638ea857637c11cbcf9fa3f50581", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719134, "uuid": "5e7d2616-29ee-4ec2-93d2-c25844f6e7cf", "comment": "Malware payload", "value": "b712e4a5ddaef48bc9a5cff6e8112d46303a7e904bde4e1de150b3111852d84d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719134, "uuid": "931f7caf-3a32-47c9-98b8-cd28ba84ef11", "comment": "Malware payload", "value": "63b7a659f54135bf9f3e09fbcc8f07901c3ff0e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719134, "uuid": "32be1865-edda-43d4-b7eb-7a330268c926", "comment": "Malware payload", "value": "87335930b94b162b24c5600389329fe5f2e2b308d733bbbf1de198279f436655f0826101633925d4709f450902d1a60d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719134, "uuid": "06d7be47-73aa-41ae-ae51-c8e502f47646", "value": "T1F572F73DFB431C27C4D58974A1E7423CB6F9820FA8B54F2A3C620E59FE84D88A5576B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719134, "uuid": "69c07a38-4a79-45f3-bc1f-5cb58dad11a1", "value": "192:gys6GlSknyzPOu1XGpmuZVUCyu4P0eB6kd+D2rrPllTTTo0GB6QzMRjSTfhlk:DbGlznyz/UFFU+p6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647719134, "uuid": "a62ee7ba-4fd7-44c5-b484-d810c04495fd", "value": 17216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647719134, "uuid": "2fb5ad9b-aa38-45a1-bb48-63c5c147fba1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719134, "uuid": "498575c3-8796-4873-89ff-723d58f283d0", "value": "ace6638ea857637c11cbcf9fa3f50581", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db4aa74-a7a4-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1647708573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708573, "uuid": "80b367a9-cb7d-4c25-ad55-8a53557bc9f5", "comment": "Malware payload (Smoke Loader)", "value": "2fb0d6133668364007aaa4946c9b038a", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708573, "uuid": "80f94378-b4bd-4519-8a52-aa1bd8229f6b", "comment": "Malware payload (Smoke Loader)", "value": "b85ce2187c68ca501f79fbb72f710f7a15c2643846b956659319341c8e61a997", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708573, "uuid": "56d70b4d-acc6-4f5f-903a-06a3d52dcd53", "comment": "Malware payload (Smoke Loader)", "value": "9097c7282d770f02eb7732c4fb915d11a1122999", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708573, "uuid": "bab089f2-c270-45d1-93f8-f77ab46d6312", "comment": "Malware payload (Smoke Loader)", "value": "7396688bfac12ca4446fd9ebacda9806b17796c0701b8a1831684810dffbf500d3ec374d941346006384f028371d3196", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708573, "uuid": "52778f30-db14-4793-8eb9-b8a7b69ec510", "value": "T15234BF223A91C873C452A1706935C7B5AA3FB8325AB1C94777994B3DDF313C2E6B6306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708573, "uuid": "25b46c4a-0d70-4851-b327-3d5dfa88b00d", "value": "90ff780668c661ffef63d2b7c92679cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708573, "uuid": "d74de6e3-36c5-40b2-a059-11484e3e7c9a", "value": "3072:R2K5cJSdBUvgLL78pZZgbug5p+0TtdUwR5bY/hvw52B:4K5yYBUvoL78pngbDz+OTY5vwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708573, "uuid": "accbe010-52ba-427a-88cb-c4679feff0ed", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708573, "uuid": "37aabf54-f5d3-4746-980a-cd99b46fb970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708573, "uuid": "ead6380b-006c-4d60-88cf-66d6e2bac820", "value": "2fb0d6133668364007aaa4946c9b038a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6529ab-a7b2-11ec-9275-42010a9c0029", "comment": "Malware payload (Pony)", "timestamp": 1647714366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714366, "uuid": "5ba40826-66bd-492b-ae84-c4dcc0dc4f91", "comment": "Malware payload (Pony)", "value": "284db111743d51114b9783601cccc9a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714366, "uuid": "d8edf0c9-5b5f-4c7e-8ef6-b876c29c529c", "comment": "Malware payload (Pony)", "value": "b95cc7fcff0db3482364284d26cfe8e1f9d9ca49116973fc864e44cf847ea8cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714366, "uuid": "15674948-781c-4507-9b3b-a260b5796388", "comment": "Malware payload (Pony)", "value": "e556a25278d7dee920c23c85d68c22607faf1312", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647714366, "uuid": "5b293022-edc4-4505-8922-ebf3455a6f32", "comment": "Malware payload (Pony)", "value": "efa894056d216ffdd093605cb10a9a7dc2227d315729d16b3bca8688d7d25f311d7a3296bea54e4b9bb00a7cc45ec720", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647714366, "uuid": "bb68d690-4ad8-4a35-a75c-8f2bafb00002", "value": "T12724F18CF66070EEC867C83288646C65B301BC77E2374E16417B32A9D93DD9BDF146A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647714366, "uuid": "5d11b97e-e53f-4cea-9b79-47e12e1416da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647714366, "uuid": "92d8cf27-2ca7-4bc0-9cab-a07464704bda", "value": "6144:KBuDfmhhOEMo4znCZGhZQfTeJdb2SdiMu:KBugO/hoCQGd/AMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647714366, "uuid": "6114d044-586b-4627-969b-8f0896c00364", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647714366, "uuid": "cad0bdc6-96e8-45b4-a3eb-d5400fe67662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647714366, "uuid": "4dbe825f-f688-4aed-a93b-deda2db4de70", "value": "B95CC7FCFF0DB3482364284D26CFE8E1F9D9CA4911697.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d7b705-a7be-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647719730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719730, "uuid": "6ef68505-de12-4d80-9d61-3af0b205cb75", "comment": "Malware payload", "value": "d7534879e448252866d336f12ec90888", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719730, "uuid": "8cdd3bfa-8d79-4f4a-904e-dbd50f863a03", "comment": "Malware payload", "value": "b96582877f26378a392e5d66c922aaa58ea64a5228aebc49ec2d4c64b586a2d8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719730, "uuid": "60711011-e34e-4450-9a0e-2877b6f70ab0", "comment": "Malware payload", "value": "e2facccd84598b91cb07e4956e5fd0f2830d2fee", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719730, "uuid": "d037a6ed-d6e0-42e6-a90d-40d5e3593c2c", "comment": "Malware payload", "value": "64f6d4ce248640d9eee13fbb9f0cbf608bc63a8601e5caed0221428a6c739a04e6decf300b74db4c0545a8ab14eb076f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719730, "uuid": "f7915fbd-dc67-4b0f-8999-766684e3fb13", "value": "T1FDA423815322C6A757837318EE52EEE54680DDA0182837AC71E9D6DC476CBE25ECBF13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719730, "uuid": "092c2011-5905-4281-970a-aade213db050", "value": "12288:NOOfTxWUxZW2mwzIIGzawf6LNWBYEEL+Lon3ef+DhA7:NOOfTkYZx30ewf65WBYOofdA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647719730, "uuid": "c3e7c29a-186b-4052-9cd1-ea86085b5644", "value": 486791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647719730, "uuid": "0dfbc615-f8ed-4f59-8caa-d133458c9c9a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719730, "uuid": "d0b4d268-25b2-4d67-a6ba-08c502a220a8", "value": "Payment slip PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e71633-a741-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647665818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647665818, "uuid": "6ecadd4f-458d-414b-8963-0550ed242562", "comment": "Malware payload (RedLineStealer)", "value": "e1f80fcb18d3663e9a3bb2f79ca32ad7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647665818, "uuid": "8601ac70-87e5-4796-ad9d-38d688bb85fe", "comment": "Malware payload (RedLineStealer)", "value": "ba5f4ef06d9953d76083e7c6bc7d762cb9b667038f14a95021002708b73f65ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647665818, "uuid": "ed4ff35d-6a74-43a8-9634-6d156d76ad85", "comment": "Malware payload (RedLineStealer)", "value": "eb86fcc245529bb3fc82985140b72dd39b42020e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647665818, "uuid": "5379c7d2-53eb-494f-8eb5-cec52e978019", "comment": "Malware payload (RedLineStealer)", "value": "cf795fbd029d448cd2f7a7e413ecc9b32b185adf8be481e5d1806520271971ed64abcb6e5cb4971fc98257b9ddedf6c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647665818, "uuid": "08d87958-87d9-4229-b6a5-2491fb0b3d65", "value": "T1E67533FE9303EF25D60E01B41E43792508F629A6DC50FBC7BDE0264B9662E5BDE20947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647665818, "uuid": "3c414e20-252e-4911-a580-6137c66b7188", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647665818, "uuid": "b858256a-fac0-445e-8e5c-66a8ce1944a6", "value": "24576:45CZcpcQKF59jaxi5MSLp172ZWgZPaBRyLKxeCfkeW5FhaxY6FnMUNukEaHNYK3d:45CW6TF5ha05M+QZSrMhCsLMNCNa/PQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647665818, "uuid": "ee805018-fd05-48db-9f7a-99a931223eb5", "value": 1700352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647665818, "uuid": "2a0a6bdd-7ce3-4c32-846d-87913c77183a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647665818, "uuid": "37f8e807-7f8f-4613-9112-8a23894ac95a", "value": "19842970.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32cf47ee-a71e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647650868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650868, "uuid": "6680aab4-85aa-424e-998d-60835f9c0560", "comment": "Malware payload (Heodo)", "value": "27206841c0605d27f2a8a2cac88cfea3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650868, "uuid": "e8889644-a372-4772-a373-af5652b07fe2", "comment": "Malware payload (Heodo)", "value": "bb496af4c53da3644d7a6db3f7500207a26ef2076864dfab4efa4d2da88b0ffe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650868, "uuid": "f0f9c1f0-c3a8-47ab-a80e-8b5c421f7aca", "comment": "Malware payload (Heodo)", "value": "c21061d7b07b2057eb393ceffd934fbbd71919cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650868, "uuid": "dc7738ea-b6ea-4a8d-aa25-b68e33c6f94c", "comment": "Malware payload (Heodo)", "value": "eba4d82b310b558f138993f2b8b39cd9575f688f3383bf5c1d81624e3c25f37ef106bd73f930928be6dba63c76b07182", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650868, "uuid": "a593eb12-76e0-4c7b-be13-0457d30bd397", "value": "T159D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650868, "uuid": "72a65402-a661-4c97-80c2-eadc911805ca", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650868, "uuid": "797f1e56-9a85-4784-8c8d-d198d4c0072c", "value": "12288:UWBpwupxl0OeL/grxsGzO+r9AjCb/XKh:Psupxa/gP2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647650868, "uuid": "3b3e8a3a-8dd4-4dd2-8ff1-5229f5a69918", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647650868, "uuid": "2026ad97-b272-48da-8e9f-6c12af1f777e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650868, "uuid": "394a866c-88b2-4c61-89f2-a208710b503f", "value": "27206841c0605d27f2a8a2cac88cfea3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54805008-a743-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666816, "uuid": "dd12efd0-4d6a-437d-9a26-006ad6a55a3f", "comment": "Malware payload (RedLineStealer)", "value": "07f535f0ead4836552d5281e34a241cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666816, "uuid": "617780f5-9c21-4ef1-a787-237609404449", "comment": "Malware payload (RedLineStealer)", "value": "bbe7bea20ee9d7a2f66e58696f8f834aabfc65ce71558fc3db04c6bfee2bf6bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666816, "uuid": "98e8573b-a178-4be5-86cd-b47f3e3b6b62", "comment": "Malware payload (RedLineStealer)", "value": "3fa8e87a621c088c6d64d2ba3a64ce73d42da3b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666816, "uuid": "7a3f0846-3429-4fce-b97c-76ccedef614c", "comment": "Malware payload (RedLineStealer)", "value": "55a7c34d545309c74adffa0abaf1d906a852380a5b66da7356aacde6e963eef646b14306046ee37d39dc83ed80f8a2f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666816, "uuid": "ff2faa67-5dd3-4a54-a76f-633c802583df", "value": "T10E3633972DC160ACD3EF883ECA74750AF99E9EB6FF55F8515DF64E011806164E0221BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666816, "uuid": "c8a3dc3f-5f25-4b94-8a1e-c7381fadc07a", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666816, "uuid": "c4a60230-3099-4c63-af65-88f889311596", "value": "98304:jadOYEE9UAbaUhT4Q/DUc3DM+WReo11CEzCV3ZDq/qNn/DZy3C3VArQAiJ:jaRXptUcDbuec1/kRz/dACvAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666816, "uuid": "d1d995e2-7c79-47b2-b8ef-82195cb83626", "value": 4895232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666816, "uuid": "57fbe664-0fa9-40c2-a2a9-304a95d5ff31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666816, "uuid": "9d017978-074c-496d-8580-d213e45a9e7f", "value": "27024373.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9136812-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "20b237bf-aeca-4eb1-a4d7-2b663473367e", "comment": "Malware payload (Heodo)", "value": "9255de10797228c0e0d7f57eca673729", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "9945d919-4cf8-4f03-b65a-3e51f93af938", "comment": "Malware payload (Heodo)", "value": "be26f85c19595ec461d6142ff5e52beba65f196b3c8b13f57465579930d22d96", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "66b5bf5b-8a08-4c3f-a4b9-e8ddd33fff6e", "comment": "Malware payload (Heodo)", "value": "73d6c23b1a23a41453b56f75f183afd2714150e4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "f40117b1-3bdf-4cc5-9c8d-7d4634f9502d", "comment": "Malware payload (Heodo)", "value": "08e51b2366458054609c5d3eb3127fe8821cddb34902739c817500ccd4048ff019f5a075fe198b46dac468eb6987b7ae", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "d531a463-0645-4da7-aa22-8ebff2cbe18a", "value": "T161C47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "02a84e1f-9245-45e6-bbca-e14749645a68", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "2acf7072-259a-4ba8-abd8-1c64ff97bca5", "value": "12288:S54yM33d3q3Z7BogoreNmF+U/9JckIAGfUeb:SKh3831BoKN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648597, "uuid": "efe3512f-b4ab-4141-936d-06bf60f22fcb", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648597, "uuid": "16a82bed-e9f9-44de-a8c4-5dfb61d7e596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "b4b824cd-52b6-40d7-9511-b132a57f3f49", "value": "emotet_exe_e5_be26f85c19595ec461d6142ff5e52beba65f196b3c8b13f57465579930d22d96_2022-03-19__000952.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fb612e-a7a5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647709156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709156, "uuid": "4f06d1bf-72d5-4e04-b279-5ee2a5c44f73", "comment": "Malware payload", "value": "3ebd1a2b9db0e3419111ae065dce1b31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709156, "uuid": "094eee56-9d16-4fdb-83ba-3f6131465760", "comment": "Malware payload", "value": "be27934c7e49a992c57d36977b09107573dfabe80b6c90cbf2dc69dbc00c3723", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709156, "uuid": "08901429-3190-4a7d-938c-88863ff3e2f6", "comment": "Malware payload", "value": "6f4e7581ac920e42841c48c646f13c34b3039eda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647709156, "uuid": "7313d8c2-e261-462b-a8db-dbd164a99d2b", "comment": "Malware payload", "value": "3d6b2bc13246526f45a53ba673dcb212e6ac3e5132a5b9779ed267d19ead7ae9e11315b90ca85dc35a034d6a70c869fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709156, "uuid": "1fb47f0f-174a-4676-bc88-9490bfb9a070", "value": "T14BD523E0E754DD52D47E40B26CA4D031B6E6FCADA9D8074CD7E8A725A174932320CFBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709156, "uuid": "dc372606-72dc-4eff-a3a6-4b4f6ef5cbe1", "value": "c0adfe1e9d3803618765228287306305", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709156, "uuid": "1a318e84-a58c-431c-a4c1-5712000c1732", "value": "49152:2pi3KDPCxHtui8uCZOyXe9xZdizmhlMZuC3ipBpAEMclkONvcp:0inPuDZOyu9xZ+3GBpicl5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647709156, "uuid": "e1b680e0-d8c3-40d1-83fc-e9920298a2e7", "value": 2863375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647709156, "uuid": "8b44db2e-3cd1-42e8-9458-8e1557ea42c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647709156, "uuid": "15bd1c2e-9809-4124-8c99-abc04c6580c5", "value": "3ebd1a2b9db0e3419111ae065dce1b31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87524e6d-a7a9-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647710710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647710710, "uuid": "96ffd6a0-d239-4ee7-bc0a-3dcd596a95cc", "comment": "Malware payload (RaccoonStealer)", "value": "2831f3ca960dc4faf610e989f9fcfb21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647710710, "uuid": "e2e7beb4-3941-4373-807c-11e9ee9c62b4", "comment": "Malware payload (RaccoonStealer)", "value": "beb9d438539c349027b47e15fcb942d028ff8bf074bb7c68821352111366943c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647710710, "uuid": "54e5b9cd-8124-4bf8-bb78-4092a70c4d8f", "comment": "Malware payload (RaccoonStealer)", "value": "f6dd1557f711f902182390f681a5a2d93172af0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647710710, "uuid": "272bafc1-c5a4-4c66-aa09-1a13788bb65a", "comment": "Malware payload (RaccoonStealer)", "value": "29739ff74ae61e6fd225bf1181cd7291505f27b37926d1b04afb01b3c191ce828ce3d4b937143a1b9858dc5e4bd5b583", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647710710, "uuid": "f54ba77b-5c9b-49d0-b4c6-886d57c29320", "value": "T1CFE4F140BAA0D03DF1B352F87879E3AC752D39A25B2064CB62D16BEE1634AD4DDB5307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647710710, "uuid": "795cb94e-3b08-4453-ad0c-21ad7bf25d65", "value": "f1731ed7afe55cfc124203197b72d3ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647710710, "uuid": "9c97182f-8012-42eb-8057-06b3fdcfa5a6", "value": "12288:wfuvrUakzA/ml2enOUwO3TYacTkyMerR1aMXQk4XLp39x873CqRsyRNpWIw9InP:ZCUJnUTcacgyMg1aMgpVNOjCqRTR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647710710, "uuid": "ac4d9229-bcbb-40a0-a284-ffd6dc600faf", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647710710, "uuid": "6aafdbe7-2d63-45f5-acbd-d327decee426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647710710, "uuid": "0b62c0c0-8f2d-4066-ac5b-8ac3e56a2105", "value": "2831f3ca960dc4faf610e989f9fcfb21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e040d01-a71e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647650860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650860, "uuid": "196bcbc9-2b5a-447e-b2ee-c2330cea76f0", "comment": "Malware payload (Heodo)", "value": "f32e9115814ccb7a844b5033f2dd9ae9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650860, "uuid": "fd3b3b46-68d3-4291-8f2d-64f498ee7c5f", "comment": "Malware payload (Heodo)", "value": "befc30e7ce640f55ba5033081f0d2a7f362347a634e1cbeeb7bf35120c478be1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650860, "uuid": "ae040c82-59e7-40ef-8400-f49520797fa7", "comment": "Malware payload (Heodo)", "value": "5025c6ba273d2dba541c4578ed39f026951c07d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650860, "uuid": "d7f5ef17-5b0f-435a-b28e-2db2aeabfca4", "comment": "Malware payload (Heodo)", "value": "261e355b50e2ccfe7de080faffa681d116f18931346b8a76bcdf43ce5dcc2da57bf25a77683d57e373e658e3c3bbec6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650860, "uuid": "791c8dbf-6515-4912-9ccd-a19a9d7e618d", "value": "T161C47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650860, "uuid": "4cc2bd05-28bb-4771-8c73-1bbf615305b2", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650860, "uuid": "1ab1ae44-b71f-43c8-adc0-54579e992a5c", "value": "12288:S54yM33d3q3Z7BogdreNmF+U/9JckIAGfUeb:SKh3831BovN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647650860, "uuid": "7448761f-262d-4b65-9bbc-a5f2ad429d64", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647650860, "uuid": "cbf8c355-adb4-4c04-a657-a4369a9f9d8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650860, "uuid": "a3d99523-4e70-457b-a278-b8f0dcc91f30", "value": "f32e9115814ccb7a844b5033f2dd9ae9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5843230b-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666393, "uuid": "86482293-5076-4eea-9a83-19590bd36253", "comment": "Malware payload (RedLineStealer)", "value": "8fa81f3e0a6e0015be4c633c855f7778", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666393, "uuid": "a64746c9-0e95-4bd6-9d6f-9a9ea70a63bb", "comment": "Malware payload (RedLineStealer)", "value": "bf7cfd220d44eba42f39dc189cef99116ca1036f43a9324b9cc3f04bb7a19d6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666393, "uuid": "08c2d31b-e556-4c9d-acfa-8ac5250105a8", "comment": "Malware payload (RedLineStealer)", "value": "9c8820eb30ff6c54101f248b9d7a92c3191820ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666393, "uuid": "e1c206e7-a0f4-4e14-aabc-7b3ee4b32652", "comment": "Malware payload (RedLineStealer)", "value": "ff4efb9150953c01cbd001394e991da757cc60e2d784d8689e4895ddbb8156a9dbd5f0bec1bf8e10085d59d4e19f565c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666393, "uuid": "95b2f052-8a65-427e-a616-ff1a479eaea3", "value": "T1501633BFA5105275DB0F033C5E818F94FAE6494697004324EEB3197724A98B7B3A20FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666393, "uuid": "66225504-5a4d-4536-bb17-0911e229eeb8", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666393, "uuid": "79621cf7-a0ad-41b9-9f12-ae4ee0e662e6", "value": "98304:TeJzQG8T34Y+9nYzwRZncZQjtBIfsipZsqFl8IOpma5:TeJ8TIx+41j6fsip7FlCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666393, "uuid": "1d1ff8d6-0bbb-401e-962b-3f679895c641", "value": 4131840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666393, "uuid": "65c9d79f-86f7-48e5-814e-25dc09a60dfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666393, "uuid": "bd39c1a0-8b3d-44c8-8aa3-c98a0b8ed1c9", "value": "23294008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52fb922-a7af-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647713417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713417, "uuid": "b754f3d4-756e-4e9c-b0e0-6b4b2a19d76e", "comment": "Malware payload", "value": "6c46abf08ccbccc256bbd30899dacbf7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713417, "uuid": "1256f9c9-4b0b-40e4-ad00-afdafe388e4a", "comment": "Malware payload", "value": "bfc14168de343ff5ec11c03df95334234e2cc69868c665deb9af76e5551639ce", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713417, "uuid": "cee24d12-f652-4859-86f4-6ef9bfe4ab72", "comment": "Malware payload", "value": "6d5ee9273821e03b9becbea63d768597d3b381a5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713417, "uuid": "90676383-9ff7-4a07-8c5f-1ac03fcce7f9", "comment": "Malware payload", "value": "eb6e6a0170b59171cc19b8a0b58c8d7b9ac2a032229a5c8c9eb72dfa6c6e19ed57f647d61a6f19e66fd221c8e7b3ec06", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713417, "uuid": "abcc39fc-1e21-468f-b1fa-29ac7e822862", "value": "T1AE3339A5BD95870BC4C84173FE4F4289372ACEC4E0EAB3478A257F4126878E64F9F519", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713417, "uuid": "dd5564a5-1908-4551-875b-dade4d5eebc9", "value": "768:4BSDjijJ1j5boP9emfpEoijNHSgntjv7d8zNlUZyhkP7Tt12X:dD8Xj5bg9ELtFylUACPz2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647713417, "uuid": "7ae6b151-19c3-4f9a-aba2-743074f66158", "value": 51540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647713417, "uuid": "0a8df898-c92a-41fd-bd7d-f6d28e6c4cfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713417, "uuid": "5268d196-8163-4d47-b7cd-d2d2b669be45", "value": "arm-20220319-1810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6491961f-a7b5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647715805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715805, "uuid": "2b3a1a77-897e-4b39-bec0-2b9febda82e3", "comment": "Malware payload", "value": "f53ca2c4523901f567af489adf5f79dc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715805, "uuid": "c6ab9c6d-d448-4719-8060-3087375a4681", "comment": "Malware payload", "value": "c108c8aa3363901dfa35356629b3641a78cdca36573ae5800cf1b840744674bb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715805, "uuid": "e51b869e-0745-4fd1-af57-d5dfa3358880", "comment": "Malware payload", "value": "f7804d7cfe80d80aaaf4c0e8d92a0b2d31a211cf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715805, "uuid": "52f8de6e-5a28-4714-894e-8aec020c2daf", "comment": "Malware payload", "value": "9997e63352cab2b80773ed54f6f597f6d66636b57d748ffedbfebe1e35d5834349c2ef5cc5a69abff084f150e189c5f0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715805, "uuid": "f7eb0432-1a30-47f6-bcf7-8c6b451ddee7", "value": "T105233A44BD8BE574E88209F5E1AB5B22C779D6E42404DF7AC3BCD127AC814C09B8B67C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715805, "uuid": "9ab6f5ce-c61c-4a56-819b-4e2d65c87ab4", "value": "768:JYznAiky/GlAs91Weo9TzrgRYbhiG1vdZ6dSgX6:JYznAD3Lm9TzYYbhiqvdZitX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647715805, "uuid": "bb1feb48-1fc4-476c-9723-5d72ea0314bb", "value": 47660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647715805, "uuid": "81dc4325-7670-42c8-a4a0-687d1182eefa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715805, "uuid": "49a71fae-9b2d-4ffd-bfdd-6428c1f8b4d5", "value": "x86-20220319-1850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8eb2433-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "6a28659c-3d23-4917-bc4d-e6d49e279785", "comment": "Malware payload (Heodo)", "value": "136e81f24042001109aafed8df1588e3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "3005a3cd-3ea4-4148-b327-1ca27a87ebd1", "comment": "Malware payload (Heodo)", "value": "c229093173f4da8386dae86ce0c0f4c60af2f3cb7c3258729d52e2a178853138", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "f99b90e1-ad93-405f-9244-5b4973118ca5", "comment": "Malware payload (Heodo)", "value": "773b15cd5bdadecae0625b52561fa08c7bb9306c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "7b907091-3a9d-4c66-9113-99b353b40c54", "comment": "Malware payload (Heodo)", "value": "a71edf87ff03c9cccc14dd29128fa80cf2bf7e9beef153e64ed80b4dd96b47255e22cd60693f00710abddb05ffcbd49f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "7ff73335-8498-4520-a03e-9516309e1828", "value": "T125C47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "bd80da7e-9da2-4fe6-9971-69556763fc80", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "d056d8a5-4c2f-43c5-b089-ed8c57e4e200", "value": "12288:S54yM33d3q3Z7Bog7reNmF+U/9JckIAGfUeb:SKh3831BoBN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648597, "uuid": "fee286c4-598a-4c3b-aaf1-7935bb99f862", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648597, "uuid": "a3bc4d21-5132-4843-91f9-67733793b1c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "62b83515-7efa-4f2d-a2b2-65d010a93c71", "value": "emotet_exe_e5_c229093173f4da8386dae86ce0c0f4c60af2f3cb7c3258729d52e2a178853138_2022-03-19__000951.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9601a11a-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "25854931-0d59-43b7-a7f1-4054503cd33a", "comment": "Malware payload (Heodo)", "value": "616509b864801227af7bde8c0c6ff9f0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "301f5aa6-c5b1-4fdc-92c5-c3b616afd28d", "comment": "Malware payload (Heodo)", "value": "c2ddfd1eb3c8afada82d7986ac67969a396b499d3a91ed024b6e13451fc4f3d0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "20c455a5-8f63-43bf-b6d7-df3cc2c4f5e3", "comment": "Malware payload (Heodo)", "value": "5fbfbcd9ff4ab7e7374f22ad9ca1bd12c232b5ab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "39b3a379-4da2-4ab4-9e0d-e6135f34c62d", "comment": "Malware payload (Heodo)", "value": "2418e776176bc7a59b77edb45f604959c8108d6bbda83135c3566eb759244cf8178c350d51be87a27a7367677c2fd69e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "df3570aa-c4b0-4334-acd2-7eaed86ee879", "value": "T1C8D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "85292df5-066b-47d7-8801-f6534ecf9797", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "92675be1-aa4f-435e-be4c-5ce437b882cc", "value": "12288:UWBpwupxl0OeL/grxAGzO+r9AjCb/XKh:Psupxa/gr2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648457, "uuid": "841ebbd9-de15-4481-8d02-b7b52f75d29e", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648457, "uuid": "46127762-06ea-4477-b3ca-2929382b348a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "b381e7d3-4af6-445b-88b4-4b1d595f5cc6", "value": "emotet_exe_e4_c2ddfd1eb3c8afada82d7986ac67969a396b499d3a91ed024b6e13451fc4f3d0_2022-03-19__000731.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dac4f00-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666509, "uuid": "a680e36d-e914-4f2f-b20d-83b6b8b42bb9", "comment": "Malware payload (RedLineStealer)", "value": "b255faaeb6c1b6a5730f05678be7b7d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666509, "uuid": "8e06fdf6-9c98-4734-b0e9-fe6cf8da31ad", "comment": "Malware payload (RedLineStealer)", "value": "c37f2c927bb9fa4dbeae35bdb1083a539d7c588ad5d5d1340fcfb686ad653786", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666509, "uuid": "25068949-7a77-4772-ada5-da500f9a62d3", "comment": "Malware payload (RedLineStealer)", "value": "43ddc0040606e20bd56138720d183e0327eb2766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666509, "uuid": "f67e1de2-79db-417f-9615-ff9f16fbc228", "comment": "Malware payload (RedLineStealer)", "value": "22b9c0f9f450802a3722dc2d2114e55e157ffc0d8c1973a27461c58e55974054500298482b5e90a10f88cbb7e505d738", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666509, "uuid": "72081bfa-f28f-44e3-8658-e027e9a77ef7", "value": "T16CC423F252863DACD48B0376FF107B52967E111486C8E24FB79E4CB52C89A9EC9E46D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666509, "uuid": "6f1fc7a6-1988-419c-bcfb-c6d5cdcf0936", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666509, "uuid": "79533419-a14b-454c-8012-ef98a4e236e0", "value": "12288:oxhOkZxcoxCi9fVRvqQS03ULaHNqrxlKIQNoKKQEZrED/OKfd:2Ok/cFi/RvqkEaHNYK3XrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666509, "uuid": "1d77d227-4113-4136-ab89-d89d237c2aca", "value": 570880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666509, "uuid": "56bc7f2f-7f90-4292-9b0e-6cbbe7ff7dea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666509, "uuid": "9ee01021-5f0d-4d01-9a2b-d7ea85cff3ee", "value": "24030756.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e562bc-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666582, "uuid": "41edb7ce-c7aa-4def-80ec-75d1257e8793", "comment": "Malware payload (RedLineStealer)", "value": "396a3851018810d95411f83c810ebdb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666582, "uuid": "da00a368-6217-47e7-9754-fa16fae3e5bd", "comment": "Malware payload (RedLineStealer)", "value": "c479a5701f1a83d131c0e1bcc6d531716588ff2e0ce3597ba6af2e2789139106", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666582, "uuid": "352b5021-ed31-43a5-ab62-c132a60d0a4a", "comment": "Malware payload (RedLineStealer)", "value": "7b5d8468046965eac4c02cbbf930119836c826ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666582, "uuid": "172bc2ac-981d-4c69-b104-f7ce29d31ca0", "comment": "Malware payload (RedLineStealer)", "value": "11d10768c6768d52fceb231591e08db5b92cb6f78cfa79b89172de366d69f9fbdea896471d1255cf52a316fba2349d82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666582, "uuid": "3febf8c1-7734-4802-a79d-47bb9e69b631", "value": "T15C2633CA0315B028E0495232171E925FD83B56B8F8143937CAFADEC87ECB50A77795A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666582, "uuid": "f749609a-408d-4665-9bba-8d77399f495a", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666582, "uuid": "b8cd29af-2e9f-4d48-a726-1a6b75eb7583", "value": "98304:kHcQkXsYnUS5TSXlQixBb9eDz0Bf8wVwisu4HqEUF+C1lqpBtOp:kcQk8LKTUlQTYBEzislH++elqbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666582, "uuid": "7e2dcb22-be7f-4f16-b0dc-b03285d95c91", "value": 4530688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666582, "uuid": "97a145bc-a4c3-41c6-a7f9-a156fe81842c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666582, "uuid": "aa7fdb21-0b38-4f51-abd6-3965b913d4ba", "value": "24920962.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac22933-a7b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647716406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716406, "uuid": "2321fa46-e65f-4717-82db-c50d1c012d8c", "comment": "Malware payload", "value": "2a41f3dd51b62ecc89693c6b14409136", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716406, "uuid": "231407b9-cd82-431d-99fb-eaf2bf64f42a", "comment": "Malware payload", "value": "c7b5fb5b3d573f5b1818c4d10124f4226218e30af9a3095fa72568009a873ad8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716406, "uuid": "3982e8c8-1379-4579-bf13-8b90be566c93", "comment": "Malware payload", "value": "217d4ccfe5019f34df33d66e258a9bad01addc61", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716406, "uuid": "d0c6edb1-3681-4387-aafb-9a1d5332e3a9", "comment": "Malware payload", "value": "236f2791d0a7f7f42826606e92c84164125f149127f2bee87988232967fe95a4d3c87c64acb29830070e4e0fbc60cbe2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716406, "uuid": "20e04913-938e-4212-aa6b-8900278269a0", "value": "T1BC03E74AFD41AF01D4E531BAFE0E124973534B6CE3FE72119E215B2567CAA2B0F76806", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716406, "uuid": "33ea2d82-c334-4157-851e-cd8bfc6d444b", "value": "768:yln0ZydUWly06ibEs0NJKUIzbP7cgbtElweG:ylncydUWlv6iZ0GfTgbwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647716406, "uuid": "916f2f71-19e4-4320-ae6b-16870f1cfa1d", "value": 38808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647716406, "uuid": "81ade75b-ab1d-465a-86ed-33c4eb63947f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716406, "uuid": "8ce51af6-5ff2-4936-b9cd-088788d943ea", "value": "Y29kZWluZQ.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d19d69-a793-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647701371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647701371, "uuid": "0c9ecf64-29f4-4f62-b6a3-ab84b85638a2", "comment": "Malware payload (AgentTesla)", "value": "5a153c8ee2aa06936657e9e380a1b3fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647701371, "uuid": "7e0bc479-d8c7-48bc-a7b7-f7983089f3a0", "comment": "Malware payload (AgentTesla)", "value": "c7dae0a0bcb4f2986c44b1e75b8541f08c409f27fed4b0db11411a384ed3d0f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647701371, "uuid": "54d3cd01-d87c-4909-a750-26afcd947fed", "comment": "Malware payload (AgentTesla)", "value": "b41ec06d1484a5fdecd3772882dd21b93f317c79", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647701371, "uuid": "a3854c4d-f8b9-4ee9-8db2-1ae14222de42", "comment": "Malware payload (AgentTesla)", "value": "df2d1e8262b367fc8a511b8c6097cb904e740362b1d94d76c9c7de5897f6841102a5edd99b90a6c2c0c1480f322cdbde", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647701371, "uuid": "f341394e-aac2-49d4-900e-2bb048881415", "value": "T1AE9423EE0D485EB3B3EE74A882381F55A2C48A9522BF321F35CB5F51188BB4B7548C5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647701371, "uuid": "c4644d6a-321a-494d-9f3a-b322d504d683", "value": "6144:EUAljp4GtW3B9FnWU+1AdQJ42lrz/uUDlqLvZXDrURbwwath6sEbHPzQct4qpv8+:E5ps3tB+142BEstvXbHPzQm4Wv8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647701371, "uuid": "7af291c1-298d-499d-9a6e-c3af3f62dde7", "value": 436719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647701371, "uuid": "e1f69f28-ea42-4edb-a282-b55b359ac577", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647701371, "uuid": "c2dbf8d7-10b2-452f-a574-dcb25b721e47", "value": "invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef55c32-a743-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647666699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666699, "uuid": "8e978cb6-b358-4a66-97b3-333d3ef73bc0", "comment": "Malware payload (Heodo)", "value": "9aa5c42b9c145fc532cd50ca25af855b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666699, "uuid": "e2153228-ef94-4ec6-9d25-8d05ac1ef482", "comment": "Malware payload (Heodo)", "value": "c8b4c33fbc581f793c01238eb3755bdbb2336e2d700dcf3391b46fde4d1f5b36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666699, "uuid": "9130b419-fad9-400d-8503-3ecb42b10d5f", "comment": "Malware payload (Heodo)", "value": "1da37291ec4a88c2827d1d65bfe92225107ea36b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666699, "uuid": "4cbd5850-f37d-4809-aa1b-2def8bac863e", "comment": "Malware payload (Heodo)", "value": "b93937bb10593a7b27e64752998946865d8317bc56b3f74eada781dfcd8da08312ddbe1c9aaad57418f84284b6762860", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666699, "uuid": "bfadd1ae-0659-4add-b460-a853644bbfa4", "value": "T137C47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666699, "uuid": "a7b82654-ead4-4ee9-915c-617857d135d4", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666699, "uuid": "7d69e0aa-7006-4efe-9c6f-773a550eec55", "value": "12288:S54yM33d3q3Z7BogAreNmF+U/9JckIAGfUeb:SKh3831BoqN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666699, "uuid": "553382f1-944c-486b-9d00-18e90ab14185", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666699, "uuid": "f515995a-3c78-49b6-bbd2-8410a39cf0de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666699, "uuid": "7cac758a-66d7-426d-af99-ca82263695b6", "value": "9aa5c42b9c145fc532cd50ca25af855b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6513e80b-a772-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647687030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647687030, "uuid": "888161bb-7a89-4b17-99df-9f0f4c8abb89", "comment": "Malware payload (RedLineStealer)", "value": "c92820a2a9eff7543ada3d48147eea6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647687030, "uuid": "b0b597d7-75db-4302-a9fd-526a819e23ea", "comment": "Malware payload (RedLineStealer)", "value": "ca073d12918385962188c80d05b26317f391a0b5aef037ba84f9cf26c5ae3d8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647687030, "uuid": "1299a3ec-6d20-455a-9e60-cb12121af505", "comment": "Malware payload (RedLineStealer)", "value": "977aa7fd098f2f6ec9273ebb4c640b741229b784", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647687030, "uuid": "3e2c3b38-1243-4c38-a439-78d71394aab5", "comment": "Malware payload (RedLineStealer)", "value": "3ec6983409f9e5ab9fc2109cf938ae8e9beb112c90d8044f6947a7655e8dbb236f1b0a7fcfcc35a4bd518143049d22c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647687030, "uuid": "cc02c0b5-994c-48c6-ad88-3cff1ad37d8e", "value": "T14B94CF40BBA0D03DE5B706F87965D3B8B93E3DA15B2564CB62C26ADE16312E1DCB4307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647687030, "uuid": "fbf92529-022e-41dc-8dbd-36dce1060516", "value": "4afe698a4ff3f157978858a4a5de1db8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647687030, "uuid": "ef3c07aa-f0e2-43bb-9c0a-095f301b349d", "value": "6144:YgoCkgU7dHcbs+udtgRksV1SejfjLK38+57b1ojPYO7uCAi:noldHcbs+udtTkkfl1oDYO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647687030, "uuid": "05aa3ec3-c76d-4225-885e-b95dc3adbeee", "value": 409088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647687030, "uuid": "14b23151-0e4a-4aeb-8f3d-0466f0aaec7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647687030, "uuid": "da7a1375-4345-4108-bfda-ea0d5c3d558c", "value": "ca073d12918385962188c80d05b26317f391a0b5aef03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724e9090-a723-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647653122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653122, "uuid": "97378e05-f555-4211-b23c-2f5f9dc9f444", "comment": "Malware payload (Heodo)", "value": "501680a3935a91cfcd799a07d0ed8aba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653122, "uuid": "9e6f52d4-8de1-4e57-ae1c-c552edbffb19", "comment": "Malware payload (Heodo)", "value": "ca4ec143faab91902b131061e125e0d4c7dd25781966eab9c61fa4fafb56377b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653122, "uuid": "1390cfcb-ea20-4b65-8cc2-dc74d7c07cc0", "comment": "Malware payload (Heodo)", "value": "1a38cdf06fcce18fef0d845853ade349d7affb4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653122, "uuid": "53f0fe6e-9e63-42a5-8f40-8c40cf3851ed", "comment": "Malware payload (Heodo)", "value": "8e73a8e1bbd4bdef514d79558b34fe896fc434d855789ab29caae098771ca28c206fc1ec1b030869ad5e5e51df87ff93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653122, "uuid": "afbdad93-a77c-4ca5-9bfb-77e9eef69b45", "value": "T16FD45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653122, "uuid": "8ddc2f2d-f2de-41a2-a14e-f039d44b89e6", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653122, "uuid": "6b76f8e8-2d9b-4164-9a69-a53690ed803f", "value": "12288:UWBpwupxl0OeL/grxdGzO+r9AjCb/XKh:Psupxa/gA2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647653122, "uuid": "e685a951-0a24-4fff-9233-95b74c2d5154", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647653122, "uuid": "310ca850-fa6d-4216-951a-4fe08f4986a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653122, "uuid": "a7fe0f5a-7b42-4214-bf3d-e0d5279391a6", "value": "501680a3935a91cfcd799a07d0ed8aba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a797e8a-a7bd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647719225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719225, "uuid": "aeecd547-0269-4916-a17d-531f6c10d050", "comment": "Malware payload", "value": "31ff1168c4674f554a3986894151acc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719225, "uuid": "b1b4c1e6-f0f7-4b67-99ef-8c745af94b8c", "comment": "Malware payload", "value": "cc07de2422226a09d40f58de51b73f6870100beaea047042a40d3adf4395de4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719225, "uuid": "aad8f8a5-0068-498d-8dc9-508055c2c70f", "comment": "Malware payload", "value": "81214a996282a40bede4b8dbc0579d53b41999bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719225, "uuid": "8c2d6a77-0fa8-42c5-a10c-2dc27b512ccb", "comment": "Malware payload", "value": "39ab323737ab30c2f059fd2f21668d9e8daa7799ee6361f6744dae148c28762732796140f41e0f3e7e6537bf59a041ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719225, "uuid": "12f7dc02-e8ed-4c9f-8f4d-4c5e28e0aa40", "value": "T1B732C6A29D6D2F64E21DD1B475315B346723D416EA471FBA123A8E29C003ECCF64A3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719225, "uuid": "58202097-64ea-495c-a625-30acfa6faaf8", "value": "192:A/A/CkhBDHoj3srgeylv3DU/IdqB1p+a7PMa71cwj+jpk6/WQgFPAuPo/twD:AydgeR/CqBbtXPAmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647719225, "uuid": "13dd8621-29d0-42ac-9cd8-c9c4e6dd4073", "value": 11136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647719225, "uuid": "a20daaa9-ca44-4c10-a6f1-ceca636d0e18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719225, "uuid": "40112a73-5831-404a-b577-24b3da819505", "value": "31ff1168c4674f554a3986894151acc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9924d97-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1647666583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666583, "uuid": "5507f3a7-5ab3-492b-b69a-874d4bca4760", "comment": "Malware payload (DCRat)", "value": "8a4c682e2d26fd768a4ff0c993d753de", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666583, "uuid": "b14c074a-6c3a-4c50-bf77-f0063c916b51", "comment": "Malware payload (DCRat)", "value": "cd70a35b9ccc3fa14740927bbe242b3a2bc5a8790d88d01afccdfd7d83c9ca6a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666583, "uuid": "90e4ea6b-e62d-4b07-b040-6ee74d53a581", "comment": "Malware payload (DCRat)", "value": "edd12c792539306dd8d5bc34b0891367c5f02d7d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666583, "uuid": "468dfffd-bb36-40a9-830d-14d70d271a6a", "comment": "Malware payload (DCRat)", "value": "85421b9819f6134a457f8d90390ff607c0884f51dcf68df55f763e75d51780e0063ee83e7862607aab8fe118f0c0a9a2", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666583, "uuid": "b939412f-b616-4c48-a95a-e13c4269590c", "value": "T16515F6027A44DB01D0AA1637D6EF841443ACBD417B62EB1A7E6F33AD25A13B71D0E5CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666583, "uuid": "c8e5c90b-63d1-4c7d-b905-5520268cf7b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666583, "uuid": "e1fb392d-9517-4ee7-a977-26482190f27c", "value": "12288:u7IbbBqY8vkcsHFEu58IFNVBjsgxUUaj8i2Ni4tVN:DF0kdHFN58uVgUUP2Ni8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666583, "uuid": "e60a2fae-7b63-4849-a989-84991cde2506", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666583, "uuid": "b6054e65-f293-448d-9be3-ce941427ed05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666583, "uuid": "022393d1-9ad7-4c3d-b0d1-3b485d7be121", "value": "25171652.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c61b90-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "9213e351-7d75-4fb3-a632-29114f3201e2", "comment": "Malware payload (Heodo)", "value": "9ef22306511a4e270a26d3b00bb399e1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "f00c3551-066f-40f1-802f-238e918cf239", "comment": "Malware payload (Heodo)", "value": "cda7083c7c2261bb3ccec431f65718df72e33ed47190adb8c3f285f248c57157", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "21141ddf-d55e-4bab-b8d3-4348732ab415", "comment": "Malware payload (Heodo)", "value": "3dd41cc34b414782a87dfe6fb2338f02d71f16b2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "11232f8c-79bc-4bcb-8921-7d29df6c1977", "comment": "Malware payload (Heodo)", "value": "8c1e71c5ebf56272e2e16e25eea2bec4c2eb46d45c6f5948dd00c9e604abc00b722b6d39f12b6ff5b4a5e0403490b7a2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "69764b4c-6a15-46c3-81ed-07474aee7f13", "value": "T12DD45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "f4184067-3cdd-4e8f-b0f7-71eaf57798c8", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "9d9c25c2-bcbe-4b93-abe8-8c6b2146ae61", "value": "12288:UWBpwupxl0OeL/grxQGzO+r9AjCb/XKh:Psupxa/gv2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648457, "uuid": "89198ab3-8541-41a3-9d1a-44b99f7d8697", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648457, "uuid": "050b1f99-28ce-45f0-94c9-7ac5523e2df1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "4911fe89-6093-453e-b1b8-33c969143a94", "value": "emotet_exe_e4_cda7083c7c2261bb3ccec431f65718df72e33ed47190adb8c3f285f248c57157_2022-03-19__000730.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ce601d-a7a3-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647708323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708323, "uuid": "83973340-a443-4c20-a0bb-b8d9f86fe8e6", "comment": "Malware payload (SnakeKeylogger)", "value": "93c9c8889a5de33abde99929abf35cde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708323, "uuid": "b2938d62-8a7b-4a73-809e-7d47d3f47260", "comment": "Malware payload (SnakeKeylogger)", "value": "ce13d374ceb37878c9b5207d1f413b44e6f3debfad545111b9db53e7e3d271a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708323, "uuid": "6d867640-7c48-425e-b755-555aa30d98c1", "comment": "Malware payload (SnakeKeylogger)", "value": "65cfc2271a1bc8e9febe710c6dcd01f2f078f5bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708323, "uuid": "0a5d691e-339e-4164-a063-b5d5a75bf5dc", "comment": "Malware payload (SnakeKeylogger)", "value": "9497aefe6377e92241a9cc2814352ee84477cbbd0ee1a475679dad477a425f303e1a25463ba8b73b793655de10b3045f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708323, "uuid": "b4d7456d-c50e-4c47-bff9-f119f63d9817", "value": "T159F4AFE137618BE5F43A437484128667CF52BD7DD21FC0AA1442F91A4DBDB8318DAAC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708323, "uuid": "27b1b355-58a1-442a-b571-a6c1086964f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708323, "uuid": "6af55a30-a0c7-4826-a4b9-64aa6ac10541", "value": "12288:e4/l7vIP8uY/y8DiWdJM1iA9z1i/S9QkI8g0YKRbicLcVmvIpV40LQiE5vPt5idc:e4/lNUvg1drHYvK/YR3Y7YItcm3yd2O3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708323, "uuid": "7067c389-ab0d-4628-9f5d-a9ce16c16546", "value": 755712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708323, "uuid": "12818312-a659-4ac9-8256-b8f45752b02e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708323, "uuid": "d7043ef0-f4ba-4361-9e5a-bdd240ea2b6c", "value": "93c9c8889a5de33abde99929abf35cde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0cd6397-a729-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647655858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655858, "uuid": "0c149321-21a7-49a4-ac6c-5bb82c4de84d", "comment": "Malware payload (Heodo)", "value": "6a30e706c1e8c08a6e5e35a8b4b5c280", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655858, "uuid": "59aa4957-db9a-4eb1-8fc0-a2dccb59078a", "comment": "Malware payload (Heodo)", "value": "ce402463b4112bc8c9e132cb9fa7d0a43b9fab083915b15cff34981f78ba6e24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655858, "uuid": "3bd5dca1-7181-4927-8bb9-7b54085dc758", "comment": "Malware payload (Heodo)", "value": "55eb05ecac186bcb6e0b885f2c604e0f468217d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655858, "uuid": "88dfcbfd-90c1-4c3b-a845-207f307988f4", "comment": "Malware payload (Heodo)", "value": "04e9c7bcb56dfa152351ca6be240280382569f6a5b712b0f985fd2edb5624a8d6529850d00c0aef941d62bf3d2662a92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655858, "uuid": "b086605b-4e85-4262-a5ea-98516f1918e7", "value": "T19CC47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655858, "uuid": "c060ee93-e01a-4055-8098-2ac12d3b41fe", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655858, "uuid": "2d448d7d-bec4-4cbe-8d81-014e6a19e0c1", "value": "12288:S54yM33d3q3Z7BogjreNmF+U/9JckIAGfUeb:SKh3831BohN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647655858, "uuid": "5854336f-e0de-48a1-bf65-fc1e49ad1af7", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647655858, "uuid": "8ef679e0-6cc6-40f7-a43a-c64b5d3096fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655858, "uuid": "f290ce52-370f-4b40-8477-624deee1c93e", "value": "6a30e706c1e8c08a6e5e35a8b4b5c280", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3025bf06-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1647666325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666325, "uuid": "70c589ea-6141-4d27-bfdd-6f1fecbbda72", "comment": "Malware payload (QuasarRAT)", "value": "0971ffab949cd9dae4559c0c6948cafa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666325, "uuid": "8c5934fb-4db6-402d-a838-197d5c56c2dc", "comment": "Malware payload (QuasarRAT)", "value": "ce9d7ae378a21447db2a8d7637c1bc61b1e885c7e5def4c40c7a8c94cc1d5fd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666325, "uuid": "155a70ca-97b5-43a9-912b-875263376fd4", "comment": "Malware payload (QuasarRAT)", "value": "4a4aab53dfd3fc95e739ad3ec36acd68aeb9e002", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666325, "uuid": "bf8033b9-8da7-469a-a71a-b2ffbbf183d6", "comment": "Malware payload (QuasarRAT)", "value": "07bcde8e189511e09096e64f31f6c3f76200a5ed2cd541cf970a700626524c2642642543db1aba347de5955f1eafafe2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666325, "uuid": "0a043494-1223-4f00-8401-010c65229a14", "value": "T1F3B45B8123FC862BE1AE577DE87114259BF4F407A2A7EB4F4940B2E93C567429E407B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666325, "uuid": "4b0a5637-50bf-4cf3-87e7-a3fce110fcd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666325, "uuid": "a89868da-8bf9-447d-a37e-22c32543a3fb", "value": "6144:MTEgdc0Y8ebGbXOsA6j1RdhTHppW7v0/YtLGili3fUS1cEuOb8N95ogqq0uHEpc4:MTEgdfYyA67Hjv+G1ff+JAgLucd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666325, "uuid": "8c99f72a-6139-46dd-afc7-d6f9ef9dd8fb", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666325, "uuid": "3d18082c-0a9b-4c42-8b36-fe8355f4e89f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666325, "uuid": "5a3824fb-179a-43a5-ae9b-ddb36b647a13", "value": "22639639.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "504d9473-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666379, "uuid": "3980088c-c8f6-4a71-bb8e-9dacb50a9c2b", "comment": "Malware payload (RedLineStealer)", "value": "b398128048823aecb06076835d005d62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666379, "uuid": "c3624744-519d-4a23-a38a-6fed1b9a8986", "comment": "Malware payload (RedLineStealer)", "value": "ceaaa11843349aefcdcff93b5879d0a5c51238fe5ea5d45858628fd2d995fa1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666379, "uuid": "1dcbce53-84ea-4faf-9d09-bdf4c1869293", "comment": "Malware payload (RedLineStealer)", "value": "45de2efce914a48e2d1d972cf0337b3a67a0663e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666379, "uuid": "ac6de016-c33f-4a3e-bcb6-07850b04c0b1", "comment": "Malware payload (RedLineStealer)", "value": "a8280d9f1c1a739937bb99a1070dcf0d5352937403ba536f3cb4193fc997e0980537ef9bba4235805d8503fb1d34924f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666379, "uuid": "5461221f-cb3d-4590-ac3a-662b49a0bc46", "value": "T12385CFC63780F472D4EB70B5876B4BC81B356C13DD91D25A232DF92EE4B328AA41E19D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666379, "uuid": "2f24f83b-594f-4972-8649-ba5c3261675d", "value": "61ffae010ce8fc804af04adc26c6c926", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666379, "uuid": "bf2a8e06-c89b-42e7-87c1-e2dea4bbc6f8", "value": "24576:/JIvuBnXj2XxhIhu3/ga3gaKpeu8vOBaI4mZ1IuLVusXPcIlJmq:/omzGI04zvpeu8vOBzN1IkVu+1lX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666379, "uuid": "1fc5b9f7-0cf2-41d8-9f88-f60f1493e950", "value": 1723648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666379, "uuid": "4860773c-b78d-4b2a-b54f-ee74047fc355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666379, "uuid": "689909ca-1d88-4df6-8bca-4fc4335a6742", "value": "22954402.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c101510d-a7af-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647713384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713384, "uuid": "5444ae83-f046-495e-ba91-183244c372e7", "comment": "Malware payload (Mirai)", "value": "1073c0f5afe39952de35272155651fe9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713384, "uuid": "fd393f19-5d19-4e74-8493-d5a53913d9ff", "comment": "Malware payload (Mirai)", "value": "cf0b0345eed62d292a42064d481b1385ac4b9ef3d547db60b25682a768586d87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713384, "uuid": "2d0184f1-3214-4e1a-b4ab-8dc4ee3d35c5", "comment": "Malware payload (Mirai)", "value": "2bfbb02e30726a60d31e6ea7ee8a2d89efecf7b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713384, "uuid": "ad33a4a8-2ed9-4d3c-ade7-b953fbc0c6ca", "comment": "Malware payload (Mirai)", "value": "3d0b04cdfb7ef4413078fd52773d554122c9f908235f418927f323e060c0c3db56f4918f650c4e5c6bb67cee3a97aabd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713384, "uuid": "4fc5b81b-4b93-4524-94dc-ca100816ba75", "value": "T169C3F731E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713384, "uuid": "c95d285d-00a1-49ab-9c48-cbad5314f8d2", "value": "3072:6jVlyaL5JCrIpv04sabttiEiTmP46aQyfPlfKsNb:yoCJCN4sabHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647713384, "uuid": "a7305da8-d8a7-44a4-95e0-3676295f73aa", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647713384, "uuid": "738c469d-cf2a-4844-a7fa-667950b8ab58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713384, "uuid": "a461f778-d102-45d2-9e7c-ac8fac226db3", "value": "1073c0f5afe39952de35272155651fe9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2952b3e6-a7b1-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647713988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713988, "uuid": "7333dc66-abf4-457e-ae47-71f476a0b083", "comment": "Malware payload (Mirai)", "value": "67626575cefab031d9d17a0936e832ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713988, "uuid": "a7713e3d-0291-48eb-974d-178d8b5078c6", "comment": "Malware payload (Mirai)", "value": "cfee38ca2e6d990d09058299b5a965190e73dc238d9bebb55177140ef3a845a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713988, "uuid": "cba653d9-a1bb-448b-a132-c2bb210fb4b2", "comment": "Malware payload (Mirai)", "value": "35dbfab1945a5ff958ac21ddffa766de7bc7ff61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713988, "uuid": "34a605c5-6ede-4850-85b0-9f21eb458c55", "comment": "Malware payload (Mirai)", "value": "38c3037137575d5466bac67c0e9680bdbee49b2f56f1486aecc1e4bb3017f6411d0aa1d4506da57f12e014c218b5ffc9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713988, "uuid": "02b2873b-108d-4a45-babd-58e574028b90", "value": "T138B3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713988, "uuid": "e19fbb39-200d-42c0-b523-b476ddfe73aa", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZVoamm/QcuLB1niDNb:YuFX0GIk1MHyphSamm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647713988, "uuid": "6046bcba-28cf-48da-896c-03ca58353cc3", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647713988, "uuid": "5c0fcb89-e4e8-464d-941b-fc0fbcff918a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713988, "uuid": "9e25f889-32a0-4bbf-8871-d629f3691627", "value": "67626575cefab031d9d17a0936e832ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8edade41-a71b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647649734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647649734, "uuid": "fffd5533-9e04-42a8-a332-8f42e2581b52", "comment": "Malware payload (Heodo)", "value": "2eaa9c578416f76958d66664527d20bb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647649734, "uuid": "47fb0cb2-39e2-40b6-988f-de414c2a1345", "comment": "Malware payload (Heodo)", "value": "d23c23f7cd351f449433f9a61724ab54336d69c0cdf30762d7ad1b05a8c3cf0e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647649734, "uuid": "42a18b13-63cb-4264-a5bf-27a3aaa866e8", "comment": "Malware payload (Heodo)", "value": "5b2ae21a71420cb84b232884bc63ab0dcd442daa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647649734, "uuid": "371b8f46-1f64-4803-be61-b96ba48f3dd7", "comment": "Malware payload (Heodo)", "value": "2e7854f1ce57a06448237b9b121be2c3c3a42388d3588950b92953b2367a67a14716155023877d4babace49e74695f54", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647649734, "uuid": "6b5370ef-89c8-44ad-ba11-8ea94d7eef0c", "value": "T1E4F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647649734, "uuid": "f766069f-a8bc-44df-be1a-314c06d8968b", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647649734, "uuid": "73ab7579-e08a-430d-86d3-78fb76c7efda", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hH8rLneTfABCJoWRWwfpW:BeCCF88j+X68OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647649734, "uuid": "b28c6eb7-e93c-4f8e-b54b-a9cae3b512dc", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647649734, "uuid": "c9197e8e-3c99-4833-b439-65c400dda874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647649734, "uuid": "5a48d31d-07d0-4695-ba91-b82a52c4915e", "value": "emotet_exe_e5_d23c23f7cd351f449433f9a61724ab54336d69c0cdf30762d7ad1b05a8c3cf0e_2022-03-19__002849.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82540d82-a723-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647653149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653149, "uuid": "7ed849b6-4b61-41ca-8f7d-eeeffacb77bb", "comment": "Malware payload (Heodo)", "value": "20b2e28c47ceb9ac93c0ae8ee9339d85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653149, "uuid": "c620b86f-1855-47be-a102-e0cdc94a1816", "comment": "Malware payload (Heodo)", "value": "d2650a42f9c84af6c38b1c8e0e99fca6385e1e8a962820d5fba144be2fb1bd84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653149, "uuid": "694b8281-283b-4f92-adc5-092794f191dd", "comment": "Malware payload (Heodo)", "value": "69d68d03048019da176bcb8be70973826eeae832", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653149, "uuid": "508e84b6-c473-4cd6-8ade-322ba548a441", "comment": "Malware payload (Heodo)", "value": "036b4b9536290af3586534de80d533f89e4df7be5bb35e5097d56ceb95b09d3ba1552c948b1a9c5aa599ae2a6209ea42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653149, "uuid": "e0cd5a68-e130-48c3-872a-ecea26b90999", "value": "T10FC47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653149, "uuid": "e5d3abc6-0d81-4c13-9077-54dc2afa72b2", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653149, "uuid": "03426e0b-4151-4bb1-8997-16b8b25592ae", "value": "12288:S54yM33d3q3Z7BogKreNmF+U/9JckIAGfUeb:SKh3831Bo8N6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647653149, "uuid": "090c29d5-c6d1-46a3-928f-52029a944679", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647653149, "uuid": "517ef299-8246-4940-b3aa-91c85d5a4ab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653149, "uuid": "b78e2f25-49a1-4573-a9de-5044e7163cd9", "value": "20b2e28c47ceb9ac93c0ae8ee9339d85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cadbdbf2-a729-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647655848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655848, "uuid": "ee7419b3-8f80-44ea-adbf-d8c1466b2aea", "comment": "Malware payload (Heodo)", "value": "2ad6beafb407cf71989e25c96e4cc623", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655848, "uuid": "f19eebdf-5555-4621-afaf-ceebd7d7e626", "comment": "Malware payload (Heodo)", "value": "d55c4ddd77da04eaf38d16ba057a3c3cdd6097c6a3d20095922b15feddf398a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655848, "uuid": "c776fe66-147b-403d-9a11-efcc85a1d131", "comment": "Malware payload (Heodo)", "value": "940370545cd1228697edeaa0ee5caf5a019ffe6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655848, "uuid": "89cabe64-43ba-4478-b74a-c90ea176296f", "comment": "Malware payload (Heodo)", "value": "aed2edc3c55ac0c892ea513ed68c6cf76d76b69f1ab9eef33fa6e48fe333af9c6e8d26314dc7222926ffe0172ff96dc4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655848, "uuid": "8bc697fb-2b5a-4cf1-a277-25c12c6245b0", "value": "T156C47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655848, "uuid": "4535a809-d369-4c6b-a3f5-0785888d51cc", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655848, "uuid": "059e3d04-416b-42a4-8e7e-293443d0bf24", "value": "12288:S54yM33d3q3Z7BogQreNmF+U/9JckIAGfUeb:SKh3831BomN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647655848, "uuid": "35e73f02-c23c-44c4-a0f0-28029c639717", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647655848, "uuid": "23164bcf-b757-4d09-9687-f29e30976de3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655848, "uuid": "a127659d-0114-46f9-9f13-fc53b33a7bff", "value": "2ad6beafb407cf71989e25c96e4cc623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e852256e-a743-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647667064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667064, "uuid": "79f316fb-104b-4d6c-a539-c168cf931999", "comment": "Malware payload (RedLineStealer)", "value": "cf87b7df61d9f29d5a5de6795e968a85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667064, "uuid": "6e4dcc6c-d76f-4f76-be2c-2c152790b3a3", "comment": "Malware payload (RedLineStealer)", "value": "d5e7b3763bcbebd06d80e71d95af231e1e7badfe306a1408bc0eb23f1408cc6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667064, "uuid": "be246f84-6d50-4362-88a1-e2606bced3dc", "comment": "Malware payload (RedLineStealer)", "value": "e717b615fcd77248e5714014954a64ba5571472a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647667064, "uuid": "643e0554-4cf9-4f3b-8c4e-6f8f699ce8f1", "comment": "Malware payload (RedLineStealer)", "value": "35b5ce567adab872afe7ccde3949f2b4baabd2ae5060bb174db7ecc8bc77718116a5c2915215b8c95885bcef6f3a2df5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667064, "uuid": "5ce81b28-bdd2-40c3-9348-7bc5f4152139", "value": "T165B4943439FB9019F1B3AF75DAD879879B9EB7632607E85D208103874A03B82DD9153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667064, "uuid": "b983f55c-d0ec-445b-925c-a50878a7bdd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667064, "uuid": "de0b22d1-f43c-4e0c-8914-2396845cb6b9", "value": "6144:SenlkUzrNIUY2m6+d3NGgvFguX4Pvc801/Bh9L/v/ZpNuTjU/:SBF8+FNGgvFguOvc80dBhZ/vRpNufU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647667064, "uuid": "2ddafd26-6828-43a6-8f4a-2aaec6008295", "value": 496640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647667064, "uuid": "bfa425d7-29dd-4b31-a1c7-03d7612c7b6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647667064, "uuid": "73ea19ca-e486-494b-bab4-ff32d91e632e", "value": "28849169.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f59e60-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "2c93e7fe-3f3f-4230-826a-aa5de33bbefe", "comment": "Malware payload (Heodo)", "value": "9b7005c3a97a937d1645eb2222afffb8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "8599dfc1-7841-4c77-9295-49b67014d5ad", "comment": "Malware payload (Heodo)", "value": "d6044ac5bb8bdc5fe5f91f5e7b24c9cc83c5e992320859dd211ef5667ee1cd60", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "7c155fdc-6559-4a73-b018-1d574cfe9a07", "comment": "Malware payload (Heodo)", "value": "3e42b9b59c24b11d76d3cfc25089995b088965da", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "a9fd92de-89c0-4b3f-b6fc-c5a68fa4cde5", "comment": "Malware payload (Heodo)", "value": "8b8e7a007f5ef071e4a8bad8e80ff94242091d9ca0e85701272f2d517198682f92fbe8bb4c04c76bac3b9b6527682fc8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "76505faa-5292-45a4-b14e-63fda0a3e4db", "value": "T158D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "6ae06e87-13a5-4879-b12f-d3b1cdabd255", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "a4b1cc65-98ed-4ebf-bf70-6acbe4cab99d", "value": "12288:UWBpwupxl0OeL/grx2GzO+r9AjCb/XKh:Psupxa/gN2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648457, "uuid": "9810ae83-0e93-4b98-a20a-2742ab54b60f", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648457, "uuid": "ecba1eeb-c199-4b9b-af2b-860d4f320ff5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "9b242599-953d-41ff-a39c-b705f2389715", "value": "emotet_exe_e4_d6044ac5bb8bdc5fe5f91f5e7b24c9cc83c5e992320859dd211ef5667ee1cd60_2022-03-19__000730.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa59080-a77e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647692167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647692167, "uuid": "b10160b6-23e8-463a-b837-4cc9211fff66", "comment": "Malware payload (RedLineStealer)", "value": "caf6a69dfe5abc5af0d93efbc7338fd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647692167, "uuid": "ad3ca50e-e47d-43cf-bc01-2a40df1799cf", "comment": "Malware payload (RedLineStealer)", "value": "d61c2357e0c8c9f31ec671fbd0657ce5463a807ff5f9136e8859578f6c42e47b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647692167, "uuid": "10ed42e1-62d2-4b9c-b697-728bbcb908a7", "comment": "Malware payload (RedLineStealer)", "value": "5756ca78a6639b92ab289c08049222b7e6362d42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647692167, "uuid": "d8d56d33-cbcc-4c74-8ded-7c12880a4cc7", "comment": "Malware payload (RedLineStealer)", "value": "8218d8237bc30ccbf106b6c44634849df000b67197b4553ee6177df9d565c208cfbea5acbe1dd65961f1b1357fe8bfa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647692167, "uuid": "cdfaed63-f193-4901-b77c-c8905690d587", "value": "T1DE15492439FA501AB173EFAA8BE475DADA6FB7733B03645D109103864723A81DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647692167, "uuid": "76d29428-04df-429a-a70c-4c3fdfc98088", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647692167, "uuid": "eac3bd0e-1c58-4f53-8230-59e2e2626ba8", "value": "12288:Gme6vfIZOTp1XBV2dpbLRNnVN7MEydQ6/ljTDcwU8G46nDV/qII/fWWXAC/SCozY:XIFXExENfKUNfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647692167, "uuid": "7e867aaf-79eb-4a7d-95d7-d7cd472aec03", "value": 910336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647692167, "uuid": "e741db6d-e059-4f00-99d3-2dd17a05a21b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647692167, "uuid": "e0e2fce7-ade7-4a1e-9131-047c22ddd391", "value": "caf6a69dfe5abc5af0d93efbc7338fd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e27ddd-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "49a24ee7-8ba5-4696-8bcd-773cd40e3da3", "comment": "Malware payload (Heodo)", "value": "830e7afa04280cb77c1e6fb04f705a5e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "6cf6f75a-94b5-4687-b948-57e44c7cb2c8", "comment": "Malware payload (Heodo)", "value": "d8081ae6f3417a3a5ea4451ac73166aee85373b895a312304dff217ac463806f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "35a1e0d8-1c91-4746-8065-553f9855bbfb", "comment": "Malware payload (Heodo)", "value": "63e4684b559b707690fbe926125fc93302afe150", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648457, "uuid": "d8daa636-62f5-4b43-8a09-020baf3a8924", "comment": "Malware payload (Heodo)", "value": "78881c05f849cac77b0a6687909a7751a31af5e096bbb9cee19d369745bd5f78f0530ea54df11ac85e1dad73f083f1b5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "83dbb82b-ef31-49ec-9a52-ee0c20abc7c3", "value": "T106D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "5d22b8ee-03f2-4130-bd29-99c7572cf2c0", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "ca988bec-edd0-470d-8b36-b2e8320dd42a", "value": "12288:UWBpwupxl0OeL/grx6GzO+r9AjCb/XKh:Psupxa/gZ2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648457, "uuid": "0f41e742-e96b-4e14-80d8-fd29959d080b", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648457, "uuid": "b45f3d93-86a2-4380-9d96-7bb9d8239ef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648457, "uuid": "f613f7a8-4118-4fe0-b614-e77637fe688e", "value": "emotet_exe_e4_d8081ae6f3417a3a5ea4451ac73166aee85373b895a312304dff217ac463806f_2022-03-19__000729.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b8a453-a7b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647716369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716369, "uuid": "c342ee51-f111-40f4-ad8e-d053b4c04e6d", "comment": "Malware payload", "value": "cfa0e48b55770d868b4a568e2188ffc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716369, "uuid": "a9f852e2-8b13-499a-bf57-6a10f425a372", "comment": "Malware payload", "value": "d826eceac956006d45cd749d13230ccac7c6ab2cd081cfd8084c8d3885365653", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716369, "uuid": "91c6b32f-b517-4122-a0f4-de54717b68a2", "comment": "Malware payload", "value": "eb5b6b94d17af167236bfe36a8f21340a2006f94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716369, "uuid": "c89df8c9-4a0a-4567-b15e-6f78c0969392", "comment": "Malware payload", "value": "c827203e38ff8337a963c921337a3bfc28fb968607924246c5ea7d5ae5827b777c1d2305144469e8227a6777891410f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716369, "uuid": "8c2c931a-bd26-4207-9b64-343de7a9ed23", "value": "T1EDD4F7BD756872AFCC77C0728A581C28F650A4FB671B4917A55307998D0F8CBEF840BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716369, "uuid": "425e4110-7996-4ccb-8d59-6557ec0dd75b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716369, "uuid": "09c3d9f0-58b7-4437-9940-f2f1898f6c53", "value": "12288:HqCNtBiqGItssaB/suUP8kt9XtpH/rF8sl4UlYoXbo+SZSDaeI0xdFK:HqC9l4snDWWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647716369, "uuid": "22aa11bd-319e-4847-92a3-adae28773cb1", "value": 654336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647716369, "uuid": "45c0ae9c-8762-4c58-b733-91fbb85defa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716369, "uuid": "9dbbcad7-f08d-4f90-82e1-c351747f3f3b", "value": "20220317143046766.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3cb830-a7bd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647719204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719204, "uuid": "3fe0dfea-4df1-425d-9199-8a00b8849bae", "comment": "Malware payload", "value": "89c4b2d25e8f2b1f2f93bf615bf89062", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719204, "uuid": "a205ad98-5d02-44ff-ba68-f56644b65ff3", "comment": "Malware payload", "value": "da15889f00d13933936ca08ead3acfbb2f26624f3194f990a3083d2101ea81c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719204, "uuid": "7c8b3b49-7a46-4e68-a6a6-a2fd7400f6a4", "comment": "Malware payload", "value": "54474d4a370ea97c1b377f272db0f087f64aa875", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719204, "uuid": "262bf692-e763-4630-b0b2-1015cf732114", "comment": "Malware payload", "value": "b7b8761d0fd0927523fc9b18d75658a58db9fe7a40f1d87d00677e5f8d825bcdcde4b4ad47f8dbd26439cdecb16aa1c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719204, "uuid": "0590335a-7337-45c5-95b8-60a630082ae0", "value": "T1B1724209EB958F7BDC7FDD7745BC0B4131CD904B12B52B6A2274D428B21F94A4AE3C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719204, "uuid": "ba47add9-1590-402f-8722-795f96de03cc", "value": "384:QPFlwsMFJSrXi5mFei/KeQDImLX0pqyV:QPfWFJYXi8Fei/KeQSpLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647719204, "uuid": "8f838d68-164b-418f-9535-7bd73a0e1327", "value": 16212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647719204, "uuid": "4d6aa2dd-a207-4c5e-921b-f3838ed4128f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719204, "uuid": "3c0db75e-1906-4114-ac47-a4cb28d9c132", "value": "89c4b2d25e8f2b1f2f93bf615bf89062", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba9a628-a77e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647692276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647692276, "uuid": "045bd7e5-fb38-4274-9ccd-a5e2560ac272", "comment": "Malware payload (AgentTesla)", "value": "2a7c6fa10a7d622106133a93c811bdc8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647692276, "uuid": "196195a0-0cfa-495e-8e98-740e6421da93", "comment": "Malware payload (AgentTesla)", "value": "dd6a56ae92a5fbef92236778f5be86027ca6cd2c3894d9bad9572bd19208df77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647692276, "uuid": "c5d53246-30bd-44bd-b595-8c24f97ceb36", "comment": "Malware payload (AgentTesla)", "value": "76138e06fa31d69084eb5fa902abfb7c3bc26a0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647692276, "uuid": "4b91a61c-8044-4a0d-8028-b9418aa5fadd", "comment": "Malware payload (AgentTesla)", "value": "c4439b7fca58ec74f8fe4815c725248d9cd19177e191db043c2ac5bebca0230da4cf9e011979b8ed64f21a057c6c810a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647692276, "uuid": "7a763ace-5545-47be-a9c9-a03c9e33a1db", "value": "T12455332E5DE39A43720B99FEE59D2B2427CD4400971D7F4BD2465F3EC14822ED99B2C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647692276, "uuid": "fcc9b0fa-e121-42b4-b23c-1b5367ce7e55", "value": "24576:h3yK2tdEcNmlE+uzaKNwIpuJvkZf1FwfvcRN26ef2xkcLKW7H:SdEcwEr5weZf1FKkRaC57H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647692276, "uuid": "f24945e4-d262-45ef-b330-bef806752ae2", "value": 1281707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647692276, "uuid": "1207ae96-a447-4b9e-aa30-aa8d7b33726c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647692276, "uuid": "2727dc3f-123e-44ef-b393-2f12adf8d625", "value": "PURCHASE ORDER (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88f3a35-a7c6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647723221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647723221, "uuid": "2c39c91a-d862-4ccc-b599-11f4ac267f98", "comment": "Malware payload (AgentTesla)", "value": "c9f660246dec9b135cebd4fb70898687", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647723221, "uuid": "e2717d58-59cf-4421-aa27-e06179e36d5b", "comment": "Malware payload (AgentTesla)", "value": "ddaff71724aabbf39d9a556be6956f337f3218241c97f686f666e3ae281aeda5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647723221, "uuid": "b6a339a5-ddd7-43b5-b56f-2cbb4d432372", "comment": "Malware payload (AgentTesla)", "value": "f440caf14c9fe71748c43e4e37227aacabc1e68d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647723221, "uuid": "acf89355-fd4d-437e-9daa-31e76792cc4c", "comment": "Malware payload (AgentTesla)", "value": "04af5bd1275c1b12c0e3680d9a6c2f5bec43637497dd9c7d754a765b13fa9120f3ae433d38677570fea3c6d83fd980f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647723221, "uuid": "64045758-5c61-488a-9cbb-6db09e20f977", "value": "T12834B64334808598DE7D95F7B20785A833879CBED648A7096BD873935FF36A24832B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647723221, "uuid": "592d51ef-9244-4979-a6bc-95a6ed4aeb5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647723221, "uuid": "ffb1ab10-12dd-487a-9188-31e66bab4fd5", "value": "3072:V4ny+pU/hOTmRBMzSkGKD6M4JkblX4pYht8haqKno1O:Wyr/ATmRBM1J4yb5Hht88qKo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647723221, "uuid": "a4a33ee3-cdc6-40ac-a29e-9cfd1e22e471", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647723221, "uuid": "4d6d3447-d289-47a7-bd31-ecdfdc168e4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647723221, "uuid": "b8417147-dcf9-40c8-a80a-7c58b10a2f7f", "value": "Inquiries_55MT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cdcb4ba-a723-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647653140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653140, "uuid": "90dfd44b-0bfa-4162-bdf9-053d4ae82dfc", "comment": "Malware payload (Heodo)", "value": "894499b6755ebebc8ca270eae6970d79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653140, "uuid": "a248986c-0982-45b1-bdd7-80801368563a", "comment": "Malware payload (Heodo)", "value": "de950c66267fe62285ae0e69e05586604a09fc63011cb3fd713dad09e9fd7172", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653140, "uuid": "8170e817-fa81-45ff-be31-9e363b62d0af", "comment": "Malware payload (Heodo)", "value": "9347befe94b41305b3f70375b380db96fcd1ef56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653140, "uuid": "617b6b1c-78fc-4c73-97ca-7e46639d4f6a", "comment": "Malware payload (Heodo)", "value": "c1aa2b859ef3c67c7ef3ca111007b2a87da2f7e7b3eef5b39510cecce5e07af3942064e281961ac356436bafe41b17a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653140, "uuid": "6e4b135a-b6ef-4948-ad41-f6221dc47bef", "value": "T1FBD45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653140, "uuid": "c093d5e5-ade3-4900-8e23-78be39f45f1e", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653140, "uuid": "cbaacceb-76e9-42aa-a03a-ecb8d4713748", "value": "12288:UWBpwupxl0OeL/grxjGzO+r9AjCb/XKh:Psupxa/gW2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647653140, "uuid": "e763ba7c-800e-42b6-b635-2913de0916d7", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647653140, "uuid": "fa1cae93-5785-4510-a7c2-ac204f1e757e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653140, "uuid": "b084d609-dbe3-4865-aee8-51d0bd0b364b", "value": "894499b6755ebebc8ca270eae6970d79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85c086b-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648596, "uuid": "8b1d2b03-5e73-4838-9777-02085f4205c7", "comment": "Malware payload (Heodo)", "value": "6d42d7c755d1282ed33498f59c8cfea3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648596, "uuid": "821f59be-38ca-4c02-97c5-3a6e42b8c84e", "comment": "Malware payload (Heodo)", "value": "e43d1a25133c7113dd30055426908cf8493344627ad11bed2a9fd7ad9a55fad6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648596, "uuid": "2ada2cd8-231e-4e31-83f3-3537fa80583e", "comment": "Malware payload (Heodo)", "value": "3960d0569ba7f3d61ef526bcf82ae9750e853436", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648596, "uuid": "3b0bd7bd-787b-4eff-ac24-b40381a17f60", "comment": "Malware payload (Heodo)", "value": "6b43a8efce9beaa20c36956221b5173409e20be9789c2e56917a7e910df410ad0d376ad1a9bb92e3c9b3375d2c489111", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648596, "uuid": "ee52f3f7-f7dd-48f8-a2a0-ead0f672d883", "value": "T18BC47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648596, "uuid": "fcb068e6-0578-4792-b577-2df03c97ac36", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648596, "uuid": "3ba10c3d-1c27-41fc-a1a5-2577ed6cdbe8", "value": "12288:S54yM33d3q3Z7BogPreNmF+U/9JckIAGfUeb:SKh3831BopN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648596, "uuid": "c04494d7-0bbf-4316-a28f-8acd2ca3ea2b", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648596, "uuid": "654a91d3-ce62-4448-a427-2adf09d64970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648596, "uuid": "ae32eeaa-d464-4bec-96fd-4906a5a6b972", "value": "emotet_exe_e5_e43d1a25133c7113dd30055426908cf8493344627ad11bed2a9fd7ad9a55fad6_2022-03-19__000950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd37919-a7a4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647708436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708436, "uuid": "a80ce3ca-947e-4e08-ad12-c33d87f83bb4", "comment": "Malware payload (Heodo)", "value": "5a070eaefee840cc78619011227845ef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708436, "uuid": "79937099-b23e-43f4-8473-806ff0249927", "comment": "Malware payload (Heodo)", "value": "e5172460b0967c53f5b0bb75635b13b5134cedeebe90ccb00e3d26feca49cd23", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708436, "uuid": "b97c995a-c2bd-4d63-8965-0412de0ea519", "comment": "Malware payload (Heodo)", "value": "a6fc2075e988602d1e33f6d83d6577f8f2ecc3f8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708436, "uuid": "f7465a69-4844-4de9-82ac-fb8174b1c654", "comment": "Malware payload (Heodo)", "value": "8d5036595bed2046bbf7518866eae4c965d5f29235b23f9fb7e31af5fdeeba0f130aa9f9dd102c166149b6a11f775be5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708436, "uuid": "a6b3a69b-fe14-4898-85e9-b8de3d80cc55", "value": "T151057D22B9C19172E25F13B629D8DEEC33AE5A3107D1C1DF5AB41ABD3E729E15630603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708436, "uuid": "8131fb38-1d5a-484a-887d-2ccb4031cec1", "value": "810544f6d1cfc4b1abda96d46e502763", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708436, "uuid": "c38c498b-52dd-4653-a7dc-b59947c321d2", "value": "12288:78u2rsRwkKeb6hsHN36rXeL09CTZ5X2w7RU3zaEq366QkkOYaPG8Lik:x206S49CTaw7MaEq3XxkOYaTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708436, "uuid": "2d032fbc-bca1-49d4-9360-29510d2accbc", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708436, "uuid": "cd35a984-1063-454a-92ad-d21bfea0cd0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708436, "uuid": "0d7b0edf-13e9-4f3a-9eb2-d7d21616f0a8", "value": "emotet_exe_e4_e5172460b0967c53f5b0bb75635b13b5134cedeebe90ccb00e3d26feca49cd23_2022-03-19__164710.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760f5fbf-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666443, "uuid": "6d5fc2c4-e336-40b5-9db3-e38588968bcd", "comment": "Malware payload (RedLineStealer)", "value": "dd8935cf766ddc71e7a84675699cc5d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666443, "uuid": "3838aab2-b8fb-44fb-ab62-3b10b1d59c8c", "comment": "Malware payload (RedLineStealer)", "value": "e518fe03987c289ca0cb3709f3ad45ced8b766baa8a100536e588f67d3431996", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666443, "uuid": "35b70134-7140-438c-a40e-e29ba9c449f5", "comment": "Malware payload (RedLineStealer)", "value": "0697e76bffad55891e51af21e44bb6940d70e069", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666443, "uuid": "4cba35e1-7598-4df3-b82a-5ca36c094ebe", "comment": "Malware payload (RedLineStealer)", "value": "1184534d5c33d0872f1d7e2934d7b8206ea59b15ed8be2464ee76208a5f3123e3702879cf39a8c9c799be19aca884e3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666443, "uuid": "13642061-b484-4584-b793-f9dd557ca32a", "value": "T1DBC423FA9749BEC0C78C45B61737B07BAFA55EA458FC2902F2924B0D6C951D2C70B609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666443, "uuid": "a323ca2d-7359-4311-a4f6-f2e94966de0c", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666443, "uuid": "2407eb52-a601-4d2a-8ff9-a2ba3a4d72bc", "value": "12288:JMfR7mqt8eewToFhGsly8MQS03ULaHNqrxlKIQNo+CMQ3IyOs4br:JO9t2wTpsxMkEaHNYK3hyobr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666443, "uuid": "615d2062-fdab-4447-98ae-c97901fa7aa7", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666443, "uuid": "a54756fa-ab21-4971-bbf2-6ffae8038e6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666443, "uuid": "b1ae47cd-5b22-4f30-940f-6e61d9a36b06", "value": "23791770.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0eb55b-a729-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647655873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655873, "uuid": "ee048a05-bbe6-4a16-8d66-36e9d566aa35", "comment": "Malware payload (Heodo)", "value": "0f1440652e5f0296da5c43df489df428", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655873, "uuid": "c4ad07ec-c37a-466b-b1e2-d2add100222b", "comment": "Malware payload (Heodo)", "value": "e5e46b3c69f519768dd3a18f5d44501cc3fd52736ea44da1cd2265c5852e53da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655873, "uuid": "80721ee4-e7f2-43c4-8e6a-34f0c10b74a9", "comment": "Malware payload (Heodo)", "value": "9da73a7ac0996ea007fe44e119e2a0bbca710b44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647655873, "uuid": "3605ea28-f3ab-493e-90d7-5dad677082d0", "comment": "Malware payload (Heodo)", "value": "1c3071067003559a4815ed02e3ab7415420db10a237f67e9b3b918a5c16fb4452d2e554fbf3734b177e56019de96bdc9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655873, "uuid": "1ce7c3ad-c5f2-4c20-b9cb-6cbf21bcb83b", "value": "T17CC47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655873, "uuid": "7f179ec2-6d5f-4de6-ae0d-b44cc2f30057", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655873, "uuid": "eae3fa95-486f-4d29-9594-05aaa7622e0b", "value": "12288:S54yM33d3q3Z7BogsreNmF+U/9JckIAGfUeb:SKh3831BoeN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647655873, "uuid": "e390fd3b-80ab-4d87-b1c5-a2b5c055ef9c", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647655873, "uuid": "07d14a98-37be-4dda-9f99-6283a8404f1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647655873, "uuid": "1967cf7d-2525-4227-91df-06e9eb704ef6", "value": "0f1440652e5f0296da5c43df489df428", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a1fe1f-a7af-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647713410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713410, "uuid": "760b9714-c258-4569-b67f-5811ba808061", "comment": "Malware payload", "value": "75af472f18d1b436b35c4785649dd411", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713410, "uuid": "c2d147cb-befa-4fec-acaa-2522c42eee53", "comment": "Malware payload", "value": "e61a6d0b34f64f27c2a5efc5537b5140f281ace835248a70ed24b9465ee7440e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713410, "uuid": "ca8c4225-dab9-481c-b59c-abe9d0daebf0", "comment": "Malware payload", "value": "51506df9a4719ba7028505befecec9f6955f0df4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713410, "uuid": "3e17be91-d557-48e2-819b-5a30f5bbf37e", "comment": "Malware payload", "value": "307c64b8272ba4c82d83867801451521c747aa821e1f6edc860054811355302f65d1864397760d12ddfd4253ff007132", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713410, "uuid": "ffc2cea9-95e6-474a-8418-b1143f2dcce4", "value": "T1AE53E907BF654DE3D86BDC3B4DAA2F0528DCD18725547BBA6A34D028B24A14B0DF3978", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713410, "uuid": "e9765e48-c40c-46c8-a3fd-cc4d32f9e6e4", "value": "1536:EJE0BknKvVVFtW+QwZA0+gBlUAJpKevB:YGiywRlUAJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647713410, "uuid": "0d3b8b6a-ced0-4239-80fa-8ce26a586483", "value": 64956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647713410, "uuid": "a8b5b0a2-4ee8-4873-b6dd-e57266f6f4c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713410, "uuid": "434706d3-bf77-47fa-b6c6-8a036c5b6001", "value": "mpsl-20220319-1810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9927d2f7-a7a4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647708592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708592, "uuid": "93d156de-4a54-4cbe-b728-27189b90068f", "comment": "Malware payload", "value": "9ffda38da9799981c14b3d3e25692416", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708592, "uuid": "41ebf04f-3b10-4c05-a939-64e52b30bf80", "comment": "Malware payload", "value": "e68709e57a75e81ed749f70bea9be2815cb7c41fda90a14567927fab472efc03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708592, "uuid": "bab03b6a-1b4c-4899-9ac4-f53b2de43d06", "comment": "Malware payload", "value": "3d8959fe04d9e6d205118de07e0ca84bae7068c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708592, "uuid": "78b7d02d-f577-4904-92b9-b98c245fc838", "comment": "Malware payload", "value": "9fa8be750121a146a505baeccbbdac988fa0b8d1bfe89d3284e28163da6f180a1805ef0c4fd8167c33c7504835d15f4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708592, "uuid": "f389f9cd-69e1-49d2-8c08-5cb00e9c6e8b", "value": "T141351250B790D038E0B752B87936D3ACB53E7DB0AB2054CB22E26ADE56357E4DCB5306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708592, "uuid": "9b9e1d8d-dd0b-4064-8f0d-7773f9201d0a", "value": "4afe698a4ff3f157978858a4a5de1db8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708592, "uuid": "d5d4c164-ddf3-4043-bee4-4ae2e36a8fb4", "value": "24576:DOEXelKmEZWLTuSvcAbep6AOK80g8/gc6W8ceysBzLjgcfIZ1Pm:1ZaTusbep60Yc2cey4fjgcfGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708592, "uuid": "6583fcd2-85ee-44c4-8517-794df5d0cf0a", "value": 1138176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708592, "uuid": "f7086939-0664-45bd-af81-90e5beb78cb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708592, "uuid": "a0f8c6a7-bd10-4887-aa14-148244c3dc1d", "value": "9ffda38da9799981c14b3d3e25692416.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8407c0-a71e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647650805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650805, "uuid": "84d24bea-936d-465a-b8f4-c461bf468284", "comment": "Malware payload (Heodo)", "value": "63cf0747fd8ed998dad595a7fd4963fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650805, "uuid": "e0fb2207-e1cf-4379-a008-aa4761b3725d", "comment": "Malware payload (Heodo)", "value": "e6d5bd523ea0c9250a8c4198045b237a725064365e9f91499866efccb896af80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650805, "uuid": "73cd1b03-0ee4-429a-9425-764f310de217", "comment": "Malware payload (Heodo)", "value": "e4790d3e0b7285297d5b59fc538ca450edd50231", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650805, "uuid": "04069eb4-54cd-482a-8070-08b7588d4588", "comment": "Malware payload (Heodo)", "value": "0a3f62c7821ac37419fabbc7b5402c97ac5b9a4643505b2608645521539ca5fbfcc7271eff94fc0436c80516f0fc3fc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650805, "uuid": "ddfcad80-5e98-4792-9a10-8bccd4505905", "value": "T128D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650805, "uuid": "385c9fc3-ae3a-4d5d-a5bb-c4aa913e0f51", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650805, "uuid": "637641e3-64d5-41e6-b85e-9a8ead30fc7b", "value": "12288:UWBpwupxl0OeL/grxkGzO+r9AjCb/XKh:Psupxa/gn2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647650805, "uuid": "360dd02b-57d0-4009-8491-8c58de5ac518", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647650805, "uuid": "922d8fd3-f75b-44c3-8b6f-2aefbf9b3dfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650805, "uuid": "cbb98b5f-a68c-40fb-b87e-cd9f2d930bd1", "value": "63cf0747fd8ed998dad595a7fd4963fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68748c7-a7b4-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1647715567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715567, "uuid": "7892ad6f-3054-4dbb-b305-53720cded0ab", "comment": "Malware payload (AZORult)", "value": "5290d231f79a2264cc34151cd322a222", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715567, "uuid": "575ed48c-c13f-4fa6-8c83-6cf9ee55b02b", "comment": "Malware payload (AZORult)", "value": "e78cff004d64769a1e80583ec0d0e7fe18b4ef35ba3748e01f1771ee5daa711b", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715567, "uuid": "0cc03f35-f95d-420c-8d87-89b996f90608", "comment": "Malware payload (AZORult)", "value": "93f55e75a365d9bd1a9760d34ac6098b54b397e4", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715567, "uuid": "42e8560b-c0ab-4452-8f48-18d4acd5bec2", "comment": "Malware payload (AZORult)", "value": "289436f75ed999d3b2b49b1d525e9382bef5c2e13e1e8e6895bbc54cbf034c8d0a9b78f1a36775c2db1a87d2968dbad4", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715567, "uuid": "9c7d3336-3acc-421b-84f1-8c2a883f18ba", "value": "T13CF312443AC4EF5DCD92AA79C05CA2FD40CB6E30E55B8A576606FD9F3C332281A5E741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715567, "uuid": "a7cebd09-ebd3-480e-b717-8de667109979", "value": "9b0a846beb9e3bed048a526a893b1a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715567, "uuid": "d78416f0-ade6-4544-8c32-4c0d8c7e7d2c", "value": "3072:1TmFPcCNHK4+Xe9TdYOMJmdH9W1oajWLvemCxZ7SaK0857haE63jXGyZq/Co8DFc:YFPzN0Xe9ZYuF9ujM29xPO7a7jXGysUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647715567, "uuid": "09efac64-a441-43a9-8760-322f425cb049", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647715567, "uuid": "04cfd5a4-6041-4101-8968-9706456e33c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715567, "uuid": "e8f7841c-377c-4ed2-8664-c48869d6a1ec", "value": "E78CFF004D64769A1E80583EC0D0E7FE18B4EF35BA374.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b695d529-a741-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666121, "uuid": "6df04f03-88af-4088-8f49-6cbc1dd64d92", "comment": "Malware payload (RedLineStealer)", "value": "edd41fdb32f2090456fba963fd5bc6b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666121, "uuid": "137b3582-99b2-4b58-bc6c-a308d41a06f2", "comment": "Malware payload (RedLineStealer)", "value": "e7fe60c6925f2d615c3dba56ba4efb1cecbba38b63215c4c70862fb8e7b14f83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666121, "uuid": "168c9e2b-a588-4b07-83ec-dac08f697dbf", "comment": "Malware payload (RedLineStealer)", "value": "227d068d7c3475b9596c433d4de2b4ad2df024a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666121, "uuid": "5c4ec661-7880-4a59-9139-74f284eb6281", "comment": "Malware payload (RedLineStealer)", "value": "f58bbd62921f714daf2e271cc054f560aa78444c1c1c11c37f7ef076ec9f9278a98595fd3bf7d6801b32d798c9fd9e2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666121, "uuid": "59703bc6-3e98-4f94-8096-cecff16753c6", "value": "T100263316325AFBA2F87CECF5335C2FE2587A05AD9464791FA10895FA168E4C3570CEE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666121, "uuid": "06f452e6-8afd-47ac-9b09-57b838680cbc", "value": "dfec469ff9e19f9df882decc3c09398f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666121, "uuid": "847b3880-f54d-4b2e-bdc2-82ac42425a25", "value": "98304:ER9qU3stpCxuAvYHfd5zZ4vXVaWtCqLlCyQBks8:I9qU3mp2Qfd514vog3QBkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666121, "uuid": "5eb6d278-7393-4aca-bac8-b2db5a458570", "value": 4854936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666121, "uuid": "307e72d4-e875-4e1f-a785-61e9dc6f3249", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666121, "uuid": "5dd5dbb3-070a-4844-a871-77c86536b0ac", "value": "21353471.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6f0870-a794-11ec-9275-42010a9c0029", "comment": "Malware payload (Hydra)", "timestamp": 1647701670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647701670, "uuid": "66fe7af1-c81e-4fc3-96c7-722d7d66000a", "comment": "Malware payload (Hydra)", "value": "a61a768c681d326bc19762cdeaacd375", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tor", "colour": "#9125F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647701670, "uuid": "d8c5f3d6-141a-4224-8ce3-78cb207aedaa", "comment": "Malware payload (Hydra)", "value": "e909b4adcef7b43fe8a1a8dcdbdf1e59f9a9be01954fd8cd2d8da27badd18e35", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tor", "colour": "#9125F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647701670, "uuid": "00ae6966-8b40-4cd3-b0d2-69d078a8bf59", "comment": "Malware payload (Hydra)", "value": "1e7a51456d60d6b53aeae656aaf0bc1eb68fd194", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tor", "colour": "#9125F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647701670, "uuid": "3cdffd8e-14aa-47f5-93f6-19c205f6ed77", "comment": "Malware payload (Hydra)", "value": "1cf10261bd5a55b99faa5b3c4a4d9965a2dc50c188142ed5ca4a876dc0a8c4b9efd561d5038a3c5661806fc14d20cd8f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tor", "colour": "#9125F9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647701670, "uuid": "be052ce5-76f5-4a43-b33d-6c5fa51a55ca", "value": "T1B316339F369984CFCD204AF8612DB7C9666F2FE75B1104E76B05B61890778B01326CBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647701670, "uuid": "c751a11e-b7ef-4680-823c-863b33ad72a4", "value": "98304:UFBoJepnVrGJXvknCUtI4og75c5cg81WlIlJkFbGWL3jNM6YZ:EqJGrGJ8nHe4ogtc0WlIlJQqUjN78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647701670, "uuid": "791c60cb-96ae-4d92-8b0e-cff3400e5c4f", "value": 4161104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647701670, "uuid": "94215908-c392-4b68-a484-f54097171d6b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647701670, "uuid": "e1331964-878f-4357-a1f8-d154a2fba8e1", "value": "E909B4ADCEF7B43FE8A1A8DCDBDF1E59F9A9BE01954FD8CD2D8DA27BADD18E35.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3103ebe6-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666327, "uuid": "9a7ec41a-0cea-4c66-88d6-73b7b45cd94e", "comment": "Malware payload (RedLineStealer)", "value": "e5de6dda32f18a95492e4be387bb0328", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666327, "uuid": "5c6c9c23-60d9-4819-b0d1-b7c76baf9320", "comment": "Malware payload (RedLineStealer)", "value": "e9474a4fa275cfc51ac6d261b81829132c11ab819f721624a40ed200c5510ee8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666327, "uuid": "196a2e37-a908-433e-a07a-60ad29959aef", "comment": "Malware payload (RedLineStealer)", "value": "39ca48a687b6ec8158b85e82b4882aafafd1a11e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666327, "uuid": "956890a5-4815-4d7e-8481-fd610fab00ce", "comment": "Malware payload (RedLineStealer)", "value": "84830a8b968d13123537de7fe67754b04d634a61163b11ef524013c1ee9e8b4d1057cee819f484a479e1e460b2c5f1dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666327, "uuid": "d8f9d1c7-2f5d-4f3d-955e-cc21746d633c", "value": "T1E93633530A50AF2FE82FC1B71CF047E5E37AB9C0D873903AD1AEC6815491198A9DB7E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666327, "uuid": "5436bc0b-6c3c-4359-a642-a5f588239e25", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666327, "uuid": "e42db9e2-181c-4eb2-a2bf-e04afefb028a", "value": "98304:m5e3RWmD7h6iMlw2G/ZnUsPqb8fyECgTidOxXsiFQe69I5P1vBp6sT2mUB6h/VMj:m5e3B8tm2G/ZnUsPqbXECgTidCXlQeb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666327, "uuid": "2bb69450-791c-453f-b1d9-d4c1d55a0381", "value": 4876952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666327, "uuid": "19112e39-f059-413c-9c8a-a0862a10e680", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666327, "uuid": "3fa21ad4-dc95-4519-b135-ab0888d5004f", "value": "22511427.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b342f21-a725-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647654023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647654023, "uuid": "c18416b6-8e91-4696-b91c-81682784e31a", "comment": "Malware payload (Heodo)", "value": "1f379ab44200f9f2ce398fe067952a59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647654023, "uuid": "628bbb0a-a0ec-447e-af28-40edd44b7244", "comment": "Malware payload (Heodo)", "value": "ead0587119d04c9ef6e1f1eaddffbb78209d013a6136bf968145b351d8c13020", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647654023, "uuid": "09805c55-b8ef-48e3-89a2-0b761bb7a3b6", "comment": "Malware payload (Heodo)", "value": "7e5adecdfd99ce4da556c2ccdaa65d39e38b089c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647654023, "uuid": "5a6e7130-de62-4a75-a442-4f47ba0f08d6", "comment": "Malware payload (Heodo)", "value": "c1dbf04e943b397163e3f2c091a079ae5061c8ffd914e41aa802d3aaa9ef5bbc28e14eb2b7d452c2c3395e118c516d11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647654023, "uuid": "9208b88c-95ad-4543-94ff-e8b2c5feab52", "value": "T117D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647654023, "uuid": "60ce2c2b-48d6-4ada-af80-a80fa920e451", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647654023, "uuid": "b45169de-36c2-4fc0-a26c-f8d934d06c52", "value": "12288:UWBpwupxl0OeL/grxUGzO+r9AjCb/XKh:Psupxa/gX2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647654023, "uuid": "bb568416-0f17-4fc0-830c-7a01423d01e6", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647654023, "uuid": "3f423ac7-a956-4832-827d-19425d52be0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647654023, "uuid": "9c8070aa-fbb3-4f38-bc13-af8dfff231c3", "value": "1f379ab44200f9f2ce398fe067952a59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9387d3a8-a7a4-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1647708583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708583, "uuid": "bdd1ff87-fc7d-40b2-af9c-eec5921e2875", "comment": "Malware payload (Socelars)", "value": "be12fd54cd1c99acb5b04427ca7f31ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708583, "uuid": "11e33d8a-cf3c-48ba-a91e-3677dc35d4cf", "comment": "Malware payload (Socelars)", "value": "eb11729804c030f17ae3daf219cb9526fd22d02e6d4b59b88cdd8cb748b5635b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708583, "uuid": "d3fecf69-595f-4d4f-ad8d-4e229e0406b3", "comment": "Malware payload (Socelars)", "value": "e66332b295f66adebcc220f33e6794eb81ed7d5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708583, "uuid": "82b55ed9-c0f9-49d1-b0c7-fab44ae6771c", "comment": "Malware payload (Socelars)", "value": "72ac35811c36d6767c174e7681c3bc3cc5e998dfff71bce4353d325e6c1d1b2185b04ad48976793fdbe481a3af5f1cf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708583, "uuid": "db3c5934-da06-4c2f-b67c-4542fb3ab59e", "value": "T1C7659F11F642A036ECE310B2C6FF4AFE8D286A21031894D7D3C46D695E715F27A37A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708583, "uuid": "22c5f4ea-85dc-4247-90d9-6e30d67b11de", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708583, "uuid": "325e91d4-935d-4030-bdb9-33c674b7c355", "value": "24576:1wpk4V9rRM1oDb+enGs2Q6E9ZBJRPHJYrFSJ84ufUKKFYuXsg:WpRc1OMcV8sJjAUKKmRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708583, "uuid": "cbed97a8-8031-41ab-bc3a-4a4b9697eb36", "value": 1514496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708583, "uuid": "2603555b-4a1b-4ee8-996f-89a3181dbcee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708583, "uuid": "59884ef7-1ca4-4160-bd9a-b718224e1462", "value": "be12fd54cd1c99acb5b04427ca7f31ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc4b1ac-a7a5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647708840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708840, "uuid": "6258f5e5-fb9a-402e-923d-d3e17a112623", "comment": "Malware payload", "value": "4a3e5d20ff9e5e1f5006c3705de3a394", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708840, "uuid": "8b691932-4733-4f0c-9c16-db3869178264", "comment": "Malware payload", "value": "eb43748a4e80e0e8919eb48ca42c332714eab09c6562ca0a03d029408e3a2a8f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708840, "uuid": "e24201ad-95f4-4568-9d14-6e3cb94da579", "comment": "Malware payload", "value": "ad9d5df9b252f8fdec5f185d48e3e9010299b456", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708840, "uuid": "3a6f2885-f4d2-4ee3-a913-b89fc0155512", "comment": "Malware payload", "value": "6b5663343dd0b670d2c7194c3c864438b774ea87f6f4bf21e3c80e1bcc0b5f384c1f5ba2284a2d99ac9eb63394ddd744", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708840, "uuid": "43456b0f-c130-4d58-9b1a-d0342afe4bf5", "value": "T191F3F11E3EAAD0F4D01384374440A2367F5D02D8D08AE09BE5FDA5978E35CB96B52EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708840, "uuid": "fabaf6df-2abd-45cf-9343-b5b6f9ed359a", "value": "3072:Oy2BADHoDpqULTBF1GhMT9DCVgzxTTAhR1S+xe7oab8QPjOaSiIOwbTxvQvHOJNX:sIIDTTBF1/T9DBTqDSEekab8IGOwbTxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708840, "uuid": "73aa85fc-1223-4c57-ad7e-d3af95cc42df", "value": 167604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708840, "uuid": "f341f764-27ea-451e-ba39-fc2df8635fb2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708840, "uuid": "def1fa52-c6e0-4ac5-a4dd-5f24483f2bbf", "value": "0111257692_SHIPDOCS CUSTOM ADVICE PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6236ee7b-a7b5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647715802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715802, "uuid": "76757ba8-c474-45be-9171-4f35804e251f", "comment": "Malware payload", "value": "44f3db26d6ed1607ef1a3aa123cbc46b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715802, "uuid": "3ee8969f-9bff-4347-a20c-70d9cc1b8e51", "comment": "Malware payload", "value": "eb627801931d2416fe6adede69983ebdb29961c8881a8f5628e2a3652568b0ae", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715802, "uuid": "95a1ff2e-6512-4d23-b3e2-de7bb9d41e10", "comment": "Malware payload", "value": "1ddf88603e66cde8fad4765a386d5edb2b21b4c8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647715802, "uuid": "d05366b9-8615-4acb-84d6-c56522e004bb", "comment": "Malware payload", "value": "0d856e06d0ce1780f4a94396f0971cbd1dbb567b63e4316e14a4466b02befc56a1b2767297ea7ebdd6684add8094daa0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715802, "uuid": "1a11e4e2-e90c-4f44-9eb7-40b33b18cf82", "value": "T16C53EA07BF654DE3D86BDC3B4DAA2F0528DCD18725547BBA6A34D028B24A14B0DF3978", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715802, "uuid": "c89240cb-ae84-4980-a677-6907b575510a", "value": "1536:EJE05kP6/dVdtW+QwZA0+gBlUABpKev5:YOKiwRlUABp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647715802, "uuid": "a0e7787f-9a66-4a8d-950e-65944d852127", "value": 64956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647715802, "uuid": "8ce59727-942b-4049-a9a4-2c8b0d06b425", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647715802, "uuid": "1175dedc-0ce2-470f-aa29-0dcff690915e", "value": "mpsl-20220319-1850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791cc972-a743-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666877, "uuid": "f67849d9-01dd-4d9e-872a-a4b62c1fd97a", "comment": "Malware payload (RedLineStealer)", "value": "979b0a345cd86f60b303197fc0fd5b96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666877, "uuid": "fa253d9a-a298-4ee9-a5a4-90b27114ab00", "comment": "Malware payload (RedLineStealer)", "value": "ebd7929db394ecc6867bc7562df1fe616d57db76cb43ac1e419ba27620b1c168", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666877, "uuid": "5e71749b-732a-42d5-9527-4c744f1459dd", "comment": "Malware payload (RedLineStealer)", "value": "3efc50884e3799e03ee7f3e3f1ba07de2b1e9b50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666877, "uuid": "b2cce8bf-fa9d-4155-b110-0d27e6af8d47", "comment": "Malware payload (RedLineStealer)", "value": "02636670493bd50d5125a4aedaee4ba3f622e1bf8dd01bbb814e0f98beb63de60f7d321a1d1454a6642924f7fe8c8a1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666877, "uuid": "1488c5ca-a1cd-4186-aacb-1704a521c774", "value": "T1553633DEDD9DD21BE14AE6F80EA04E45E0C88245F6B7B74925BAC9B5074CD8280631FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666877, "uuid": "2c088fd7-f154-482d-8517-1e7b13264a63", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666877, "uuid": "ed474810-03f3-48d8-bd69-4f7b7f55789c", "value": "98304:7mUFikS+nFdUBbLwyRvBmGIYbZtN4K0pzG0Ihkrkx:7mgy1NvBmB8c7yo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666877, "uuid": "d0e28114-2c67-4359-9b73-ceeec216567d", "value": 4890624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666877, "uuid": "967e03ff-49f5-4545-84ee-e16e32791661", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666877, "uuid": "ac4f00c8-5b9d-4fab-8dc2-7b9dd60193cc", "value": "27294102.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c981c9-a7a4-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647708424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708424, "uuid": "41cc22de-c211-4303-866f-b2b587cc2f55", "comment": "Malware payload (RedLineStealer)", "value": "d78999d6398559771be9af5ce4149dca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708424, "uuid": "2f37c9f2-455a-405a-955f-f2737c2dd27d", "comment": "Malware payload (RedLineStealer)", "value": "ebddd1bd4994a2e430a41296a494bb098931d582c114173051ddfb30ec1cc855", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708424, "uuid": "662ed5a8-ebed-4f24-99d6-20b1ffb11ab2", "comment": "Malware payload (RedLineStealer)", "value": "5e0c78c1b42be1c1b9f34a8e8ada42ec91e5bee6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708424, "uuid": "316adee0-ec78-488d-ae5d-529ee5d6ceab", "comment": "Malware payload (RedLineStealer)", "value": "682820aa10d4ea506dd6f9d2b6460dea56127430677ae91b985fbf06c976fbf672cb7d18ce0e6e2be543c389ad823bfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708424, "uuid": "cb1048cd-4a4f-4bd6-9f08-18618eda6c5a", "value": "T1CA353317E7C92A48EB01C336C2A3DB626936F121127DBF9904B1972C9636F313E95917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708424, "uuid": "78d134dd-e9f9-480a-8f8e-5d0dafc7a6d0", "value": "0d3e2394a765799c0458f90f78d7e558", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708424, "uuid": "ac445b7a-d6ff-424f-9366-a9fbca798c7f", "value": "24576:tlOll3VwpYhAsVWvqDRLrvDvqLvATawnyR+K9wocms0mjU:HOlpVwpYhAdvwvDvhTXu39wPms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708424, "uuid": "80b7b980-596f-4749-840b-84eabab7097f", "value": 1083184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708424, "uuid": "2e937ae5-dd1c-4ffa-ba7f-b6d5419ef83f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708424, "uuid": "69b1bd0e-823f-4684-8916-1885af838ddf", "value": "d78999d6398559771be9af5ce4149dca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6ee0b6-a759-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647676226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647676226, "uuid": "71995d56-75ec-481a-8cc1-423f231a5ca5", "comment": "Malware payload (Heodo)", "value": "02bac1e54114d92d325d14afd7007c60", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647676226, "uuid": "f60dd19f-756d-4778-af7f-541bd2f5e57e", "comment": "Malware payload (Heodo)", "value": "ec62352a871a5d47ea83fa652868e8a71647f2a84650e097d50de8cc5d06b605", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647676226, "uuid": "de9f42e7-b064-4ba9-8354-ca1aba535a95", "comment": "Malware payload (Heodo)", "value": "dc93fc649d7602b394e51c06ed5a99fd0a89bc03", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647676226, "uuid": "a855a628-11f8-423d-84db-1981075e5c16", "comment": "Malware payload (Heodo)", "value": "797fa0fa7dbaac54f8c25b9642483ae4443b82b57551e02928ad4a013d4d189bacd215c09ab7f2e2758c83ff4fbe9f73", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647676226, "uuid": "45bfcc74-870a-4b05-be47-ea2dd519eca8", "value": "T1D174AE62B6D180B7C2F311B14A46626FB3F5EB00473AABC35BD10C586B39593D33979A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647676226, "uuid": "3da72d7e-8f93-424b-a6ba-930197b580e9", "value": "6144:WZ7T8DsyVvuJb8fTSeOPwSyeuRJ0tvZVKudKV9M/9KnAuMW4d/GBdYtko+:WZjb8BOPxue5dKV9M/98f0ko+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647676226, "uuid": "f848dbad-502a-4433-95fa-e56abdc50f7c", "value": 346950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647676226, "uuid": "cbf93fb0-648f-4081-8ef3-573d788d4d82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647676226, "uuid": "1b9e7799-f20f-4b36-b069-d19a56989af6", "value": "emotet_exe_e4_ec62352a871a5d47ea83fa652868e8a71647f2a84650e097d50de8cc5d06b605_2022-03-19__075021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37037c96-a7af-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1647713152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713152, "uuid": "7e3297ff-f83a-452f-9781-052ad33f69ed", "comment": "Malware payload (DCRat)", "value": "5a644b261e31bd82c9d53aeeb012e1d2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713152, "uuid": "f6008f20-8e65-462c-8ff2-82f2fd54c085", "comment": "Malware payload (DCRat)", "value": "ec7530be3b51c76f865fb17df9fda1d5577df22854e33b2945da30a9367762cc", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713152, "uuid": "dc9aec4d-592c-48fa-a5ca-67c25e54c556", "comment": "Malware payload (DCRat)", "value": "06257cc3398df32732304d9cfb9ddd20466262b1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713152, "uuid": "21254894-2aff-48ad-9ca5-1dbd45b292cc", "comment": "Malware payload (DCRat)", "value": "70ccf64f3bfdfae84e615e95ad530055811eddb409f2a48d00a1d72f07e51bc018f5639006e327bc4bec3d559245bff0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713152, "uuid": "7f12a62f-2c46-49c4-a658-15eb6d239d78", "value": "T12785BE127A44CA06D47A9B33D9DF942447ACAE412626EB0F7E9A339D17013BB5C0E5CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713152, "uuid": "3d87df20-6668-4e29-bdf4-c3280ff9f31d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713152, "uuid": "b8af6a9c-a9a5-4093-9126-7734f33d9646", "value": "24576:MIijNWSwMd9Si4jZF7iLG0I6xOAg/NXtXBjI6O+owAK3EMZNixgcGxli2T01jHwM:c0MXp4PnAgzxsz+owAK0MZjb5UF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647713152, "uuid": "505cac22-0b32-4500-8311-0d9956e823de", "value": 1836544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647713152, "uuid": "2222b5a6-7cf3-4b45-ab26-c09ca29da022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713152, "uuid": "2e074e99-b831-4b0a-8a4c-e99ee6b16d87", "value": "5a644b261e31bd82c9d53aeeb012e1d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88836375-a741-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666044, "uuid": "975a22e5-8e84-4a7b-8eb2-62af84122a8a", "comment": "Malware payload (RedLineStealer)", "value": "d70bf5fbca5a147464d12e8aa774d323", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666044, "uuid": "76845685-1abe-4d22-b214-1819a98196f5", "comment": "Malware payload (RedLineStealer)", "value": "ee39272e41dcdcf8258fc616ce03e896d4826d711fa770ba583c72461ab8df43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666044, "uuid": "ebf6c63e-f154-4b11-9410-99cca7b0c504", "comment": "Malware payload (RedLineStealer)", "value": "8d814800fc08285c934785e1b73a595b276024a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666044, "uuid": "def82bbd-e1a0-4692-988c-dad7768454df", "comment": "Malware payload (RedLineStealer)", "value": "37a7e101ab4b2a79bf031a90d21585dc4b36eb34ef9a81cb7f1b0dd844938b8a82545e65690dbaad4fa366edf4bda687", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666044, "uuid": "6aff3f20-82b5-49ec-96ae-b554c7bb7f40", "value": "T1C53633C1B1D66854E4D70E7D72CF0F01A5A4B8900CE96346A6B2D873D8887E399FD26F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666044, "uuid": "db55ea2d-d2e8-4a8c-96e9-a71fef2507ca", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666044, "uuid": "9ded4422-083d-47a3-ad26-66c77ab57baa", "value": "98304:hht201TequNSCdtvIz+rSytotZjsfUAw4yTIIJx:hrPmSCdFEuS0o/I8+WIIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666044, "uuid": "9b45cbb9-d014-44fc-ae10-da18b276c090", "value": 4920624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666044, "uuid": "19cd9fce-9da4-4430-8e1e-04e587fce9f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666044, "uuid": "bd915324-405d-418d-a693-fedfb8c5d3c4", "value": "20875527.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dafab89-a7b6-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647716170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716170, "uuid": "1003f1eb-b7b4-4695-a1e1-9cd8a205767f", "comment": "Malware payload (RedLineStealer)", "value": "0e566d062e12ca080b984309712bf0fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716170, "uuid": "469e5d26-99e5-4fef-9015-68e8c710bc22", "comment": "Malware payload (RedLineStealer)", "value": "eed3dc3bd8fe006447ebd633cd8ce00a38f96c69f05d7a621c852ef2c45192ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716170, "uuid": "95c3b93b-0f25-42f3-bc77-4340cfbbff2a", "comment": "Malware payload (RedLineStealer)", "value": "d0be6f51368c1e1547d0880763074c8ed9eec864", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647716170, "uuid": "40b26d14-25e0-4991-ba98-2955d95a5195", "comment": "Malware payload (RedLineStealer)", "value": "463e5d61f316635ce1e089c761aa3d9eff400df8dd66e21de0fd1da5ef66fd8b4bf9da1d71cba1078e5c95bb6fdc21a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716170, "uuid": "36dd939f-b394-4bcb-bc54-a0ad2e6fe238", "value": "T1C6953309DA8D5A08D5A2B23A81B78E357973B139536D0FA111ADB23CAFF3B771C52C11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716170, "uuid": "7727d28f-f717-4db2-8dfe-c7080fe0764b", "value": "522c2b7934d672997a3a4448dfe9c305", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716170, "uuid": "b65183df-bd6c-4613-8c95-001476aacf70", "value": "24576:tm98SKigyX1H7CIURcWRYn8DitMbmVCCcfqTvDRqLvAzYydy+vkxI5aJn96rp2Sz:G0k12xRcWyOmfTvDRhzxvkmmniwSa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647716170, "uuid": "581bec61-bf58-47da-ad78-3bc09b5d72e0", "value": 1998976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647716170, "uuid": "0a650390-b853-4e40-b394-66ed2865ad84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647716170, "uuid": "0ef58071-7c6e-452f-a21d-c79f5855ff63", "value": "eed3dc3bd8fe006447ebd633cd8ce00a38f96c69f05d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3785c270-a77d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647691678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647691678, "uuid": "d90be4b6-614b-4ff0-9fa5-aacfe37e8b30", "comment": "Malware payload (AgentTesla)", "value": "a457423c60a0b948ed03308105bcfb17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647691678, "uuid": "05a8638d-52d4-448c-97f8-33db365e810c", "comment": "Malware payload (AgentTesla)", "value": "effba2b0791940bfa971f7f7a30f27fe2e1691b23ca82be2de4ab6181b07e750", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647691678, "uuid": "ec2e9e6b-36a1-4716-9dc6-85c711caa5da", "comment": "Malware payload (AgentTesla)", "value": "01136d40878602d620dd00eea01f7773f6c97d5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647691678, "uuid": "4603e535-a868-41fd-a1cb-51d6aa476599", "comment": "Malware payload (AgentTesla)", "value": "00dc84b334b460a164126ded543474f0ee2580d3bb2020492786a7444dbd38fce902cc3eabc21f8c8ab3143c355da0bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647691678, "uuid": "25e1d0a5-3e78-4cf0-bfc8-706b251ee917", "value": "T13C9423EE0D485EB3B2EA74A882381F55A2C48A9522BF321F35CB5F51188BB4B7548C5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647691678, "uuid": "53ad11d9-c4b0-4121-879f-7189e2caf398", "value": "6144:9UAljp4GtW3B9FnWU+1AdQJ42lrz/uUDlqLvZXDrURbwwath6sEbHPzQct4qpv8+:95ps3tB+142BEstvXbHPzQm4Wv8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647691678, "uuid": "4bf3986e-f39a-4717-8fd4-3f4633c2d6e3", "value": 436721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647691678, "uuid": "73f3366f-5bc4-4996-af48-fc6a87fa74ed", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647691678, "uuid": "2277d5ac-c775-4cf0-b1b1-d7483696103e", "value": "new order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269f4a01-a7d2-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1647728157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647728157, "uuid": "2c38f7ac-3bba-4186-a377-93e2e502902c", "comment": "Malware payload (njrat)", "value": "a45f423c55d5efdfce385793e36c00c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647728157, "uuid": "1761b7c4-2b1c-4f57-895a-81299de1c15d", "comment": "Malware payload (njrat)", "value": "f0e32e7fb7c37a8740b558745334cb526675456d1e945ee999cf01d4c7e30919", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647728157, "uuid": "43bf5d36-7845-401b-b636-9fd963c43a8e", "comment": "Malware payload (njrat)", "value": "da9b2551a7155b4dea1b1ded8cdd95bb694a101c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647728157, "uuid": "8bd54f48-a04f-4283-b342-1cac4b78c11a", "comment": "Malware payload (njrat)", "value": "2f350a0286d316c35e151b43a7c9ef4f7f237d71471fec96589acc3c9abcccfccbc112dac8b025cc8e5dccb7dbd232f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647728157, "uuid": "35740071-d5c8-4442-a6ee-80b2d40e4615", "value": "T104F3C72B7A84CB15DE682871C4DBA53007E1ADCB1B33F2463F48366D19427E79D89BC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647728157, "uuid": "47d18306-09ca-4ad6-87ed-a9d366fa79f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647728157, "uuid": "05ba7b33-cc93-42da-8f05-c9ede4ef2758", "value": "3072:jEmT+k4aPpBsQK5//sI0xcTLx1dsAZef+K:jppm5//sICcfdsie2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647728157, "uuid": "5e44edba-3551-48af-b155-2bfacf1b2de0", "value": 160768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647728157, "uuid": "ba92d5d0-8eb2-4b40-8129-c19aa6957f5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647728157, "uuid": "413f714d-37a8-4fb4-a2d5-3d5a87c74b36", "value": "a45f423c55d5efdfce385793e36c00c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d7fc67-a7af-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647713422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713422, "uuid": "d1447227-ad04-4c19-a64e-585f226c472e", "comment": "Malware payload", "value": "cca70a894efa92b2252b87a176bee835", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713422, "uuid": "b06aeca4-88dc-43cd-8164-a9cca1143e58", "comment": "Malware payload", "value": "f0f44a382db76274339cd29bd930c4882c3acb48d53d26532aaecbb91dfcadfe", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713422, "uuid": "cc03bca9-0efb-474c-a770-e1f2d48bf2db", "comment": "Malware payload", "value": "cc2784af324f03c9f762473099f95dff5b521386", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647713422, "uuid": "15f32514-cadc-4ed7-8b84-ae72de5f2380", "comment": "Malware payload", "value": "67da3c6fae9e3ad19b50d6c40fee1acc328f377912b10e3608a10fcbd69c96ca815998716904151f4a5ee3b7b657db5e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713422, "uuid": "0fe0e3d3-df7f-4e00-89f0-0b4deb6e7573", "value": "T12B532A55FD81EA00C59000B6BF0E110D7727C3E4E2DFB7775A296AB4668B1678F2F81A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713422, "uuid": "c3ca43ae-41a2-4075-97fe-a4ffdf83bb77", "value": "1536:zjnTUulSMHskDq5cRI6ilWAF/oP8lUABdOJ77OV1:jUub2WAF/oP8lUAB91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647713422, "uuid": "89195b06-03fd-4666-82db-1446e0ee4b17", "value": 64320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647713422, "uuid": "2f70d597-f1b0-4ef7-a441-b0de37022951", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647713422, "uuid": "f16215c3-9a8a-4b20-98a3-666ca3a08737", "value": "arm6-20220319-1810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "976ecd93-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648460, "uuid": "ae1b8316-d9a9-4e99-8484-36ae49a1b6f2", "comment": "Malware payload (Heodo)", "value": "299cc7696f3d2ea12e274d53fb80706b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648460, "uuid": "6f691725-4683-4fa7-891f-216520d6a1ec", "comment": "Malware payload (Heodo)", "value": "f1300b76b706eaaed6b079e31c4686bef39568070d21c00ac89ec2eeb0717142", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648460, "uuid": "cac16eb9-824f-4013-8667-169fc042d7aa", "comment": "Malware payload (Heodo)", "value": "34b4b81a312f012d1312a96ea66374772d6681b2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648460, "uuid": "86f4a6c7-7d23-4499-88cd-6f366c446cde", "comment": "Malware payload (Heodo)", "value": "18df81040f3a134f0513e7cdc0a903b6a9d3281e417e87aecd8739be30065bff8f532b34c76b6754d36dec83f0e92fa4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648460, "uuid": "5c3832d0-4cfc-4187-a558-11b3d6bbeb4d", "value": "T152D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648460, "uuid": "648b6a25-fc3d-47f3-9444-42671b90a1cd", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648460, "uuid": "d0c099b6-31a4-444f-abde-274b503156c3", "value": "12288:UWBpwupxl0OeL/grxHGzO+r9AjCb/XKh:Psupxa/gK2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648460, "uuid": "2404b5e9-5e8d-4fc3-b34b-c6e18fb1145d", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648460, "uuid": "7075081b-b862-470c-94c2-3d034591a3fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648460, "uuid": "a0fd0bc5-04ec-4042-a62e-459259c1a71e", "value": "emotet_exe_e4_f1300b76b706eaaed6b079e31c4686bef39568070d21c00ac89ec2eeb0717142_2022-03-19__000735.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d72dc431-a741-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666176, "uuid": "a4bd395f-49f2-42ed-b369-5960de06ebb1", "comment": "Malware payload (RedLineStealer)", "value": "5a64a91f05d6fa2e90fbfb700e6ba511", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666176, "uuid": "459f3bca-85d0-4684-b96e-55a7efa826bf", "comment": "Malware payload (RedLineStealer)", "value": "f1a3756e7e9e19e2e27dd4924bf56318a67e1379f9cf1b841a9e977af5ae38fa", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666176, "uuid": "b587206d-77a0-4ab9-a59f-e23652ac906a", "comment": "Malware payload (RedLineStealer)", "value": "65642c4a5b99965811a12155ea6ea14b50c999fb", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666176, "uuid": "b18ad593-04eb-416e-a659-92783afe20ac", "comment": "Malware payload (RedLineStealer)", "value": "bb722066e15580c377b51d899e214776dfdb8873e5ab4d07ed7c0537ea28b053347a41762ae1aa36cfb9a2383f1734e4", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666176, "uuid": "fbafa5e2-a2c3-453f-9ba7-5f5537f319e4", "value": "T1356533A331D38646D38E32B21779065DE32F5E7CEAE876E72ACB54821E844A37D0C517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666176, "uuid": "c52b45f3-e6c3-4c91-b40e-ae5d0682eae3", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666176, "uuid": "588c7470-d978-4f53-902a-69a2d0b80418", "value": "24576:K65wwl+rhIvusm2GTXTpzD75cnRugf7ZbbN6tZboZGs45PVG/3Q3ZWF+DR5ZY28x:/5rl+ricbfZ5cnwgftbbNwZbMTfgJWFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666176, "uuid": "902fa843-af86-4b7a-86de-d7af2aee75dc", "value": 1522176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666176, "uuid": "8e44acac-8023-4755-bf1e-3510e59448a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666176, "uuid": "50f8f504-26f4-48f5-a913-03f116bc17cc", "value": "21477516.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1d9f8a-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648600, "uuid": "fe7499e8-6df7-4b7b-ab33-b961644646be", "comment": "Malware payload (Heodo)", "value": "2a21189ab60ec1594630658f187585e8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648600, "uuid": "fadf7dc9-2d77-4caf-85b2-fc299be40d84", "comment": "Malware payload (Heodo)", "value": "f45dcd18a881e7aa09fe783bfd675ae05a5c24732a391a9af5722a6c866f484b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648600, "uuid": "e6c22ceb-c005-41e9-982d-805effa6a171", "comment": "Malware payload (Heodo)", "value": "6e5dbab51705e7c9cd2b0afbcceeb7da7f5a6665", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648600, "uuid": "4aff5926-2905-424c-ad8a-1f465056da72", "comment": "Malware payload (Heodo)", "value": "55fbc39a4c23bc72be042f4226d53c481b232173e3ab887ee84aa32f7abed101e43f11c0eac1504f29fea9aff93d04c5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648600, "uuid": "e755cfc6-c4d6-4ced-9dde-7e1830928408", "value": "T11EC47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648600, "uuid": "51a124ff-381e-4c03-ba32-52c642ce944e", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648600, "uuid": "4f3307a6-d41d-46de-9d2c-02e1181db99e", "value": "12288:S54yM33d3q3Z7Bog2reNmF+U/9JckIAGfUeb:SKh3831BoYN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648600, "uuid": "4a578551-a781-4016-888b-a1a453cb26e6", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648600, "uuid": "ae457f38-db6b-4caf-9cb2-714fca3a191a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648600, "uuid": "5d7ab4db-30f1-446b-b458-b2174949ea81", "value": "emotet_exe_e5_f45dcd18a881e7aa09fe783bfd675ae05a5c24732a391a9af5722a6c866f484b_2022-03-19__000955.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578215c5-a71c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647650071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650071, "uuid": "dd076a56-3502-4fce-8334-6acba7f431ae", "comment": "Malware payload (Heodo)", "value": "bb4c8bb47cf8d068671ac4a0c6cb6c20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650071, "uuid": "39e25776-dca0-4ec8-ac85-d229b01e7861", "comment": "Malware payload (Heodo)", "value": "f4efe825f553b2880c4508441616ba025858dae618cac7f0c6d4cda27c624ab9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650071, "uuid": "04e06035-a86b-4b7e-867a-47ce8414e6c0", "comment": "Malware payload (Heodo)", "value": "9ccfa3a8e2ccafd53565c1d0784a2125580425e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647650071, "uuid": "4aa19ec9-5c5f-4c26-ba15-332785eebf71", "comment": "Malware payload (Heodo)", "value": "316a9039eda6263c7f994005ad4da615296c40accb9788765070ff6c705ef924c11fb01270c6e2d58d53821052fa3ca6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650071, "uuid": "a54f15f4-ded4-4cea-84d9-d366fd10ecb0", "value": "T1E9D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650071, "uuid": "301dbadb-8ef7-4f61-84ee-82e71032579c", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650071, "uuid": "cd7e4869-b608-4e02-a77f-7ff0e6f8b0ba", "value": "12288:UWBpwupxl0OeL/grxlGzO+r9AjCb/XKh:Psupxa/g82mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647650071, "uuid": "acecd257-3727-4b7e-b9b2-f738a9029edb", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647650071, "uuid": "5254892d-2d85-48a8-a288-d0ccd12403e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647650071, "uuid": "de37316a-f4bb-4872-a79c-565abaae740c", "value": "bb4c8bb47cf8d068671ac4a0c6cb6c20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d6fe8d-a7a3-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647708322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708322, "uuid": "29f853a1-d9c0-46fa-a84e-b751cc25beb3", "comment": "Malware payload (SnakeKeylogger)", "value": "203960ca47e8b6ae7d773df3a8e40105", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708322, "uuid": "910c6bc4-4eb8-4d85-b726-551d5dc36a7e", "comment": "Malware payload (SnakeKeylogger)", "value": "f6608722225245373a70f61941f6ecda7bfd2646f982193dbf29439ca1e249a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708322, "uuid": "ee169ad2-01c2-4feb-9740-ec477cc8f9f4", "comment": "Malware payload (SnakeKeylogger)", "value": "3211570da456d5685dd3402542cc9deabb71d16f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708322, "uuid": "14d13c23-073b-48ea-9738-fbfb633bcc5d", "comment": "Malware payload (SnakeKeylogger)", "value": "60193ac9075cd2cf7b1a0aff691cf577c202a6221df5862a24686fc4dc12077988937aa8477a939d946b2936c8a4c872", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708322, "uuid": "a5968b7c-6d2e-4062-a0f2-88a7c465fa5e", "value": "T1EC0528BA265467AFD837817185010827FA01ACFFB60B8C56A8837B454E3F5836FC65DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708322, "uuid": "c785ce92-9a3e-4ac6-88ab-d7a75aa10f31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708322, "uuid": "f3446014-d7ef-4c24-89cd-1695850abe46", "value": "12288:0o115yskyv2Fta0vjuUNBT1BDSfiT0nwhJPVbR0w39XH3yd2OluON4fA9uwkCp:00jysB2FtaPUzLt3yd2OluON4fA9uC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708322, "uuid": "450b9a6f-36ca-454f-b8e7-18b19ad003e0", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708322, "uuid": "d04c3b72-5171-4146-9ed9-c58b9b3e3d5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708322, "uuid": "b0e8fb23-ead1-4430-a68d-f0028405b9e0", "value": "Sample Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e95e0b73-a718-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647648597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "7f258592-116c-49b4-a78e-e3b1207224b4", "comment": "Malware payload (Heodo)", "value": "bc128014b1f1956c4a315f05e1720d6f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "0353aa4d-2720-499b-9c83-145d1fae1743", "comment": "Malware payload (Heodo)", "value": "f7ee01fd945554601f1caa761c57eac1df3df917672cfafa117869f69b08736e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "1316a6b4-7edd-44ba-b793-ce2a7e7a724c", "comment": "Malware payload (Heodo)", "value": "ea974abd8ac110968f1e98b184838baab0bb1207", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647648597, "uuid": "cdfc4d56-2f24-4d90-b0d1-5bc4172ff551", "comment": "Malware payload (Heodo)", "value": "a590764318b3b2a5bc56ef42936ab79dc5cd98e5d5194164a79812db59ec6d1270484948fa115d962bd7d42e8bbc48ff", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "f1eafe38-c034-4b05-8aba-3f9f0e0a8fd5", "value": "T163C47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "f748cf23-4836-4535-b59b-fee9f3b2c270", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "1e4b8133-a919-4d13-8e57-f2386c156631", "value": "12288:S54yM33d3q3Z7BogVreNmF+U/9JckIAGfUeb:SKh3831BoTN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647648597, "uuid": "242277fb-b49e-4ddf-91dc-cd5417777f4c", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647648597, "uuid": "f398a084-f4df-4f77-850c-8f1a4fc1bbef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647648597, "uuid": "54789feb-eefa-410b-9896-6c9d3a20a445", "value": "emotet_exe_e5_f7ee01fd945554601f1caa761c57eac1df3df917672cfafa117869f69b08736e_2022-03-19__000950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f02477-a723-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647653126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653126, "uuid": "14348ddd-f48f-41dd-b632-57c6e623bf2e", "comment": "Malware payload (Heodo)", "value": "bfbe2461b460de85965db81ea714359e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653126, "uuid": "8ba08cc4-18ad-4211-9072-870f5ae34897", "comment": "Malware payload (Heodo)", "value": "fa2f3a619a33e887ee9eccc0d50ceb84aaecbb5d3aa096af5442ce9bf9d256c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653126, "uuid": "3df434c6-01cd-4e88-aea5-8d187ff86c83", "comment": "Malware payload (Heodo)", "value": "641b3387376a545f5a3ba1422e4c2fb7a31e3e67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653126, "uuid": "721381ca-87e7-4fd2-ba9f-4f59af5035be", "comment": "Malware payload (Heodo)", "value": "ae45af045757e6db435e43fe4a731a91520de4206760744f06dfdb9f9caaaf1fc37553eb2acca61dbf20dbb6dcfabc5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653126, "uuid": "d297fc8d-7d59-4d66-bc51-1e0f4d6bd4ab", "value": "T12DC47D1173C390F0C6576578840FE615AC7BB83C6B18857EB14B62AF4BF78909A346FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653126, "uuid": "e909472d-88e8-4141-92c2-159b0de709f7", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653126, "uuid": "869f0414-97e1-4af7-b36d-b00c428ae8de", "value": "12288:S54yM33d3q3Z7BogfreNmF+U/9JckIAGfUeb:SKh3831BolN6+ADckbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647653126, "uuid": "35bad6ff-6fb3-4b1b-b015-cbfb9b0f3923", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647653126, "uuid": "4739f4aa-0141-4bb5-af2f-6539530f0647", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653126, "uuid": "6d11769e-ea8e-43d2-8e25-5e84af6d37b8", "value": "bfbe2461b460de85965db81ea714359e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab5ae25-a723-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647653136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653136, "uuid": "a84d8c81-773d-4f22-abe5-30d368067af9", "comment": "Malware payload (Heodo)", "value": "292fd4e47308691dede397527525edee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653136, "uuid": "8362f8f8-cbbb-4bc0-9c55-54358fa85307", "comment": "Malware payload (Heodo)", "value": "fc872e582bb067911e45b44f1cf91a760d71b5467b20e59f9da0cfa1d605c351", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653136, "uuid": "63f6b64e-e7e2-43d5-940c-215ad5697172", "comment": "Malware payload (Heodo)", "value": "735355978daa9b7bbbfa1d10b62a0326322a5800", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647653136, "uuid": "4ac46230-5add-4110-9286-f4cdfd50c938", "comment": "Malware payload (Heodo)", "value": "2f35cc1332962239ad062282d81e865291ae20705bab9eab35378477661b64fe3df3d7194caec6e4007a6a9a20e6d302", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653136, "uuid": "7cc9e3ee-b38b-4bdd-b148-e91e7a51d109", "value": "T1CFD45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653136, "uuid": "7470ea0e-af4d-47c8-86aa-6987d824b294", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653136, "uuid": "51bdd055-672c-4bc1-9f63-81cabb5956a2", "value": "12288:UWBpwupxl0OeL/grxqGzO+r9AjCb/XKh:Psupxa/gJ2mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647653136, "uuid": "94c1a5b9-30c1-4a6c-a951-20f8ad1e957a", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647653136, "uuid": "fa7ec62b-ed48-419f-ac9d-26e4fd116ef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647653136, "uuid": "5eccde4f-dea7-42bc-adc5-66e03b135e81", "value": "292fd4e47308691dede397527525edee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ab5ed5-a740-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647665803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647665803, "uuid": "3972e32b-3813-4ea1-90aa-b6c0659cb0c0", "comment": "Malware payload (RedLineStealer)", "value": "141916df044af781fac565577f87d68d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647665803, "uuid": "80275126-a7bc-46be-94d5-a7a466290c6c", "comment": "Malware payload (RedLineStealer)", "value": "fdd7599299ca06506689bc055bc5711011d94d59a7a5a339cdc20b573a473a6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647665803, "uuid": "be5d6d4c-6841-4e43-a729-9302bbc3a19a", "comment": "Malware payload (RedLineStealer)", "value": "99b5218e912bf8feca9a1b20bf851d9d4af7d90a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647665803, "uuid": "e399e3a5-e648-4994-9dfc-ac97b046c92e", "comment": "Malware payload (RedLineStealer)", "value": "9ec6cf7bdb5596073d948ccecbc4cd8df1b5523a136f4ed719cc1ddbeeb881c7363dd01078dd15c6df835042e2193f25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647665803, "uuid": "e4f49de2-7f5e-41d4-9b35-af3ef6c1f25f", "value": "T1C83633A02060004FC6097D796BDC6F368A487BD17FA2729AF3B8059BC71D5EAE81D3D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647665803, "uuid": "9a4ecb31-09cd-4800-9880-92509b23169c", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647665803, "uuid": "68cc180b-57de-46aa-89fd-73ac1ef0e8fd", "value": "98304:bTx0Obmfw6AkvDJSE+qk8vO62GYexRv94xT8aPe8mr+xifdslIh:bdRcw6A6lSpq1vOXG5vaxT8aPe8maxQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647665803, "uuid": "b27eca26-0648-471c-9400-20ffb9ec2976", "value": 4875568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647665803, "uuid": "6052835c-ec3e-4c4d-8270-42b628fd3f4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647665803, "uuid": "cc384066-6cc4-4d34-b999-81affb0d1017", "value": "19988094.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a26fc5-a742-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647666494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666494, "uuid": "c80723f5-ed4f-47ec-9fc0-7b3ad9ae89a1", "comment": "Malware payload (RedLineStealer)", "value": "c831db1d3035bcd6b2ab9c3cc755a856", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666494, "uuid": "2637752b-76bb-4c0a-832b-976500e08e5d", "comment": "Malware payload (RedLineStealer)", "value": "fe7e378c72ec43fca46360a46a8fc8c0d5ec0f4739ce3286610774fdec47edda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666494, "uuid": "1fb6c12a-7187-4bb9-8c32-7291834479f7", "comment": "Malware payload (RedLineStealer)", "value": "411ac4899945c1ec92cf250e8031a07e7f8de272", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647666494, "uuid": "a07af269-7aed-4197-beed-c4fe967a3717", "comment": "Malware payload (RedLineStealer)", "value": "8f240ecf075611810febe3dd280039111a3738270c43c8d050642d4807817cbdaafb0fa5f212f98cf65ea94bc3ca573c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666494, "uuid": "fbb92987-840e-4be5-b899-d4c4ae4a7de4", "value": "T1E775335E78C9AC1BC45E61FE2F379502AA6C051381FC37C1E857CBE91CC90B55AB86D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666494, "uuid": "18284a8f-4e43-4c40-8ec4-1a2c054426a3", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666494, "uuid": "3752abd6-1733-49b2-8286-fd8ec36b80b2", "value": "24576:SgDYd8Iarw0DZNUhPEh3rjqY/fmGldoggt6NwAGeZlQlRkEaHNYK3UCarVs0:5DPJHPUd+XqYLldNgtDAGeZmNa+Ts0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647666494, "uuid": "e3c1766e-0ca2-4db8-bb1d-deb4fd316974", "value": 1568768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647666494, "uuid": "9cfa04d8-e6a1-47a6-b6b5-fcf750b2ca75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647666494, "uuid": "7dda1f08-a5a6-4655-b224-ab94584b6b78", "value": "24015826.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba3b04a-a7a3-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647708328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708328, "uuid": "2843f77d-0d97-402b-9b15-e25cb3466df2", "comment": "Malware payload (SnakeKeylogger)", "value": "03469f48251ea8562bf3d37cdb28ee55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708328, "uuid": "0d4ed274-5203-4a4d-b7f0-fb52be1c848b", "comment": "Malware payload (SnakeKeylogger)", "value": "fe84e1a62e57213249801372834a30d3d218f122889258bdd83e5f016ed4f209", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708328, "uuid": "7aa24ede-d731-4271-9099-64cb3397b318", "comment": "Malware payload (SnakeKeylogger)", "value": "6da83078764ed93fae7ab46c014091e8d22cd6be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647708328, "uuid": "c52e36f8-0e57-47ad-bb2c-645de68fbdf5", "comment": "Malware payload (SnakeKeylogger)", "value": "d2fa466bfcaf855887a798559cb8828dcfbfe2bec60dd3a49805293c140a82a3f9afd56204fe6c618c5bd33576d128ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708328, "uuid": "123fc139-c1b7-40c8-a4ab-d33b1812efd1", "value": "T15DD46CAD326075DFC86BCA728EA45C68EF90747B830F9217901311AD996CA9BCF145F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708328, "uuid": "a3bfd6ff-031c-4948-bda6-8221645f55ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708328, "uuid": "de18d41c-c806-4a85-a501-159586ae9efa", "value": "12288:e1g2iNL2B4e/uOu8mGLKrlc1D6PRZqSuyKtfRKG1U6o8hTgxRUcZ64jH:ei1+4eo8bElckU6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647708328, "uuid": "13c95b13-034f-47ec-8e79-d15ce503a228", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647708328, "uuid": "190451ae-cb94-4520-bbe1-490f6e23a8ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647708328, "uuid": "3c372ad6-a424-4d8f-b824-11cf6de74695", "value": "03469f48251ea8562bf3d37cdb28ee55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417bf870-a7bd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647719183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719183, "uuid": "3f64ca54-1cbb-4ae8-9255-cd9cd69faab1", "comment": "Malware payload", "value": "b891a281447fb98387a8b32ee6b62dd5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719183, "uuid": "4d547e54-6e4b-4a24-9b8c-cc4f9dff60f5", "comment": "Malware payload", "value": "ff3a803389848b8a2c5085307f98cbc4f1f28891a9ee88cdc81173e426358fb1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719183, "uuid": "f8ed49a7-eac1-48a3-80f0-9cfa99fb95ac", "comment": "Malware payload", "value": "efd0e953c2fd79ba44f194531251116cd3b9a52f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647719183, "uuid": "116f2cb4-271a-464a-8f56-da804371868a", "comment": "Malware payload", "value": "942412d7474fda095cbad9df7575a359b8e113fc42a78ca9ba97936a04175e27227c50139d743669bbb07fbd338b52c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719183, "uuid": "c42f6f8c-54ee-4d21-ac6a-0baeb3304655", "value": "T1DA42A842B31D0957C07A7FB03A3F3BD0B79FAB613299E184325E9A8AC075D315191DAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719183, "uuid": "33333405-ade3-491d-b723-a2b1c0ab61b7", "value": "192:BSzIqzw3YOFdCvllBcZmlRabDCJTtW0bsxqGbm+ucTsWN3FHcsyFBV:BSkM1vlluZmlVTtnbsxqGugdBBUBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647719183, "uuid": "04c497c6-3248-4c6e-84b5-8863dc475c11", "value": 12036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647719183, "uuid": "763bf14d-98fb-465c-944f-46214d115b98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647719183, "uuid": "51188d4c-8cbe-4777-a5b3-b6349a1e385a", "value": "b891a281447fb98387a8b32ee6b62dd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }