{ "Event": { "published": true, "date": "2021-11-18", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-11-18", "timestamp": 1637280181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "b086dfa2-b295-4955-bca5-2eb75c242406", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36cceab1-486e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637239874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239874, "uuid": "ab4c1cff-ff62-47fb-8dee-c3c6f6fede06", "comment": "Malware payload (AgentTesla)", "value": "b7c96f93b121b969f76d06a2820d5ce2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239874, "uuid": "9739e061-bcc6-4a25-9b85-a66f9ea6b3b7", "comment": "Malware payload (AgentTesla)", "value": "01f0f3021482b5afa7134a7340d2f24399c96fad30285bfd7923f107772c6637", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239874, "uuid": "cb94f351-818e-45dc-84a2-d49868a685d8", "comment": "Malware payload (AgentTesla)", "value": "02890574f8cbd5f38894c08f00a33d6526b8bd8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239874, "uuid": "dc27640d-9896-47c8-94bc-299d5c3c18c0", "comment": "Malware payload (AgentTesla)", "value": "146483e5b60f3162aee347fcda0b61095b9aafef9ee731f326870ae5a873dce6e9516cd5ab1337e1a44228425cb1f82c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239874, "uuid": "e757cad6-e554-4b10-a856-6d1c3bb48f64", "value": "T1B5E45BAD325032DFC857F872DA561C6CEBA474BB831B8203A42351A9DE1E697CF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239874, "uuid": "5c879562-ac61-4e44-a197-e4c1621b96bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239874, "uuid": "15f22351-5b7d-406e-8109-d1fe6badc693", "value": "12288:eGfXIGLLsHv4zygoyf5JEscGPDB4NHmqoCuf9eb4GUUdBUcHfSahTSWR:F9oHv4zNfnFDBOGzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637239874, "uuid": "36792213-4338-42a3-87e6-b6b499f74bf6", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637239874, "uuid": "5214f9b6-e623-4b16-8468-2d4a900bf044", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239874, "uuid": "9df6a272-d250-419b-83fa-a7a231757f92", "value": "b7c96f93b121b969f76d06a2820d5ce2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6a312b-484e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637226168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226168, "uuid": "04c86fc8-77d5-4c4a-a518-8a1ecc302c7d", "comment": "Malware payload (Formbook)", "value": "6e8ba3eb00c3d87afbc75d11251f35fb", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226168, "uuid": "9a14c086-7c76-4a76-8e82-78b7b7728ec1", "comment": "Malware payload (Formbook)", "value": "020c9745a66a8b2fd17bbe68f1c25f3c15377a3da0c9759be9bfc584feadb842", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226168, "uuid": "d2c48dbb-ebd3-460c-9274-95c618d66690", "comment": "Malware payload (Formbook)", "value": "0cbd4717f1dffdc91e85c38a2aabffb95a60c7ba", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226168, "uuid": "1761de09-a003-4ef4-8e80-ef6446949ebb", "comment": "Malware payload (Formbook)", "value": "68410c0cb4552a8af5b116bd3df69dd24c08b00a2f0c7847d31e1595ddc9022fc18ed0c484bad5e2bd672732d2574281", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226168, "uuid": "e17b9d13-0dc2-4ee4-b435-9a8dfff7b269", "value": "T17634126BF2B97602F8DDBA3717C84B58B976CD30E60DA01AB06476678E394A41333F44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226168, "uuid": "4df1eba1-b63c-416f-8c72-5fd9771a1cd3", "value": "6144:je5jv251jgGWOp7uVwf3rlKYGpESl2ah96mR3HICtS:je5jVg7uoWpl/h96mR3ZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226168, "uuid": "6d695672-45a0-4533-a2e7-5600fd988f1e", "value": 234456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226168, "uuid": "0f591af3-e302-4e23-ae87-231b6c55d7a2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226168, "uuid": "d136f506-295b-4044-9c37-c50234736d2f", "value": "Neue Bestellung.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f65e0d-4816-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637202068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637202068, "uuid": "db456279-a055-4a27-9fa7-c19c58abe34d", "comment": "Malware payload (RedLineStealer)", "value": "5b0192d31dcb9a21714e0e0c9a2cb202", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637202068, "uuid": "aa025a62-d318-437c-a77b-906269b6009e", "comment": "Malware payload (RedLineStealer)", "value": "023e7c9e73b997a33476a2d958fb237395b098872854ce2e92af2b89cd87ca7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637202068, "uuid": "e150cf77-74a8-431f-91d0-160baf98bcd4", "comment": "Malware payload (RedLineStealer)", "value": "14b1574c8d64a8516e59bf26e115d416f52093a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637202068, "uuid": "bddfd75a-19a5-43e4-a188-37620b2bccca", "comment": "Malware payload (RedLineStealer)", "value": "41c5ffed7e7d6f0ac11935a013cd13324a326d2f0217d27e3d430ecfe89ca4a6f30cb9cf7138c6a5fc7731cfb6f32d00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637202068, "uuid": "59614233-ae9e-47d0-9db4-66852eb6188b", "value": "T1A025591962A19A3AC25A1BF7E03DC09487D197115162E3DBF5BB12E72E8B37D0BED0D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637202068, "uuid": "3f5001ff-2952-43dd-84d4-7c9addc24778", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637202068, "uuid": "00e97699-29d2-4c8b-8b78-f6df9565325e", "value": "12288:HsBWRwkRhdDsklRsIyIMYxvbsB1ibdjL4h0SePxVUcjEzy7qYXH4KaK:HsBW6kRfQklNfj9bsBQJ4h0pX7qYXYTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637202068, "uuid": "f029f142-f32b-4d0f-8890-b1dcd972f3c9", "value": 1020136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637202068, "uuid": "9fd34971-ea81-4940-a790-cc2273136c85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637202068, "uuid": "039ca672-ece7-41a4-95d7-09ffe7ff0130", "value": "5b0192d31dcb9a21714e0e0c9a2cb202.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85c3d33-48a1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637261996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261996, "uuid": "5d1cac2e-fe71-4b02-ba34-e800c21cbec1", "comment": "Malware payload", "value": "b7d4200f55fc68f6ac3488db9cdd82b5", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261996, "uuid": "a57844e0-0442-4841-a286-31cd79959bbc", "comment": "Malware payload", "value": "029691fe1fba75b378998499e9a7b5bf99affbc262f6616bbee086074d4a2258", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261996, "uuid": "35cf3be4-dafc-4a38-89a6-c110adb9be13", "comment": "Malware payload", "value": "25c673246099e9bcbb026c8ab713ffefd89a2607", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261996, "uuid": "60e37363-e83b-421d-a118-cf2af7779458", "comment": "Malware payload", "value": "4bcbdc3f6f180e21f5606403e5a726e30d7eea0352a80bc34f7ab678e60a913bc41da0c8f95d61562e38eca5416080ba", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261996, "uuid": "fe87ab0a-8589-459a-8e94-27553b1cfcfe", "value": "T13C852912B2BD44F7C1A736F75DDBA364B425BD3029289C4A2BE83D48DF35E413926293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261996, "uuid": "ae6aba96-9c1c-4210-9961-6f948827a176", "value": "24576:X5EI1N9XpjxxW5AoOZNbqUactkdNPa3azmTU+WL5e5GY0ASA:X5b1SOHKctkiTPWLMGY03A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637261996, "uuid": "fada6fa4-fccf-4347-84a2-acd36ab0b929", "value": 1774592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637261996, "uuid": "cbd51688-b89d-4dd8-b126-05bcaef2f1e9", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261996, "uuid": "ac3bebf7-1078-4074-a8e8-1fa749c79039", "value": "123Factura15062021_(977KB).PDF.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05aa86a-48bb-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1637273230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637273230, "uuid": "1f6a5d0e-bf2c-4d43-a3ff-ba256fdb80fb", "comment": "Malware payload (AZORult)", "value": "1b9b97bc621254042928cb526873e4cb", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637273230, "uuid": "30462da0-5586-4393-a244-a4be8466e509", "comment": "Malware payload (AZORult)", "value": "02d6463c8d80183f843d874ab427c11fc47b6b9ce472608be7be2498c0950ada", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637273230, "uuid": "0505e9fe-d33d-4519-8515-23466ae1ed0b", "comment": "Malware payload (AZORult)", "value": "8162c5d199a8d88b5136e01ccc129af0477ba40d", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637273230, "uuid": "0c369c71-2898-4503-ba73-39e0be8ce943", "comment": "Malware payload (AZORult)", "value": "6afb4484154dae0f58370730f04e65099c0cd783f40c9aad1c009d8de595f26b755041094e23978e7561e047b9c6c427", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637273230, "uuid": "d3f90268-fc42-4f32-bc5a-0532a31173fe", "value": "T19524CF21B292C072D55711398DB1D77A8A3AB8611761A1D76BE62F3E9F303C1DF3630A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637273230, "uuid": "a158e077-8b46-4dcd-9d85-9ad5ccd3db94", "value": "6195fe1585c70ac4c59d23b1b02df3a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637273230, "uuid": "d16ec151-0856-4246-b183-2125d3b7974d", "value": "3072:KMVirZTMWUgUScEAhur1qLQMdQZFrEFBWm16wijgcDI7iXvGDvZBN3+p:KKadMAcp+qLtUxA6wEciXvGDX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637273230, "uuid": "22d13e83-f0ac-4a1f-8fa2-337e87dc5b71", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637273230, "uuid": "c9840e8b-1e92-4e52-bdae-96c1a4e26133", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637273230, "uuid": "ecf2292b-dd62-4091-a469-ae3d7c72515b", "value": "02D6463C8D80183F843D874AB427C11FC47B6B9CE4726.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1904d9c8-48a4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637263017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263017, "uuid": "37bbb676-bb04-480a-97bc-2d3ba29f91fc", "comment": "Malware payload (AgentTesla)", "value": "dc9fbcd75d62269395420e4e347a9b31", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263017, "uuid": "3ea1783a-9ae7-40d2-bf45-1036e2f8c5bb", "comment": "Malware payload (AgentTesla)", "value": "0319c980cfa92a29165c6652194bf86af9ecc3a76d65b258a0ea2271527a8d64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263017, "uuid": "d8452abb-ae62-498b-b188-b9ae1767f540", "comment": "Malware payload (AgentTesla)", "value": "03d2c2ba6edd808b4fcbfdebde67a442011897eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263017, "uuid": "d4108990-a5b9-4b82-b9d7-88715f24eb18", "comment": "Malware payload (AgentTesla)", "value": "221508aa0917f385fa15d6f40851230b187c332c7d81cc381ff861fecc779728aee8472e3fb5cb18681b0f76f7b9d2bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263017, "uuid": "433c2e88-9ba1-463b-87fb-3abe7eac3aa3", "value": "T169159D328808B81FCEEF1F4275112FC37C39157BCE685458A18F75B96A689285C7AF78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263017, "uuid": "dff8a76f-602a-4b1b-8251-2ba1903610fc", "value": "12288:YwcZK0E7SFbxbT+poYM+2KvFnprTHtorjKLL9IsnLINC6tznoRMgMjSoI8H:YjZBjFbkpuG/HtoaIeLGbBSoI8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637263017, "uuid": "140e552c-7f32-4f67-983c-481555fb35bc", "value": 919411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637263017, "uuid": "578d6045-3af5-463b-bba6-7fc932d64807", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263017, "uuid": "cda63afe-b912-44b1-8108-c88526ba0145", "value": "new order for confirmation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0017995f-48a7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637264263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264263, "uuid": "f408a207-5276-48dd-aa77-c357f242fbb0", "comment": "Malware payload", "value": "0861b82ff3f144f1f97a3361ffb063ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264263, "uuid": "8884be46-f4ee-44ba-b0d4-8b3bad2fa42b", "comment": "Malware payload", "value": "0320de72a9cbd2d3a1a95b929713e43efdb919e2900c2432d00a16b313b59451", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264263, "uuid": "d2c52e53-83b2-40fb-af77-e310de9ed13e", "comment": "Malware payload", "value": "a3e2f0a857adf119397b201d68da44153163f37f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264263, "uuid": "3eb4d6bd-627b-4986-994e-816b4ec586a7", "comment": "Malware payload", "value": "9c4cd0c7c8ecada9ca827f7679a170e229be910c8990c541720a9df7b30f6e297a39624be91ef2714f40a1efc1c7c938", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264263, "uuid": "b3993a7b-3e77-445c-af1a-7730fb452f0f", "value": "T18275E01263DDC3A4C3725273BE26B725AEBB7C2606A1F19B2FD5093DED20121521E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264263, "uuid": "42c18eea-3c2e-4da2-9736-11bfe0bb71e4", "value": "bbac62fd99326ea68ec5a33b36925dd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264263, "uuid": "11eb39fc-f862-4e73-8cfe-333d5422abec", "value": "24576:n4lavt0LkLL9IMixoEgeaLf/NoOlp4JYRS5kKiM/XVNpw0ezG7q9MmCS:Ckwkn9IMHeaLfFaKRikKiM/XN3PaPCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637264263, "uuid": "2f0fd12f-6ce3-4b40-9681-8e08c0d1e968", "value": 1573376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637264263, "uuid": "99b0ae45-7a6b-454a-8ef8-e94e9ebce7ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264263, "uuid": "1fd4a538-c2c8-4e66-ba3c-35b2a5abc496", "value": "0861b82ff3f144f1f97a3361ffb063ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92fd63f1-4825-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637208675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637208675, "uuid": "466efa0e-fec0-4df6-9d4d-d017464d18ea", "comment": "Malware payload (Loki)", "value": "a86614903bd9adfacd05b2ec77a5ca9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637208675, "uuid": "c1054b61-5a9d-4cc4-9c3c-be65a21fb7bf", "comment": "Malware payload (Loki)", "value": "04648027cb82497087f5b36b8d2fdf12ce9412349c728500bf97c9418d729f0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637208675, "uuid": "4e707c9e-9977-4044-aae3-532ebb407230", "comment": "Malware payload (Loki)", "value": "8ffc79f5254bd1bc1cc4c2c4b25d307e89759beb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637208675, "uuid": "c7197663-5bd4-43d6-9465-b7690338c198", "comment": "Malware payload (Loki)", "value": "ed09ee8d1539e7992a1f863bd3b3500e03dbccd8ed37d9503cc61696e03d55b68b8237270a23052a03ebea62af40b587", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637208675, "uuid": "3af6f21e-69eb-480f-9226-9e2a24794ef4", "value": "T1A97423D2D6C16A67CE904D3C344CB1B45AF4C7C848289FDF19B6A74DF5811B4C732A9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637208675, "uuid": "76cad327-0f6c-455c-8012-2e6a647f08d3", "value": "7e92703dce499411055ffe61ec751d90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637208675, "uuid": "5c485433-5d02-44b3-be1b-69774151c556", "value": "6144:PBTV9vnOIs51FrHDpSEYHKV8hMlWrFXOkOHtbzPjS+xvRjdLMr:NV9vOIsNDcEYHzMlWhOkOHtvjNpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637208675, "uuid": "b0cf5552-d3c2-4c76-b58e-fbf155213915", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637208675, "uuid": "b0316ab9-7c5d-4c67-ae3a-dd2105823860", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637208675, "uuid": "6487d160-50f0-4942-861d-06cf71bebb3a", "value": "04648027CB82497087F5B36B8D2FDF12CE9412349C728.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58b3195-489c-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637259870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259870, "uuid": "10e9178d-759d-4fb5-a822-3f45eeb70acf", "comment": "Malware payload (RaccoonStealer)", "value": "82fcdbe5c0c44003806ee3cb7ebbcc0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259870, "uuid": "88cb643c-6f63-4b1d-8212-662cc6203b59", "comment": "Malware payload (RaccoonStealer)", "value": "057c94c9a7d7d2f63911469b1c25fac5b374d9f54a0d57319820df2496938bbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259870, "uuid": "e89e9905-9440-472a-bd08-4395be6dfd29", "comment": "Malware payload (RaccoonStealer)", "value": "f61e60763287bae7c06fdc924bbf63c197f22c03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259870, "uuid": "d0fbc1c9-22a6-4cad-992a-7f12a9f8d956", "comment": "Malware payload (RaccoonStealer)", "value": "edb897458ffeac1eec584ba6d7c60c8ab5eacadce3738cc1fef72ad2d55248f708c6999dc08c503abfd13c367ad6a516", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259870, "uuid": "cbb96ceb-9612-47d2-aece-c0e54efa1a2d", "value": "T19574BF00B7E0C034F5B752F88A7593A8B93F7AA17B2591CB12D526EE5675AE0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259870, "uuid": "6ba2da2f-85d8-4a91-8205-67b0c21277eb", "value": "9abf03d4e22c0a12cb29c8d67fb192e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259870, "uuid": "bea9cc98-fefb-4d27-9931-c7e96e89ff59", "value": "6144:LNSIUG6+YwtiM8/cmLFzVL2rIqFqqPSAhXgFwh6SmRqQ0JWqZy:/riL/BhVLt3IHhOwh6SmRMWqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637259870, "uuid": "9dc58bdf-2407-4a10-b081-d9e66a4f0f9e", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637259870, "uuid": "00e4cea6-e2f1-4943-a0ee-e3b5abfc0e1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259870, "uuid": "149fbdb1-e78e-4b39-9e89-277c4202cee3", "value": "82fcdbe5c0c44003806ee3cb7ebbcc0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e111f7-48a9-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637265474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265474, "uuid": "166ba885-c8ed-4aa7-b57e-7cbb81841261", "comment": "Malware payload (Smoke Loader)", "value": "613617ec09fa68027630a4789d68e859", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265474, "uuid": "0e799a7b-88e4-4965-addd-a92bddf6c269", "comment": "Malware payload (Smoke Loader)", "value": "059bbe167465c98898d9d17ea2bc3f6d66d1b5a83fa602cb0b26c0880ae47a42", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265474, "uuid": "74494b05-0a54-4f42-a419-475876147bfd", "comment": "Malware payload (Smoke Loader)", "value": "043cedd15daa6db5e0c5f27c1232e67e5a97871e", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265474, "uuid": "4925b7b5-9ce9-4990-a82c-fe5b343cf9d0", "comment": "Malware payload (Smoke Loader)", "value": "bd0971df4b6aac9f7b2d73558e545af8e7cc95e3290404821a1043603ab3f7377dc412c420cb827615030574ba0136c7", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265474, "uuid": "8f60864b-a081-44d0-921c-8b5f6ced707d", "value": "T143447C10BBA0C035F1B716B849B993B8B93F79A16B7590CF62D116EE5635AE4EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265474, "uuid": "941e1e4f-381a-44ab-b17c-a7385521b6f1", "value": "9abf03d4e22c0a12cb29c8d67fb192e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265474, "uuid": "28f3a45c-76e9-488c-a567-c95899fd9ad4", "value": "3072:Hf0Npf7ygJLixy1/R+HZlHZNHfAav6Wy658DwjzYkLY47O34RRYu414ADjeqqLz3:4+l5N/FiWwg0E7OIR6r2AXevr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637265474, "uuid": "19e13389-5766-4941-a70e-91c3bf86b100", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637265474, "uuid": "63dd577d-bc3a-4e6b-a065-653be00918ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265474, "uuid": "b99c97f9-62eb-4d2d-8bde-3f836544e67b", "value": "613617ec09fa68027630a4789d68e859.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21baf9fb-489f-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637260884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637260884, "uuid": "eb8e5e9d-8a20-43e5-9918-05bb59ad993c", "comment": "Malware payload (RedLineStealer)", "value": "320dfb6627ba74c96d10b24497bcfa39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637260884, "uuid": "a9a0dbdf-c4bb-4c19-9eee-f90d079fbb92", "comment": "Malware payload (RedLineStealer)", "value": "067c807a07a5a2aa8ee58f79bf846aa4b8c590dffa51f1525a1cfd5a63392557", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637260884, "uuid": "3758f74a-e627-489f-8702-06097a11b041", "comment": "Malware payload (RedLineStealer)", "value": "e721affa9784ea529a88d9ae37857c46754ec2e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637260884, "uuid": "015cc35c-e7cf-408f-9355-3e71654ad29d", "comment": "Malware payload (RedLineStealer)", "value": "39ba64626b7c69ed904428014d1de46699b837ebda50cc9c06cc3dfe1738aa434fd7a745d5da1f88527c98af304ccd70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637260884, "uuid": "3e65fd80-dd55-4557-a592-b529b7d8b2f3", "value": "T13584BE10ABE0C034F1B756F44A7693B8B93E79A16B7490CF52E526EE56396E1EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637260884, "uuid": "9a3f2f29-4bbd-411a-b597-ae0ac847afc6", "value": "5ec00bbaa469943db4b6795b01cc4091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637260884, "uuid": "e9e1373e-5404-45c2-aa9b-4b2c282a4490", "value": "6144:d/hUAC6pP6xkBLotTRzpfhgX3yQxuWNxSF6cmJNf2qisY28347a:jU6pHMTZpfWnyPWNxSMcmJ3is8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637260884, "uuid": "4e394e55-612b-434f-a651-49b1d05ef4a0", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637260884, "uuid": "5881fce2-9f4c-4fba-a9b6-294206c691fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637260884, "uuid": "907c6fdf-8940-4b7f-bcd1-6638c0f72537", "value": "067c807a07a5a2aa8ee58f79bf846aa4b8c590dffa51f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9352a2df-48a3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637262793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262793, "uuid": "69dc7bb5-cfc7-43fa-8c94-137e7abad1e7", "comment": "Malware payload (AgentTesla)", "value": "7d23f1694e37911b841060a02020981f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262793, "uuid": "192a1dab-aa80-4ba2-abad-030d608914ae", "comment": "Malware payload (AgentTesla)", "value": "076b900f6db95063c95612f8085616259365064524bfe24cd240a5b93399d277", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262793, "uuid": "5ef08d09-625a-4fa4-b73c-0a68f61bc57c", "comment": "Malware payload (AgentTesla)", "value": "2a592516ae370076cb087f9aa28c1fa906117e14", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262793, "uuid": "bb45fdda-fbfa-4bca-8903-c0bf700c2f31", "comment": "Malware payload (AgentTesla)", "value": "7ebbcaad507db70625c9e3df8e52e9007c38cfb2a38cdf503076f09d7cec413141299919da03cc07a0afd0c99b63951b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262793, "uuid": "622af69a-5ed1-4139-9e98-71ac1dd36a20", "value": "T162B4026A93A88B37D5B907F99065FB3902795EE07824E7489DC078DF3E727420932B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262793, "uuid": "b8a350cf-dd6e-4df9-b624-2374a8dd4e7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262793, "uuid": "dacad961-5f25-4ca6-ad1a-400cb1fe870a", "value": "12288:2cS9ZMW/1bVlqfhUOSeU8SGklGg5ASZwKNtNtmk:k9Z5NLqfh9SGkF5ASwg3tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637262793, "uuid": "0f1ece5d-1503-4e30-9c03-db06a0b2a523", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637262793, "uuid": "a6191ba6-1304-459c-91b0-a55afadbc555", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262793, "uuid": "25251981-c2bc-4108-a852-7d524fcfe657", "value": "DHL Shipment WaybillDoc_TransportLabel_3990350980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440a394f-4887-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1637250634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637250634, "uuid": "41a1b41b-0b05-47fa-9e48-2411f722fe9c", "comment": "Malware payload (AveMariaRAT)", "value": "b8ade164ec1a5e394b964dc98cf56083", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637250634, "uuid": "f41c1a36-3ee8-4d8e-9387-b923978d4326", "comment": "Malware payload (AveMariaRAT)", "value": "0869c7903ee97fd7ba12a3913727719e555c478609fba806199d7eb19e49be76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637250634, "uuid": "ae88264f-21be-41e8-a5ed-d0c95383df33", "comment": "Malware payload (AveMariaRAT)", "value": "0fec104404053c2ab7ab6a27fa738eec9176d70e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637250634, "uuid": "60ab15a9-fef6-4ef2-9526-e6fd5bf14921", "comment": "Malware payload (AveMariaRAT)", "value": "b413d8219b2632a8289bfbe1976cbb21ab7992de389ed030a24d892056180007d923b259f482d77efd94ef87c3508494", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637250634, "uuid": "9c0e9f89-d8de-4cea-b02c-63e814540bcb", "value": "T1AF54D3A26502AB2EF508FF73C35FB71878606EDA6CD2465CD90E372855381F54EB6388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637250634, "uuid": "12d59cf9-7764-452a-9f59-d755daa879d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637250634, "uuid": "544a9ffc-3553-465f-be26-87c250249a19", "value": "1536:2P3aumhG5G4VskUKrBa7HeZxPe8rGB0By:2AMxaWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637250634, "uuid": "6d15a189-8508-4e52-bc3a-99eac73fd38a", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637250634, "uuid": "43b8f656-666d-434c-adfc-e657a65cc90e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637250634, "uuid": "abe7d36f-2d6c-4880-bff4-1276cd37c9b0", "value": "b8ade164ec1a5e394b964dc98cf56083", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44147248-487e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637246768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246768, "uuid": "c1260226-295b-4b20-91ad-073494ade2da", "comment": "Malware payload (AgentTesla)", "value": "5dc8b661bea6352f359cfc3aa7d60d0a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246768, "uuid": "89babb58-6b03-4889-9937-0b224c430962", "comment": "Malware payload (AgentTesla)", "value": "087bc603025a544ddcbdc5bfa33af67931dc4b1d914a3b856a0d98039c908b3e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246768, "uuid": "f306f04e-f48f-4e17-b1eb-eedf40551086", "comment": "Malware payload (AgentTesla)", "value": "0c230fd8ddbbc1ce37cb472fda47255aee402c4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246768, "uuid": "fb18f4c3-0d4b-4118-a4ec-fade0d84d25b", "comment": "Malware payload (AgentTesla)", "value": "fd031a7212a6008d6939ea398de5348271027a43aa9a6b2f42d2e6b0914079b6d31edc8993e0a74409554c8ade6eb51d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246768, "uuid": "e52fd933-dd0a-47c9-b0fe-6b5414651a77", "value": "T1E274E17C37AB6FF2E75E463AC2A5004447288D2712C3E35FA58709CA9CA63DF9411D97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246768, "uuid": "4138b14c-c1a4-4017-b214-b9b62d15dd7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246768, "uuid": "74ce9f99-9643-460c-b85f-0fb060ca0087", "value": "6144:y9J7ybnFSbEI0ko4VpPiDdHbVpMRR/ofoMxezxTI1c2G:6yTQ3o4VpPcBpMooMEzxcSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637246768, "uuid": "6c52d3ae-c585-4d1e-8d78-7cf1ad336dea", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637246768, "uuid": "caa607f7-3bf5-483e-abb9-613e654043eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246768, "uuid": "5893b045-4c91-4363-ac37-a04923ba4c69", "value": "order 00023747757 Dated 11182021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54bc040e-484e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637226180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226180, "uuid": "75920b93-56ec-48f2-a6ad-84926573b37e", "comment": "Malware payload", "value": "9f25ab4cd58fd103f55508a65a2994c8", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226180, "uuid": "63f315eb-4d94-4b35-860c-75fa837463af", "comment": "Malware payload", "value": "08d74984e5402fda2167b43c228eabe1687100a819edffc7d1ac083eefb29bf9", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226180, "uuid": "a9601eab-20b4-4304-9e84-f60f4708a211", "comment": "Malware payload", "value": "0742ec2d2fcc3d89fce4b8009910ab0a3455ecd6", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226180, "uuid": "2db79064-8c47-4224-a2d4-06941da94595", "comment": "Malware payload", "value": "bcbd3d1914cff90ec3507bfa58c6af48d84ee245f636a6b080687cbbd2e32fd8cf0cc99a02e95d12f564679532bae2fa", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226180, "uuid": "e7bf1f88-7143-44e1-a1f9-e380dbef00d1", "value": "T1CA3412E476F30A0CC67BA7386B141492DC9DED63308AFCF9A955B80603B5CB45487D9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226180, "uuid": "75b30d7f-b09f-45e2-b864-e9868481ff23", "value": "6144:E6NgeZPW5ODqBB/iG7sf6IgHgQwMB5trVEp1W+jQfRsWZ:9geAYhG7sf6IxQx/VYPjWeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226180, "uuid": "7c4cde7a-81b6-4b8c-a65b-2783b76493b9", "value": 233448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226180, "uuid": "c711b6f7-f025-44f8-ae0f-d6e8e267b016", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226180, "uuid": "a56f783a-de94-4ff0-85ed-ec3ba0acb92d", "value": "1156B10-21X0.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f5f293-4862-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637234928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234928, "uuid": "f450f65e-d4a1-4ba7-ac69-9a041de9e319", "comment": "Malware payload (Formbook)", "value": "fb6533a557c91fe2666ec0c83c8d2222", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234928, "uuid": "5fedba37-00c2-4762-9510-15aa293f857f", "comment": "Malware payload (Formbook)", "value": "092136c57be5920feea805d61d41b309ba138c209b8e22e7f3edc7c5fd2c3422", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234928, "uuid": "f4215bcd-4187-461f-be6d-3351885d6887", "comment": "Malware payload (Formbook)", "value": "aafc569c743b5ceff8c83483516deb8b5a6661ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234928, "uuid": "aea697c7-447c-4ea1-a8d6-52bed142e792", "comment": "Malware payload (Formbook)", "value": "b801a1e6b0c0df705b481563dd0091c1a9672235f155e6b8b5cbbd6552d85c5b3239749bc423fc1b8278f195758dcddf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234928, "uuid": "b8cd52dc-3194-4cb9-b5d9-a10f87fbe747", "value": "T126B412A5B6A0DC0BC384A77C48B7F3AC5A3482D43DDB9A57FF0059FA3D50B5E1128692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234928, "uuid": "95b00557-9011-4f2c-be53-0a0afb970acd", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234928, "uuid": "42214eb6-0374-4ba4-b745-b50f55977853", "value": "12288:Ker8teycAQI2wnAxfB37WFcn4+0h0M1rN6t12IXqUdK:UtVBnAxfdOcnH051rHW9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637234928, "uuid": "2f6ad24c-661d-4b9c-95e0-a7b1d37022dd", "value": 526835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637234928, "uuid": "6b5746f5-7780-4190-819e-81576c6d3078", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234928, "uuid": "dc12677c-9022-4740-9447-8076a32fefd9", "value": "PO_0008610326.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12a46687-4817-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637202447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637202447, "uuid": "e923214d-3209-438e-b6f4-273a00b05c82", "comment": "Malware payload (Heodo)", "value": "6231c8b3e1986e4c2b5a7e753405e4b0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637202447, "uuid": "33620037-f6a7-4d45-820c-3d84d10526a6", "comment": "Malware payload (Heodo)", "value": "09ff538fa5cf5e28718efae92e13187b35a274a3fd53f6541676af19fdaae778", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637202447, "uuid": "25f53a2d-d928-486b-b767-36eb4999c463", "comment": "Malware payload (Heodo)", "value": "d3ff5969821dc440ded985a8c9f787e3b1a59985", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637202447, "uuid": "d99ab32b-ce1a-4983-a97e-25312602bc62", "comment": "Malware payload (Heodo)", "value": "f1f6736aeb62020a4cfee82ab477518738a57d1e379b9673f01f5352c2b2a599cc54a4a99f7df56ab30dd7bc3670161e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637202447, "uuid": "8b7fcbd1-a24a-44b1-8d71-4b006ec1098f", "value": "T17644BF10B1809032E9BE593645FAC56A8A7D7A600B90DDDFA3980D7E4F775C1FA3089F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637202447, "uuid": "a3381230-eae5-4650-8f0d-8596f1a79010", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637202447, "uuid": "c26af2e8-3584-407c-b6a0-f435349b7ceb", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBC6asb:prf+WPVXNcwUKaWTXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637202447, "uuid": "0f2530d4-6264-439e-af76-7d07ce180221", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637202447, "uuid": "da7a5315-58ac-47c7-845e-54697c820a4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637202447, "uuid": "bc9e7b37-d52f-4ff5-88a5-4fd6c3b1ef27", "value": "EqYfi5gG.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a739b61-4802-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637193629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193629, "uuid": "48e65997-3301-4e7e-be51-a63876de1e69", "comment": "Malware payload (Dridex)", "value": "ed74aea6615efe95a6be3cc328d8d3aa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193629, "uuid": "7e961f3a-f83d-41e4-97b6-011c9839586c", "comment": "Malware payload (Dridex)", "value": "0a67e8370883a0c86dc3d6dd9a8798fc2d46ed3e863e0a1a5ce55853becf6143", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193629, "uuid": "2cc99b90-524c-40f8-a0ae-b2f92b91353f", "comment": "Malware payload (Dridex)", "value": "fd428ce33f34942ee737b479dd5912680ef86b90", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193629, "uuid": "745e1d7f-41d7-4a10-8d37-b8e3f39d7ab5", "comment": "Malware payload (Dridex)", "value": "b25c46000c0a8e893794933a3030ba96d44aa73e78ca42b6e2bcfdc284515eb730f8538e0d64555447855387022946c5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193629, "uuid": "c4fa87c8-9612-488f-9327-725e7a259f93", "value": "T1B9E48D067CF9989CD511ABBD421E86FB8BB089B784D0CAC1C1199F3A5C17BDBE54C62C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193629, "uuid": "a336606a-e06b-4c63-8df2-be59ad8b123f", "value": "43b460ede91c0828a2b4acde6b98d16d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193629, "uuid": "64e44b14-11e5-4cc6-8edf-4c552c4a2d95", "value": "12288:B9we+YtfLwxfZYnfh0xnf2xfH6xfpaEdk9qcK05GDdiO2cGoOUwg5v:B9we+YtfufkfonsfYfpuN5GxiO2cGoOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193629, "uuid": "784088c1-55f7-427a-8a5d-d757d80c130d", "value": 668520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193629, "uuid": "1030cc2b-832e-471f-acc4-535aa344c941", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193629, "uuid": "d1e721bc-47f4-4998-9b0e-11f80aa16f82", "value": "SecuriteInfo.com.Trojan.Dridex.777.24937.26485", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1474fdd-484c-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637225503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225503, "uuid": "1a82e6a4-c48d-4e1a-acae-71c80631607a", "comment": "Malware payload (SnakeKeylogger)", "value": "c95c03ddaad2aefec42f5d58b4fddb9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225503, "uuid": "99d8f5b1-8317-4470-b3e3-e7b51515ad92", "comment": "Malware payload (SnakeKeylogger)", "value": "0b0de2e9fb56c0313a746ebd10647957fc6465cd12d3d3ce1263ff34946be7ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225503, "uuid": "f439e1c0-4009-4cf2-a521-bcfa1b754333", "comment": "Malware payload (SnakeKeylogger)", "value": "12ab6f0d804450d6a66126abc59cc423b5ba59aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225503, "uuid": "567a01ce-b016-43ed-a8ee-cb0781ff162b", "comment": "Malware payload (SnakeKeylogger)", "value": "c4a2ea067da35e5731574e0c4adf89771e81ef5a35d99c48b4838e3af01836cb1de59f5aaa350d33421b9337f03a14da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225503, "uuid": "3fcfbfc2-e2e3-4bba-a6aa-15c8069919d3", "value": "T145D49EE83574F49FD722C476CAA4DD799A70306A0FC7C203B45B16DEBA0C766BD181A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225503, "uuid": "850c3cfb-f75d-4a54-9321-77508a30a899", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225503, "uuid": "ef003225-c775-473e-a1da-af697bfe3e87", "value": "12288:hXNMSm31gW7UsEtERaSATt3hEMAG6CqO12w0denPJpCpM7:tNMSm3KWQltpSQSFCqU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637225503, "uuid": "69c0b1d8-610c-456a-8fa1-ed4cf86a5d56", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637225503, "uuid": "63769ab2-c1bf-4f83-b09a-cd7dc37da018", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225503, "uuid": "e1a4a5bd-827a-47a9-917d-32b66cc87077", "value": "ZiraatBankasi-20211118.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8246c5-484f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637226599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226599, "uuid": "f423bd92-0172-47ea-b9c0-4ef21c713539", "comment": "Malware payload (AgentTesla)", "value": "eedc8570b967f58ae5ac83bab1fee9f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226599, "uuid": "77227469-1a23-4d37-8034-0b78ad0cee14", "comment": "Malware payload (AgentTesla)", "value": "0b0f285f4fe071a243209eb7669f0478dab92330c73f4e3baf35c85330de206f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226599, "uuid": "661d7493-bb9c-4aa4-b27c-79e4e406caac", "comment": "Malware payload (AgentTesla)", "value": "bd2c92f7ef3e34b83a4a6aeb64b0408544a09354", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226599, "uuid": "90e99ca6-6ebc-4758-9c01-2756fe57ed1f", "comment": "Malware payload (AgentTesla)", "value": "a1b75043596a67196838858ca463ebd1323d3ec76be9571a85675c490403822b75b83e0b6d32d5bb0c1ef193787f1e55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226599, "uuid": "3b107131-13d7-4343-a2a4-892385679d96", "value": "T1A8D4EFE036B8C427E77081B6C5B1D2BA4FB0B15D1ED1C6427D9E6ADF7628764BC28312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226599, "uuid": "26754066-4217-4c64-b7bf-f2d75513a619", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226599, "uuid": "09f675dd-30f5-4916-92d9-611f8f051408", "value": "12288:Gcm31gW7TxM7TVlqQ+wye3Xelx5MWQvWmd0FcDJPHjrkS:3m3KWB6TuQ/KazJdK6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226599, "uuid": "431e80de-e38b-4cbe-b68b-7003b9fc3ca0", "value": 654336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226599, "uuid": "0098c87f-9bea-427c-a48c-f1b188ca1747", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226599, "uuid": "752b3cc6-f74b-4799-9d3a-6d9403951073", "value": "DHL airwaybill # 6913321715.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2b983b-48a7-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1637264307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264307, "uuid": "9d083161-f44a-4c2d-8250-f29ef48078b9", "comment": "Malware payload (AveMariaRAT)", "value": "c15f7767b4b24e9c71382a0ee1df8adf", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264307, "uuid": "128f84c9-3809-45c4-b149-5a652eee1ebe", "comment": "Malware payload (AveMariaRAT)", "value": "0c4dc605ccb6774573209bed611fd46e653b1e6dead46af183051bea0072ac6d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264307, "uuid": "3d54857e-b31b-4e7c-b26e-a97a2248e522", "comment": "Malware payload (AveMariaRAT)", "value": "4e8d0a4e35bfa9d373607ad9a1e56108e4dc514d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264307, "uuid": "28091001-ca1e-4658-9e8e-3096c4746d38", "comment": "Malware payload (AveMariaRAT)", "value": "6767fd147db844bc7ac9bc4f4b031e4fd4d38b9ea682f12168143504bd6116c6da24018b2d334d2d842df3fae18f06af", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264307, "uuid": "18010f7c-6784-4edd-bb48-f04968764867", "value": "T139D4ADA036B4DC13E360B1B78561D2FACAB0BD6C1CD1F6067C99769F7A64B607CD8212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264307, "uuid": "1a356adb-8512-4a71-9685-3cf1ee705327", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264307, "uuid": "c4da7743-6690-4ade-8c4d-cd8c76ff58a7", "value": "6144:mo9uKUa3HXkh22hlECn/KqS15VIFI7M5IBOyVZsPl+3W4WHFvj81ErSoQA+1emU2:moqm31gW7+18oqrDDFMiGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637264307, "uuid": "e23dc8e6-dc15-469b-b115-41941467430a", "value": 635392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637264307, "uuid": "0da63e16-e08e-42c4-b87b-a0cdbd866e50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264307, "uuid": "f300d269-2457-42a8-adfe-3c08ac969636", "value": "c15f7767b4b24e9c71382a0ee1df8adf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9277bfff-484c-11ec-843c-42010a9c0014", "comment": "Malware payload (Socelars)", "timestamp": 1637225425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225425, "uuid": "376183cd-6edb-4a2f-a47e-d65a956f0313", "comment": "Malware payload (Socelars)", "value": "54c05aac2960455681d946dad6a7cfd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225425, "uuid": "dabff039-443d-45f8-a545-d7928c579240", "comment": "Malware payload (Socelars)", "value": "0cf605b9f4173deff53a3d3a84811e7acc9fadcabf1237ac6f2b313b1701829a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225425, "uuid": "06ec59cc-8715-4f7a-900b-baa684f46f2f", "comment": "Malware payload (Socelars)", "value": "80f7559b71693c1f83a85a765be311e4ed722c9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225425, "uuid": "d8fc9ebd-2cc3-4ca5-8dc2-3dec010dd436", "comment": "Malware payload (Socelars)", "value": "d4c8bc69dd41b8c7981a67e86c2a1b16f885d8448b742cdc9be6d847129956aad3c6fa0ac47be2127d17f3350b5e66bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225425, "uuid": "2b856789-6b9a-40b4-a4f3-1c1aea0aba20", "value": "T100659E21F742A036ECE3107281FF47FE9D38BA21070854D7E3C45D6E6A619E27A3765A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225425, "uuid": "ad16509f-cac7-4003-a224-21bdba78d75d", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225425, "uuid": "61e9d96c-38be-4c57-a276-5456b8d2239b", "value": "24576:j/HpQccsl8Haz/hvzfb4ckjel4f2Ubf1taARylMuqSvHg2ixn:LpkXA+JespRylMxSvHgbxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637225425, "uuid": "b4c46052-656c-486b-8aeb-76123838f107", "value": 1455547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637225425, "uuid": "caeab7ee-fa02-490e-8516-a714300ce1ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225425, "uuid": "6a2ae56b-f6be-481e-a499-7ba1f7fbc522", "value": "54c05aac2960455681d946dad6a7cfd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d89690-484b-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1637224979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637224979, "uuid": "8cd9a273-fb67-4cc9-a068-2c284be868fd", "comment": "Malware payload (BitRAT)", "value": "0457f006c73c5442b0fd82685729cc82", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637224979, "uuid": "766afa45-9231-4865-919f-4588d82f78e7", "comment": "Malware payload (BitRAT)", "value": "0cf6826931ba6210e8dc7a99287c4839e20bca413b9844f655d9dcc9252cf164", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637224979, "uuid": "661a523f-bb88-4013-a3fc-8cb940d395ac", "comment": "Malware payload (BitRAT)", "value": "858e1206440adbfaf511d346b83158b6aff9c8ce", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637224979, "uuid": "0a82b18d-7bf4-4a15-a4da-0301829cb4a5", "comment": "Malware payload (BitRAT)", "value": "8461640aff603d0e6b01984e5c2d45f1e59f11454c00284be06c97841f302cb7fac324a2dd8255bb058355b7d5d5033a", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637224979, "uuid": "b7e049dd-dbc1-49a8-8b58-717dc4ba02b9", "value": "T151746C1377074506D418ABB4EEB7BB311721FEFA59714707E2E17A2E503F2AA3680726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637224979, "uuid": "ab76f083-bb09-4e6f-86bf-d18f6188bd4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637224979, "uuid": "63d6fdaa-e2cd-467c-bcb3-9e0c40ead1e9", "value": "6144:+VS30jkLDxTMC4viLm84aJ+/kTXkgVHJYiL:ITjEFAES8XZkgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637224979, "uuid": "788ccdbf-3218-4c51-8912-c9dd48554790", "value": 348672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637224979, "uuid": "35b6793a-c231-4c94-b4ea-de746164d2ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637224979, "uuid": "476ad5f4-5846-41c8-8dfd-9684479cc80e", "value": "0457f006c73c5442b0fd82685729cc82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0fb9da0-486f-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637240482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240482, "uuid": "8993feb9-c775-4fd4-aa4e-074306527383", "comment": "Malware payload (RedLineStealer)", "value": "d9305963f33b51e092a62058dc1778ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240482, "uuid": "2b752619-fbfb-4c88-a151-c1b6d48e8e43", "comment": "Malware payload (RedLineStealer)", "value": "0dd171d325f25de39f62bfef5fba30d0f2551079fade53987f535ce9894eddd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240482, "uuid": "9008e37b-b315-410b-8e96-b6d006348467", "comment": "Malware payload (RedLineStealer)", "value": "6814e86086351cf40e08f36e3a32cd3011a27570", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240482, "uuid": "43d277be-a4e9-499a-8d92-7d8921ec048b", "comment": "Malware payload (RedLineStealer)", "value": "2bafa789f0be0a3a549a39c3fb4cece0a29abd0ebd7d8300101824db3bfd4bde24293afa42dac951c7090ec403385e48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240482, "uuid": "ccf4db8e-347d-40a0-b081-03237a61116b", "value": "T11016330B9A8F960FD187B7BEDE0835902D1363698E2DF0BDC479CA35BCF94624A50536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240482, "uuid": "8c0bf014-feae-44fb-9bd6-ae72ee37c3e4", "value": "e48cc266501c282987b27f2c1f654e2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240482, "uuid": "3254a99a-d0b7-47e3-a116-54ffa6e5e18d", "value": "98304:oQ+xFssOMxi+LtYvZ9UHQYHiHCejQZrlWtUalSjSD3fdGokjH4Xj+txJ:ejssRA9UHr6kXWtUalSjkvdGdHOWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637240482, "uuid": "373a63c1-bb96-4db8-bad9-808502830a50", "value": 4404736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637240482, "uuid": "b8d9d0b0-6428-45fa-a358-70ee82913c04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240482, "uuid": "3e57bdca-ea14-48f8-8337-96edc0b51f47", "value": "6814e86086351cf40e08f36e3a32cd3011a27570.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b48bfcf3-48b6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637271009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637271009, "uuid": "1c05df38-f7de-481a-af63-932cf2e89afd", "comment": "Malware payload", "value": "e188ccdf5a3a6b5e90d88f3b0fba273b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637271009, "uuid": "51e71ed8-36f4-430e-ad66-0d9867b0638b", "comment": "Malware payload", "value": "0e2cb448df93006283f5f7c83b290cbcfc8157eafd1a9b004ea4064c40d18e4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637271009, "uuid": "430f9332-70ec-4891-b5b0-34cdce702e09", "comment": "Malware payload", "value": "ff454b2f476244227b493e7a645a60ce3122c395", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637271009, "uuid": "75ce08f8-ca0b-497f-852a-5d9290a90a28", "comment": "Malware payload", "value": "9b0f0dc5041b2422c6e1fc23fc2ec0e99604e4337a21dda3525b00e934dfa9328d8c0e4101739777dcf265a947515611", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637271009, "uuid": "2532a8d8-b9a9-4890-a1aa-66ba5dd95679", "value": "T13F54E055B1E5E4B0C18BC976DBB4F5E98A3F3822AFAB50DB458A374C4D520E0DE78C60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637271009, "uuid": "41569f4d-75f8-436b-8021-61f65f600e34", "value": "63a806c199e422807de783c1c09b5907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637271009, "uuid": "69825701-d203-4608-a5e2-a383bdb4d6f8", "value": "6144:1YrE3FSbNG2sB5TJ8F/p/uwONct43j92U:1/IPo5C9pGHNu4B2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637271009, "uuid": "7fb7b688-e77a-4dce-a822-ec35c8906eac", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637271009, "uuid": "d640f7fc-7f65-4207-b3bc-55f9eb190812", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637271009, "uuid": "d14fcd42-94c6-41e5-a78c-81cbd071d62f", "value": "bird.png.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d85e406-4853-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637228235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228235, "uuid": "26966dd9-9df4-4772-bc27-26d99c469a9e", "comment": "Malware payload (Formbook)", "value": "cedc7056c435a629f10a443b40d6a818", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228235, "uuid": "4406e6e4-3012-4126-b62d-c00433dbe704", "comment": "Malware payload (Formbook)", "value": "0e2e801a0cc0e4257442d1243a17ae2ec7e7057cdb4a41a899d9aec7eb77cfbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228235, "uuid": "7f3304af-5e37-42c5-a3e1-81131ee55e35", "comment": "Malware payload (Formbook)", "value": "508cf8b71f106c43997358508df7661e7c074776", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228235, "uuid": "43a1ebfc-d338-4ed1-a0a1-0a2e802e5a04", "comment": "Malware payload (Formbook)", "value": "139b52246e93e67bc9e166af734ed5c603cfbefbb0205ec5611d25daa3188f6ecab449a1fc6ad97fa01134a705d61a36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228235, "uuid": "8a1c1701-19da-49ff-9b98-5b9688f43f32", "value": "T126742319B6C063F7C58345B00AB3EF2CC2F865ED11151463A794AEBE7253B82594E2EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228235, "uuid": "b66455e4-ce2c-44d2-b9b9-1dd9603750e5", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228235, "uuid": "f03bd88c-edc8-46e7-9ed5-40c6aa30119f", "value": "6144:rGiptWDXRVqqt0gfw4Ouy4kCvCRMHy3zUCcToWOp+qwXA/r:fcLo4OuyRrKSUhcWezwXAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637228235, "uuid": "7a2306ba-28af-47c0-bfb0-4e3f8604d8b8", "value": 343915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637228235, "uuid": "409a6bc3-a2b9-4417-8a78-ee1dedf50599", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228235, "uuid": "b9324888-d676-4b43-9f3d-a697599c97bb", "value": "cedc7056c435a629f10a443b40d6a818.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd7a14d-4803-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637193874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193874, "uuid": "0381ee40-2719-40e7-94ef-58dca36e7a7c", "comment": "Malware payload (Heodo)", "value": "d02f33af7a5d1f6563b5b621f13ebe1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193874, "uuid": "ba7806ac-4702-4408-bada-c198c86c2295", "comment": "Malware payload (Heodo)", "value": "0e73d913d476471aacabe92df1060933dfe94325dbd19c1382dd8fbd51b33a28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193874, "uuid": "67d8e812-132b-4d2a-bf7c-9c6c14762900", "comment": "Malware payload (Heodo)", "value": "b653447a746ce6f988757a2f202928abcf812c34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193874, "uuid": "348f9fbd-55ae-4c17-8ef6-9167e48cec3d", "comment": "Malware payload (Heodo)", "value": "62d6b6dff92fa3600bdb6d66d3782ca61980225d1417282f092d3eaa139aefe41811f2ba508d3d35ead1e853cba5b0b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193874, "uuid": "29f22b0a-5cd7-48ed-aa01-6515a7375802", "value": "T13C44BF10B1809032E8BE193645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193874, "uuid": "7d6d5ecc-bc8a-4764-8cd4-de2d7380766a", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193874, "uuid": "7d5bb824-48dc-4a74-b5b9-caf8b8a9895b", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTB4C6asb:prf+WPVXNcwUKaWTyNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193874, "uuid": "a313191a-f2e9-4ab9-b989-a34e68db3b1f", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193874, "uuid": "1f56c8f8-054b-4e9c-bce1-5f2fdd11f2bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193874, "uuid": "8faf96d4-e7d8-467f-a0e9-aba365fe5530", "value": "d02f33af7a5d1f6563b5b621f13ebe1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfeca39f-480f-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637199302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637199302, "uuid": "0793edf8-51dd-4ed6-b7ea-80d12eaf0471", "comment": "Malware payload (RedLineStealer)", "value": "725b3d936e1b57e9d65b8f307226e31e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637199302, "uuid": "1eee4416-5c33-442f-a9f7-8abae3758cc1", "comment": "Malware payload (RedLineStealer)", "value": "0eb3dd10a000208a20b1c8426be9b2241db72ff724d81a4c5809b90f3360027d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637199302, "uuid": "a4c9925f-ed2f-4c32-8fcd-8dbaf91de6e4", "comment": "Malware payload (RedLineStealer)", "value": "7ef5118f5a90a27dddef37fdfca885edadb4a981", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637199302, "uuid": "12e82eff-a2cc-4c7b-a043-6aa17abbdce6", "comment": "Malware payload (RedLineStealer)", "value": "14a7da8fa106a56aeae04fa404755e44347e6edcf8deb4ddec9f6fa473615f7e27258273c999614cf8836620a84f3843", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637199302, "uuid": "4e92ec3e-cf70-4cbc-9e43-01418b38c315", "value": "T1B87401522D4AF718A0653F338ADFE7D793B21EF14A334AC75E099A1311601826EB3779", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637199302, "uuid": "d4c3f86b-eb92-48c4-9548-c2137e87288b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637199302, "uuid": "0282601d-4456-4164-872c-a011fab2a99b", "value": "6144:mINPUO2BAw8soNpzV2HJRUf8anq/SdJr1uktq3V:TNHwpoNpzgpRHanq/4RuktEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637199302, "uuid": "4a5a7074-fb19-47e9-8146-1771e659e242", "value": 353688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637199302, "uuid": "abe10352-7513-4d97-ad55-4df16e78a293", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637199302, "uuid": "232fbeb5-ff19-4b33-ae2e-93b371536853", "value": "725b3d936e1b57e9d65b8f307226e31e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10ba8aa-4875-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1637243166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637243166, "uuid": "c2605301-3fb6-450f-afcc-036eeae453cd", "comment": "Malware payload (Vjw0rm)", "value": "60cc1e4fa39514502caf3dc86f8f8662", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637243166, "uuid": "105f88e3-a144-46b9-899c-eeae42a69f97", "comment": "Malware payload (Vjw0rm)", "value": "0ebf684ac457414e7b0e91ad49f9854b0e75c147af739aa70e059b7b76300373", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637243166, "uuid": "2177bb47-a6be-49cd-b66e-79ead0b9e05f", "comment": "Malware payload (Vjw0rm)", "value": "f9747e9a5e335c9be2464010a48f6e5a487ca078", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637243166, "uuid": "2ef36293-eebc-42d8-ae70-9a766244a01b", "comment": "Malware payload (Vjw0rm)", "value": "9d89b9e8cd1ef2c0ef5cb4acc11603f67242b940a5c4241b9f22cbe42dc5ab6502fdcf764e91c0539b1c98a61c02ff5f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637243166, "uuid": "b7e2c4f2-d625-4e6f-bc86-8419c8196165", "value": "T19FA28D85BF817E559750902182BE5F1C2BFCC282F924D14D7513F2847AA7589EA2FB0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637243166, "uuid": "b8a9242e-e85d-4e74-9a84-e75328c00b1c", "value": "384:4Rh8st0pJsBkYBP9BYDCDuEVT4JYDCgQihqFv51RYW6t04B1e09Bqd7LJrSvqnoS:4f8st09WP9BaNOT4JaCgQ8qFx1z6y4Wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637243166, "uuid": "b8727646-4e59-43f5-a46f-b75582522d65", "value": 23059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637243166, "uuid": "043f299d-87fd-47dd-ad1c-fdd503c4be74", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637243166, "uuid": "35450766-88aa-4cd7-879c-a4e17fb2696d", "value": "bcmqFGlSVu6430.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2344a42-48a7-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1637264643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264643, "uuid": "52f6f359-1189-44d5-b156-98248e399ef9", "comment": "Malware payload (Metamorfo)", "value": "75ca4a81030978ec7d641ea1e3cc151b", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264643, "uuid": "532fe73d-24b8-4bd5-a855-18b8e668be12", "comment": "Malware payload (Metamorfo)", "value": "0f5cb4a7d08f41d879d9a847c114caf53d60351736b34cdd5329e1884547fdef", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264643, "uuid": "a6580a17-dfdc-4e88-ad0b-2a6c590500f0", "comment": "Malware payload (Metamorfo)", "value": "c0426648cc09f7b1062c4e7492f5be53eed810c4", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264643, "uuid": "33a450a7-98d8-41c0-830e-89f14ce5b2ca", "comment": "Malware payload (Metamorfo)", "value": "511208b52ad556367dadac7b8cd5bd4886547bee67320b69ac6e49e1f68fbacfcf3cd1bea73881c225e0a7422e838eb8", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264643, "uuid": "2c5d54f0-68ee-4efb-8063-57d36f5ee25e", "value": "T19A41D0116AF60729C2B7CF7618F6A2868EA6BD51A9434B4F8044479B5862280EC32D6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264643, "uuid": "d224205c-245e-433a-8f9f-58a875efb470", "value": "48:8+uH+M+LmJ0jcbX/qNi0i1cIXv3KaIqiHkb6NS6:8+ueFLmlbXiQ0i1cGvKdEbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637264643, "uuid": "f746e849-c64f-4cc7-bde9-a55bd4e992dc", "value": 2006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637264643, "uuid": "fd642f21-0698-477e-8dfd-7e001d336595", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264643, "uuid": "c1491c43-163b-4781-baf7-5f66f16b3e00", "value": "BoIetos_Novembro.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22bd2a8-4863-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637235330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637235330, "uuid": "48911b8f-3b41-4774-b4d0-d4c32cf605aa", "comment": "Malware payload (Formbook)", "value": "67422687237ede2e120c07a854c57677", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637235330, "uuid": "9d062107-4f7f-4fda-947c-652a114b1a46", "comment": "Malware payload (Formbook)", "value": "0f71db9b3323ec4ee05ca87d0f3190de6f8380f94c90c8b2aa27a75ddbb804fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637235330, "uuid": "413e0a2c-7f8f-4a99-b0d7-8a11b2b8e9d1", "comment": "Malware payload (Formbook)", "value": "8f752bb4f0cb91ae9d2b7fa3d3e0eb6b573953c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637235330, "uuid": "fff5bce5-560d-4fd4-8fbc-c45c9c10ca26", "comment": "Malware payload (Formbook)", "value": "d18f9f4741c8d1fae476742321c5fb1c0deb8e87be67f5dd7af95d8e4ef94c5c451fcb05f855644c51d0e83a25c34515", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637235330, "uuid": "b7cb6d25-76e9-4412-a687-37635677ec0d", "value": "T1035422CE789BAD7FD91612B205669BA1F7FDDC4D02B4AD534B41EF102E3324382026E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637235330, "uuid": "58729605-de8d-409a-b1f5-513b86ec8179", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637235330, "uuid": "238058d8-7017-4f39-910c-5751b44b290b", "value": "6144:rGiwG/xL723wWqzZRXtRw4fjmYo0qGVi13UJFWz:Nx7AwW+ZtRw4fHq7moz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637235330, "uuid": "75d03e9f-c9c6-4c73-898b-7d2d01c2c1d1", "value": 302784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637235330, "uuid": "5bfdfa66-a434-4c06-a127-0c57834c4abd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637235330, "uuid": "0b899d09-655c-44b0-84dd-a5d27cb1f1ca", "value": "RFQ -30015.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d77e45-4835-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637215391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637215391, "uuid": "af808170-ffee-4834-8e60-c44b554d0cab", "comment": "Malware payload (AgentTesla)", "value": "9ff29fd59f3ac0010cba4da238cd48c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637215391, "uuid": "2d6214df-d71a-41a0-b28c-424ef649393a", "comment": "Malware payload (AgentTesla)", "value": "0f96b02d380a0b99d4ba89716e3d2a04b8996d70b3c79c0da3c8d6426d973b1b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637215391, "uuid": "419ed196-eb21-4986-a179-a0aa4f10077c", "comment": "Malware payload (AgentTesla)", "value": "f2aa6abfe3991afabbcf431edd7c9c4e6a272a62", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637215391, "uuid": "5245d1ac-30a4-432b-8560-38fdaec3ce67", "comment": "Malware payload (AgentTesla)", "value": "77501126070e9a5f648dc18b8a913385610e075ef553cd444d1365a4aca8c2e32420dacdf79d8a42e89ea658b54af05c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637215391, "uuid": "ee579cb6-7ae5-4f2d-813d-10788b5c2456", "value": "T19E058C85E1649813F63246B89030DAB937B27DE92DF09E8538D83E6736F6293783550F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637215391, "uuid": "a66de39e-23d1-4151-b164-f66697112333", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637215391, "uuid": "9314efc4-9ae9-48ef-9eca-847192c63ffa", "value": "12288:22wm31gW7ph/655QXo6uiD0kSVB9LPuF3YzrXRt9VjW:2zm3KWthSUXLD0ZB9zI3qrXR3VjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637215391, "uuid": "15d190ee-882a-4ecc-9e06-e9cb4019390f", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637215391, "uuid": "9836f380-e146-4f86-9153-524b88eb958e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637215391, "uuid": "aebac165-a60c-4b39-ace0-20f3a9d6acea", "value": "SecuriteInfo.com.Scr.Malcodegdn34.25017.28247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55b2dda3-484f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637226611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226611, "uuid": "59a9c33f-94f4-4e81-afba-b355bd7fbfdf", "comment": "Malware payload (AgentTesla)", "value": "f3724d928cd1059973d89557ef2306a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226611, "uuid": "7fd14c07-7592-4a6a-812d-1c3b9daa7541", "comment": "Malware payload (AgentTesla)", "value": "107b407922efa4f6bf1da4b2e19e726a12bd5c84cd310e961343171bf35e8414", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226611, "uuid": "fbc839c3-5241-4f19-ae6f-35581c2cc5a0", "comment": "Malware payload (AgentTesla)", "value": "9caa108b5f6e75cce724538679c49de704622376", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226611, "uuid": "11ffe7b0-3d52-41f8-a43e-c3e09593cc93", "comment": "Malware payload (AgentTesla)", "value": "5e550dc9092f82d048ba9a40ba80f77b45c6add438f1898ae44ea90a704186032d0e695b606ede39a66dc38e53441d33", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226611, "uuid": "330a6e5b-c6b2-408e-85cb-527c1358777c", "value": "T15C05026033EC1B56D5788BF547B1A06243B17E791A32E3A95DD234DF2671F002AA1F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226611, "uuid": "29f4508e-37bf-4b10-8a94-c8f4c51f8197", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226611, "uuid": "aaa2960d-5928-4fc0-b09a-b4d9cc92be45", "value": "24576:sbn0R+iBMfAFoQEH5XhhCvNhiSbBI2xf6M4x5bpcs+SC0:DBMfZQEHwvnZ+2F6T51qSC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226611, "uuid": "b9b15ef0-e28a-4d6b-a0aa-f01778848b9f", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226611, "uuid": "9f6d01c5-4c01-46cb-bc5e-acec2f5aa412", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226611, "uuid": "a1ab8f8f-797a-442f-8828-54c10c1ff430", "value": "DHL Documentos de envio originales.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b365a8-48c1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637275794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275794, "uuid": "afe3797c-c682-431d-9d52-bc069647823a", "comment": "Malware payload", "value": "59d8cabdde0a4a99e5fa908a3486e0f2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275794, "uuid": "e2ae2171-150b-4d0e-9ac4-9eb7bcd87e5a", "comment": "Malware payload", "value": "107f844f19e638866d8249e6f735daf650168a48a322d39e39d5e36cfc1c8659", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275794, "uuid": "8fb075a0-4872-4817-b152-0353f42d6c8c", "comment": "Malware payload", "value": "31f0642fe76b2bdf694710a0741e9a153e04b485", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275794, "uuid": "7d7d15f6-28d9-4275-bd3c-a1b81cfe5a6f", "comment": "Malware payload", "value": "07e8e9621f334c78e4e92df9e56a3d4b4e103001483f4976fdd2f36c1225773c3d8e0c4d6a84f9c2cc939bcfba3fa7ff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275794, "uuid": "8912e2b8-b932-4029-ab26-de3a32a847f6", "value": "T1CC53F957FB148047D94F0179C52E8B28E138F77DCE81B39769E8DAA88FA0A534E06747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275794, "uuid": "921e1f48-d980-42d8-b7fc-8add4479dfa9", "value": "384:osRgLDpJiYObn0bFzouS+TZzOO9QX/EFqdEYBRjV7Mtq4nVprF4/dRiD+YjsDcdD:os5TIZ7tJ9JOIiI8ItIKmFQicsaY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637275794, "uuid": "aaeecd7a-317b-4e3b-970a-91788a6a0aef", "value": 61680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637275794, "uuid": "e5cfb96b-a08a-4749-a5a0-93fc81a60f73", "value": "application/x-mach-binary", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275794, "uuid": "f3a9e04d-895c-4c11-a623-d7676cf7615a", "value": "107f844f19e638866d8249e6f735daf650168a48a322d39e39d5e36cfc1c8659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd71878b-4857-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637230275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637230275, "uuid": "3eb3d210-e8ae-4a89-8d70-f664bb348644", "comment": "Malware payload", "value": "cbf26d9192ed79b5a9abd05019c6e4bf", "object_relation": "md5", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637230275, "uuid": "04b150f8-511a-4acc-b881-a708755a79a4", "comment": "Malware payload", "value": "10aaca05e9ba57cbec08ea4fac64500f3774c9e6be1df10e86f4d007e5bba9e5", "object_relation": "sha256", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637230275, "uuid": "9b328bcf-c6b5-4d88-9db1-90b06f7bf811", "comment": "Malware payload", "value": "8c94eefa89ddd99700760ec541e4497fb16b155b", "object_relation": "sha1", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637230275, "uuid": "94caed0b-af2d-41fc-9b98-d350da6abc30", "comment": "Malware payload", "value": "20f7861d35ad46a2f5b6d6f92ee94dca14c20a2746786bcad9a1f935357f45dfbd2d8760ad6473530930889964b28df2", "object_relation": "sha3-384", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637230275, "uuid": "f6a7b602-cfe3-4a4b-b6dc-7993e5ff7f91", "value": "T14AD3D06196811D36DF568B39038F49D0D29E726EFC1F5BD03B23A2D7A8A3EDC1128258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637230275, "uuid": "91042a25-00ff-44b4-b348-d088ad78b017", "value": "3072:h+oXwhJd0+y7ukYe4uYum1GdgOpVXGuhCUqDwECN:0oXw50+OukzVXV2uhDCZCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637230275, "uuid": "870b7c5f-4a4d-44e2-a249-3f4d7b76a606", "value": 135202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637230275, "uuid": "9ec007dd-6ff0-49d5-8089-34ee3a9a6520", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637230275, "uuid": "68565b79-e460-4358-b083-491cd54f9529", "value": "test_3.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a9ae64f-484f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637226539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226539, "uuid": "20d8b00b-6a6c-4ee7-9671-68141aca6a37", "comment": "Malware payload (AgentTesla)", "value": "90834ca683efa9bd4e4ab54728b94ce5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226539, "uuid": "c1fb7845-d1b7-4df6-a06c-7409810f3c75", "comment": "Malware payload (AgentTesla)", "value": "118c41cc349faeaf8f78b73842903b12b9aa9ebf8b0bf6ece455fd8ea943da25", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226539, "uuid": "e1301b93-5623-4d84-9772-36d6bc24a49d", "comment": "Malware payload (AgentTesla)", "value": "88a0a5456c8af1d6d024e46a95a974e53c2c7a07", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226539, "uuid": "5a2f9032-311f-4d9b-9ef1-c18fd042f300", "comment": "Malware payload (AgentTesla)", "value": "128653cec0e16b9b8bd8671ab3131dbed0b4ecec056d15a9ccc6c7ea37045600b4a3c5dda6d774f3f91ea4eddf74379f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226539, "uuid": "f27fd992-20cd-4009-874c-fa56b45dfd7d", "value": "T19CE4E1E036B8D813E330867AD5B0D7BA4A70B16D0DE6C6427DDE6ADF76197207C68312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226539, "uuid": "a470cf71-4607-4059-a1e9-f9fa484a9ef0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226539, "uuid": "a4e80314-d6be-4140-81da-06eef6415fdc", "value": "12288:vcnLm31gW76F5C/nvgjteb0XdOF78A4OHoJ8RJkz:vcnLm3KWGDCHUEbh7ayoJ+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226539, "uuid": "a83f17cd-d15a-4586-adda-0808644cf9d2", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226539, "uuid": "53ab6d5f-2be0-42fa-9ec3-3e71c7360b16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226539, "uuid": "26c314e5-2b02-459b-8779-1943a189ee40", "value": "DHL Shipment WaybillDoc_TransportLabel_3990350980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477f1760-4888-11ec-843c-42010a9c0014", "comment": "Malware payload (Stop)", "timestamp": 1637251069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251069, "uuid": "6c4f027f-cae2-49bf-b5ee-befd1ce1df84", "comment": "Malware payload (Stop)", "value": "d35de0d2a41e42f68a16e1ba09e1b0af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251069, "uuid": "fcc99f0a-81cf-4d61-9e8d-2158f2089ff7", "comment": "Malware payload (Stop)", "value": "11d8a24bed6416051583799bb8bea7f3761fb8df75d9cfd817f5a251bc72dd8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251069, "uuid": "c60770ef-5ad3-4360-b5bf-a3e0046b6864", "comment": "Malware payload (Stop)", "value": "1a897e721ae9b6f94c5861c60911e947fab0d257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251069, "uuid": "792efcee-061b-400e-81e0-368231bed358", "comment": "Malware payload (Stop)", "value": "d985af56be35cfe406d5e2fa8e987b66f7f4abb68f4cc9f70fd6b55e2a61e36402f8bb7b3ee573d0b7ceb5343d967672", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251069, "uuid": "aa9e42dd-a3a8-40c7-add1-3ee5302d3403", "value": "T1B6E412E2FBE5943FD87650301AB09351093F3D722574A58E234C7A9D5BB12C0AAED7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251069, "uuid": "ec6de7a6-cdaa-4d42-bac7-49051e91707e", "value": "a618e171c5a85d8da93ba6288f0bee4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251069, "uuid": "c47f1256-eece-47da-a5ae-cd460dab39bb", "value": "12288:BFKD6Tg1Ar2jmYAoV4AGNtqAKnCQnfQto0+JybW9577LL47OSSIl:BAeTtr2ysV4h5KCQnf2EJyMJ7v47O+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637251069, "uuid": "edff5dea-07d5-42ef-bd9f-89155f31d34c", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637251069, "uuid": "5d7ddb35-e078-4dd4-814e-3c8b4679f226", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251069, "uuid": "78062484-fff1-40b3-81d5-75ca573db045", "value": "11d8a24bed6416051583799bb8bea7f3761fb8df75d9cfd817f5a251bc72dd8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d984ad-486e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637239867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239867, "uuid": "5cbf8809-604b-4aee-95cf-7c339e8792a5", "comment": "Malware payload (RedLineStealer)", "value": "9963457a100582d49be3af4cb4700ffd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239867, "uuid": "23e054af-7ba8-4d9d-87b1-b9d9b4b1a17e", "comment": "Malware payload (RedLineStealer)", "value": "130bf413b2c838b82d39d4654ed058d9e14662822ea0d21cd2aae0e98ec87016", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239867, "uuid": "c3133e2a-3d2a-4b85-88a6-f748ef82687e", "comment": "Malware payload (RedLineStealer)", "value": "fe21db3462a4f1e61a15390d6d54c883c6adbf29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239867, "uuid": "1b146c66-f3a9-452a-b7ec-12af61564737", "comment": "Malware payload (RedLineStealer)", "value": "a392e70d55a290daf85bc89674402c9d29a5e677173950a6b043469444b9e959c9c8f8ea192bb685c475efd202b07de7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239867, "uuid": "a7ae510f-1998-450b-b423-2ce7cfd078f9", "value": "T19CA4401BE9C2CE11C9472776C6E39780FBF650C143634BCB9B58C6C0AB466E16F61E98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239867, "uuid": "082fd88c-24d3-495d-9b14-f41662d54b6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239867, "uuid": "cdd06271-48e0-4a91-8b53-2c9f2202f305", "value": "6144:NgwMvgBz01pEHWogGAFuRe8YDwBpS2f/Qo0+Aj17yhpa1n:NBO/ogGAFown2f/QGzaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637239867, "uuid": "fc419992-8211-4d0e-8a7a-c45efa3e49e3", "value": 456600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637239867, "uuid": "5b82c2a7-ff37-4edc-aad5-6b9a03031873", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239867, "uuid": "e513c62a-e94e-4f97-9f98-79a4155ae076", "value": "9963457a100582d49be3af4cb4700ffd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2bf39a-487c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637245923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245923, "uuid": "bc22f325-4e16-4d14-84a1-fe600173e760", "comment": "Malware payload (Formbook)", "value": "a3b8d59430deef4d59ec0d47a60af449", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245923, "uuid": "cdf479f6-55c2-44eb-b130-379aa5624db3", "comment": "Malware payload (Formbook)", "value": "1339a93d8ca9b03d1b55ce0d283da6d320bf04fc515a8259597c635901c821d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245923, "uuid": "75ccae58-ccd8-4a1e-99cd-d724b2a4f125", "comment": "Malware payload (Formbook)", "value": "4cb4bef74a68cb9a55c8eed369a7beea317e3840", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245923, "uuid": "3f73759c-8311-44f8-aacd-b3b1bcae16af", "comment": "Malware payload (Formbook)", "value": "8646e78fccccd6daae9eaaf9a274d5e6bb64eb0ff3dff21c79804ea44e37163da6b365a320fa10f986e37b4b48af5769", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245923, "uuid": "a6d07927-07a3-4460-aeea-d04395f0f6dd", "value": "T158D4ADC39AD016A4EE980F3501326D344327BF6ABCBDF9CD6E48751217376C29277A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245923, "uuid": "d60f640a-65fb-4877-9eb8-a467a786e79b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245923, "uuid": "0f03f39e-4c34-4e10-9d79-1796ca942f4d", "value": "6144:uGi+jGL0og4dDiXYOg8XQ5iiRHTjO0gBzxRmpwCxkZ6W6q/Ba:A1JiXXngQEHTxgBzxmwckZ67q/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637245923, "uuid": "36518096-3d21-4dfa-9561-e4e037d30315", "value": 654215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637245923, "uuid": "40a1f48f-815f-4e80-a9fa-9d568f44a8e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245923, "uuid": "8d3c5c7d-ed1d-487a-8619-e98ce6863c85", "value": "PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0fd4d3-485d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637232877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232877, "uuid": "d27f8a6f-0719-4b04-a7af-5bebbb631f54", "comment": "Malware payload (Formbook)", "value": "ed2d47f7678b42e6147cb72320886787", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232877, "uuid": "c0fa9545-6e58-4c71-9007-316b3633ce5a", "comment": "Malware payload (Formbook)", "value": "139afefc28319e5f2d0706268613e6d473be21893b39e7cffb76c1f7711fbee1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232877, "uuid": "0c70f2ef-e861-45d0-8f78-4b12f7ea4889", "comment": "Malware payload (Formbook)", "value": "a008a980fc087c663165f9889915fed75567a5a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232877, "uuid": "5d7ac4fc-4f2b-4f4c-bfb5-fafd5656f33b", "comment": "Malware payload (Formbook)", "value": "12df5845f0b548af61f6b88b6617ebc746d12caeba78b0878a3b52116af1fc0ee8d196773d10a83d923f65a57ae6173e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232877, "uuid": "aee00b98-d569-42cb-894a-66b67fb36dc2", "value": "T1B174222BA3C10C27E2E543350AB3EB6ADFB657851263BD074B1D1FAC4EB4B024B59647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232877, "uuid": "41c951c2-c628-4ee0-8b23-1644e7e7121e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232877, "uuid": "3a23644c-65b1-48b3-ad6e-ace27448400c", "value": "6144:rGib7tAXtguyNjKO3Q2nO3mHSyFNXX80SU5O15KycuaS9VEthVMVer5AF3ETzrT3:X7tAXta/POXyFNn2EyMS9ChVMQ5A+TzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637232877, "uuid": "ba88eea6-3784-48d4-afd0-1253ba605401", "value": 340337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637232877, "uuid": "dc3617f7-eb6f-41a9-9c74-b500f25d8cec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232877, "uuid": "3a35ad0e-cf98-4bd6-9ced-337e6d8ce8de", "value": "ed2d47f7678b42e6147cb72320886787", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8303966-48a7-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1637264599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264599, "uuid": "f1bfa178-3bff-4867-80d4-0c62697d04a7", "comment": "Malware payload (Metamorfo)", "value": "52722f3d4e19c39e4e09f9150fbdecb2", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264599, "uuid": "c13e7dec-7526-4d49-9b18-54e36334deba", "comment": "Malware payload (Metamorfo)", "value": "14a1b75dae91f94f9e68916a082439f286bc907e3fbe83ae72b585714a7f77cb", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264599, "uuid": "35018c7b-561e-4f75-8b3c-88cfdc9c8bed", "comment": "Malware payload (Metamorfo)", "value": "5506c0f69dd4676ef1b72788d2da9aae360868d2", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264599, "uuid": "7683ffd5-cb19-4760-ac34-d36628cf63ee", "comment": "Malware payload (Metamorfo)", "value": "216e46df9701a90a45c522b085ea747f47dc338b45c9b8d93ea27d44f944e4ca9f2eeecd529ea4f72a5fad3f8d385cca", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264599, "uuid": "2e154db3-3c96-4563-b0d8-d3225d74597c", "value": "T1194106112EE71319D2B3CF7528FAF68689BABD419E534F5E8084439718A2140EC31E7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264599, "uuid": "8b176233-a57e-4013-ac79-637de3386355", "value": "48:8+uH+M+LMsK8R9oE1cIXv3KaIqiHkb6NS6:8+ueFLM5SKE1cGvKdEbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637264599, "uuid": "b5550eae-7d4f-4ca0-a805-0015c410a424", "value": 2014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637264599, "uuid": "ac369f8c-83b2-4e55-b593-8e03efcdc22b", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264599, "uuid": "88719a0d-7a3e-4de2-8443-501390a0d731", "value": "Curriculo.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268e60d6-4850-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1637226962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226962, "uuid": "2facb4b6-c6c8-493b-b2f2-7bf519734167", "comment": "Malware payload (Metamorfo)", "value": "16c36382de19ef3f8730aad502256ca5", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226962, "uuid": "321457d7-e394-4d84-bc23-855075dabe92", "comment": "Malware payload (Metamorfo)", "value": "1603e0dccaa35dfb80348d0e3b2d7f9a4311f006bd4192b45d91f86fa93c73bb", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226962, "uuid": "54a3cd16-f5e4-4a69-a93b-cd817de3ebf6", "comment": "Malware payload (Metamorfo)", "value": "a7641c7ce8a97df3e7cc966635d3326116ffec22", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226962, "uuid": "75e17cd5-820f-4a2b-a044-c9fc59e0e8e3", "comment": "Malware payload (Metamorfo)", "value": "9b0096ed8b0b08238d6c5742a5092dca1b67fe8480fe5b96ce79f24ccd3309e0a22f82fbb29fa62d9798f69271d1252f", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226962, "uuid": "e2ec9e4e-14ac-4497-a9b2-551506c6be14", "value": "T1A341F0052AEA1719C3B3CF7610FA629649BFBD11AD538F5E408443CB1861150EC36E7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226962, "uuid": "7c4d82e0-9194-4bdd-86b5-0fb15dbed2b3", "value": "48:8+uH+M+LbLrhCkEO6pE1cIXv3KaIqiHkb6NS6:8+ueFLr0kEOSE1cGvKdEbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226962, "uuid": "eaaba72c-cdbf-4d49-8368-7517d08f5272", "value": 2016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226962, "uuid": "f7159d1d-de7c-4de7-b65d-2d07b4373c31", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226962, "uuid": "7a288922-a8fe-49f3-97e2-790db7b2ff01", "value": "Foto.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340930e5-4862-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1637234715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234715, "uuid": "afe0574c-c7f0-4dfc-b81b-19b78affc2e2", "comment": "Malware payload (GuLoader)", "value": "1141349c257c19bc520be74a0b2b5c84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234715, "uuid": "6422b014-3eb0-470a-90f1-17cc5eb1c3e2", "comment": "Malware payload (GuLoader)", "value": "161ec356ac71bac284e79ada3eb22e404731fb9d61753be7fae17d4f731962b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234715, "uuid": "52936f7a-b558-4caa-8e8d-d081b97d85fd", "comment": "Malware payload (GuLoader)", "value": "630c30828ebc0dd24c450b885abc15c54011a5d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234715, "uuid": "bae72281-3582-4329-beb3-a1380887be30", "comment": "Malware payload (GuLoader)", "value": "bf998d3ffb71dd2a7abfb1b9dd7bd4745352a4a5af063fb5d39d80234eff480531c0e201a0a9bf3cebec7ea64fbed6b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234715, "uuid": "be1ea2c1-d1c1-45d1-a7e9-cc9ba4e7eff6", "value": "T1F324C5017905EA26C454E0F17930D74F5301F733A22A3BEBBA8577A8E6749F368B5A0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234715, "uuid": "ee52c7b5-2b84-4a34-993b-268f26c0ae44", "value": "f104c0d3c5e62753d0f5e557895a5e41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234715, "uuid": "cdd1d057-e943-44b9-a647-e28216b5e432", "value": "3072:8tWViLhsTdFvG/a1m4BzWSl5mrqGZlENv3LFnBGbQ0u9qYc:cFaeemMzWS9O4Lr0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637234715, "uuid": "26c506e6-029c-46f6-83ee-ce011f633cf7", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637234715, "uuid": "310ac948-4130-4b02-aca2-e915a2ab2044", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234715, "uuid": "406b46ea-b8df-489a-ace0-864d872feaa1", "value": "ARRIVAL NOTICE DHL Code Nr 4622256860_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef1b5c7-4863-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637235405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637235405, "uuid": "86ac37fa-1c22-4222-8187-c96491300b2d", "comment": "Malware payload (Loki)", "value": "31a1de9276d21cd5d2ac689f1b210d8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637235405, "uuid": "8190bef0-0232-4fa4-895f-b1b70383d948", "comment": "Malware payload (Loki)", "value": "16381bf7dcd8ba91895e3da5072d62233a0a925ed351fdfa6a07e394741db884", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637235405, "uuid": "f91cee92-3d4f-4677-870e-c3a6b106ec39", "comment": "Malware payload (Loki)", "value": "e2e6a6b4ce916a534ffc21cc381acca938815704", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637235405, "uuid": "de76deb5-310f-4afd-8ab9-5a4e35da8e73", "comment": "Malware payload (Loki)", "value": "66a653a18a49abfb67a78c5a3aacfdcff254fc1d8ef589e6f06a99d8245c4878583e0a496197f26b65e7734cf6956d02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637235405, "uuid": "2b6e532b-cc72-422f-9023-785c669cb6c0", "value": "T1DC44020297BCCB1AE96B4BFC9024125403F9B25A5553F39D0FD4A4CE2D637A2DA05FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637235405, "uuid": "23f41d65-f22e-4ed5-98ef-a8799e322192", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637235405, "uuid": "91703df6-e3b1-491f-b133-9120910f2e78", "value": "6144:phsG7DyCIywkRV55EMh4Lhfm2jYWXfWeQBRUx:pJDhDnXwBhLkWPWNwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637235405, "uuid": "9a576eb3-8137-4aed-a893-83c94ddef145", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637235405, "uuid": "468db534-5dfb-4232-ad03-8d4e4dcd199d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637235405, "uuid": "9de6fae0-3983-4050-bb75-d452774e509d", "value": "31a1de9276d21cd5d2ac689f1b210d8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245a5d80-4839-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637217080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637217080, "uuid": "f3f610b6-bb0d-4b98-9318-31619e66842d", "comment": "Malware payload (SnakeKeylogger)", "value": "fe364a621eee0d82c07bbcf8f0e0b530", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637217080, "uuid": "7e82bd6a-853a-4ed1-a093-2edb7a0d9510", "comment": "Malware payload (SnakeKeylogger)", "value": "1705412a15eee739a0ae525289dbafb98e6eccf75438a938e9f29f2317968036", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637217080, "uuid": "7729219d-b5d2-442a-8db6-868b47e0eaa8", "comment": "Malware payload (SnakeKeylogger)", "value": "a9a982e73301af3948b36cb29719389ffc587748", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637217080, "uuid": "8e0948b3-8893-4649-90f2-31cedbea7ec8", "comment": "Malware payload (SnakeKeylogger)", "value": "1a8c003e1293fb068c3723949b1a4334ab0f6eabfebc06c5b7a6c06be29326b9fa1b6257cbc643df0978b99f1d8bf41b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637217080, "uuid": "2d003fe6-0af4-49b7-b271-c4e116f7f022", "value": "T1A7C4CFA036B8C413E77081B6C2B1D7BE4FB0B26D1DE1C6427D9E6ADF7659760BC18212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637217080, "uuid": "545c24a5-8869-471b-a3e3-f1117cc65697", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637217080, "uuid": "da9f427f-fec4-40e3-ad1e-17677b0c38ce", "value": "6144:NNpXKUa3HXkh22hlECn/KqS15VIFI7M5IBOyVZsPl+3PNQAf8R/1zsAsYjxjm8Q3:D3m31gW7NcR/1zsTaFm83m3/egWUZP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637217080, "uuid": "728d37dd-2114-488f-8f8a-27d9c73fb542", "value": 543232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637217080, "uuid": "1709cf77-5c01-42cd-a516-c485f9778c3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637217080, "uuid": "2e1593d3-2e92-491f-a0d9-345823db3d6c", "value": "Quote 2021.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04e4105-480c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637198041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637198041, "uuid": "732c6e09-49d4-4143-ada9-30cb06e20c3c", "comment": "Malware payload (AgentTesla)", "value": "801e694ab67cfcd018249c4bfdfe2566", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637198041, "uuid": "9d664b05-5471-407b-95c8-f5bd5ba1ab2d", "comment": "Malware payload (AgentTesla)", "value": "1742850c2c5b2bc8e6d990f23be99e4a40c7cc5146c7e4610b2bc4914bfb09b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637198041, "uuid": "ab51e82e-f29a-4beb-b459-33cefb77ad07", "comment": "Malware payload (AgentTesla)", "value": "529ae3117944542c4da9f2b85b18835d40c7b47b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637198041, "uuid": "586c6413-2e8c-4b7d-a47e-86daacf59514", "comment": "Malware payload (AgentTesla)", "value": "3ab952b5b4067dc14033e3b12d6554c276d4bb5cd15205603f654140e53b88cbe70814f5a4d7e94d4d5b6b2e8a2b9e84", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637198041, "uuid": "93d9be72-bf4a-4a34-bed8-46be981e139c", "value": "T16E84124673DCA90BE6C05B7048B1F369673AED584A415AD3B7923F2BB8339520406E9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637198041, "uuid": "541d82e2-7be8-4f1a-85ee-4e175df2ac00", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637198041, "uuid": "f003d586-8e0b-49c2-8b34-3fe5bf7d511d", "value": "6144:TGiiGeKGDuGyGNtiFTTwHUmI2fuHdz/SKZGAqbQVElXj40pmK+pFxIUdqOyJWRhc:AihwHUmI1d7SKQAsQaxXmK+pXhhy2wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637198041, "uuid": "6763260e-0ee7-4378-b035-e35dfda236a0", "value": 401842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637198041, "uuid": "bb67e8da-63ad-4888-8b4a-b197234790b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637198041, "uuid": "3ed386da-5683-4297-bd8b-07ae7fdad60a", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b815a5b-4888-11ec-843c-42010a9c0014", "comment": "Malware payload (Stop)", "timestamp": 1637251076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251076, "uuid": "98e71c01-39e1-44d3-968e-3002b6a1f46f", "comment": "Malware payload (Stop)", "value": "a28980fe97fec6b306e4869646c310cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251076, "uuid": "a9b957fb-ca12-4af1-9f80-3efd812512af", "comment": "Malware payload (Stop)", "value": "17ed0184fb499a13e4ddb60c3d1b977b921ac54977fcdd7fa964d9cdb40c6ecf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251076, "uuid": "154fd20c-dd99-4a4b-9301-982814f30ab1", "comment": "Malware payload (Stop)", "value": "24ea80d0b02f7b7fa36883f615ffff0ef2d2b7b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251076, "uuid": "7e19b5df-50b1-44df-85b6-83f499019451", "comment": "Malware payload (Stop)", "value": "27a3566e884fd3e712977fca56ffa93c0e479f280e483004e01c3d6ecba3386290c326cfbb46e1a864da85cd35c58cac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251076, "uuid": "775b3521-a612-4a5f-8f68-5081eca6b292", "value": "T1CD15F140B7A0D03AF1B616F87AB593B9A83A7DA1A73494CF12C627ED56345E0EC74343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251076, "uuid": "30d9dd44-dec9-4dee-9db4-ad1dedca56fe", "value": "84b6df72a9e01c91bfab46c99e26b87e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251076, "uuid": "12e487aa-cbcb-403b-962b-dca94becaef4", "value": "24576:2Z5pciQyj/UIYkO8/sHWcwAbHc6tRLV9:2/j/TsHWNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637251076, "uuid": "4fa4b254-616b-49b4-869a-f61b098e4ea9", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637251076, "uuid": "263e0cee-59d2-483e-94a9-4034b1188e3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251076, "uuid": "793ca307-6040-4a15-abc0-603612f2720b", "value": "17ed0184fb499a13e4ddb60c3d1b977b921ac54977fcdd7fa964d9cdb40c6ecf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e97f7e0-4803-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637193850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193850, "uuid": "0e1130c4-9a1e-418a-a39d-e92f2bb22579", "comment": "Malware payload (Heodo)", "value": "124684af987f6c5aaf265c81c2bf8e19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193850, "uuid": "bcfee4e3-c20b-4431-bce9-016e47906786", "comment": "Malware payload (Heodo)", "value": "17fffa76beaea9c2db0136a06fcd6ac60b9934b017ef9ba3f8fde9e7e5fa337f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193850, "uuid": "ce5d5bc7-aea9-403a-8886-6401844b188e", "comment": "Malware payload (Heodo)", "value": "81148f5ef226de862e37db27b6406ca553ddae34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193850, "uuid": "2ba94163-d772-4746-985d-2068be9be8fa", "comment": "Malware payload (Heodo)", "value": "ec7ba55d0751aebfc70eb95c680ee9e49071b4f2c959219b6af8a0df6f6cb6da2ec3bc7a5a724244eebbb39cfeddc2b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193850, "uuid": "b8570c4c-c1d9-407f-a553-7fa195ec5540", "value": "T16B44BF10B1809032E8BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA3089F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193850, "uuid": "0f78c68f-bfe7-4ea3-ae29-9b3037ab0ba0", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193850, "uuid": "0cf04e8f-5b6c-44fa-8111-4f72565a909f", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBp6asb:prf+WPVXNcwUKaWTAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193850, "uuid": "0c84e9bb-5347-4ae6-a644-fc94b955687e", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193850, "uuid": "8879383f-a534-44c8-8df5-619888d7e433", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193850, "uuid": "9e1ecb22-a3a6-46f1-a1d0-aeda17774631", "value": "124684af987f6c5aaf265c81c2bf8e19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31675f37-483d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637218820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218820, "uuid": "4619d28e-9d96-4001-8473-e01c68292d59", "comment": "Malware payload (AgentTesla)", "value": "01cb1c9521220537344b6e8059ce052c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218820, "uuid": "01417828-21a7-4076-bca2-e1dc6da20053", "comment": "Malware payload (AgentTesla)", "value": "1813fb3a2229e221497d5f8191683f59ab5c30d8e7fc1fd19f79e98b06e6ef70", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218820, "uuid": "08fd47a0-0b5c-4160-a46a-e93058fd03d9", "comment": "Malware payload (AgentTesla)", "value": "de5d9376a79b6c1c40d0b3478d8b2662be47e2a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218820, "uuid": "ad0cff7e-a036-4812-b065-ab5768f4e3c6", "comment": "Malware payload (AgentTesla)", "value": "4874c8005a892373b84aff360e707f8f70601c24c3fda2a97e411231133be09a6f929cac87093888164d65792046912c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218820, "uuid": "c41a85de-8475-4254-9d93-4e8c55b7f5ff", "value": "T1BBC4E17923500BA7E4893CBAD613486D4BF9B496D227E358BDB3D1799E6B7004B023D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218820, "uuid": "8b0ef71e-bd1f-45c4-b82a-1541329af93d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218820, "uuid": "ef08dab0-1456-415b-b408-0e6ba6bd18aa", "value": "12288:C4vNzKAfqaiJv+HS0ZoAUYvgzE/DXOXvV329ucuf:VpDZTyTYvLEvV32c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637218820, "uuid": "94b4e093-a12e-4448-81bb-4fdc12d59005", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637218820, "uuid": "469e829f-eccd-41fe-aafa-4c8cde2881d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218820, "uuid": "e2290c19-31e3-4ff5-99ff-a32132a3e956", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b89f09d8-4871-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637241380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637241380, "uuid": "6684fa61-76a5-44e6-861e-e14a0da5a04d", "comment": "Malware payload", "value": "5b17a2d046f0bc8e34648e4af5cae8a3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637241380, "uuid": "3bc2eaf1-0bab-49b4-aabd-5c4995524a40", "comment": "Malware payload", "value": "188109c069f5bbb979dd60689bb2bbdce861dcabea325d3fe5ac5e4a95a4e667", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637241380, "uuid": "cb57d36c-7e4c-4d2d-96f3-9089f8b6ceb8", "comment": "Malware payload", "value": "4d0cc7075a1f9816da765e93a5c0e64a6d817fdf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637241380, "uuid": "99bba21c-d0da-44d2-945d-068e99c1047d", "comment": "Malware payload", "value": "6293289fa5b1c78039a4a84a3f14cb922ea25af1ba7980a3420e8e32ab30e4b593dd49bafb93375c7345841a8917764a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637241380, "uuid": "7531a12f-7e6d-4391-853f-5daa4e17cce1", "value": "T1DD513614B09320AA5142A27D531C2E339FC5C3851AA38FF5629959C0B9AE83BCE71F77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637241380, "uuid": "04e5f264-6939-4a4c-b38a-84e12204eb13", "value": "48:qnpWNQfXiha6L7VIuR9oKkGNycgKktnT7y/+r41n8gzoD48Uz6dU:qpGtaKmk9bTN9ktTgXED48yoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637241380, "uuid": "1defb832-cd64-4421-9b0d-6ff0cc3ce324", "value": 3061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637241380, "uuid": "32acb3a8-4921-428e-802d-0acef69c156e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637241380, "uuid": "52733f59-6c6f-4300-b2b1-299e5514632f", "value": "obf_report_1319.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34550c9d-48a7-11ec-843c-42010a9c0014", "comment": "Malware payload (Neshta)", "timestamp": 1637264351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264351, "uuid": "8a2a2164-1310-4591-9ceb-4a2935f7bcdb", "comment": "Malware payload (Neshta)", "value": "c39a71d53744e830f775ee130f8828db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264351, "uuid": "6b4a4895-155d-4359-bc1f-092d90228a90", "comment": "Malware payload (Neshta)", "value": "189a9bb6ec5acaa4d8f7d889fcfe1bf393a4d10d55d0f297b77907f877c72791", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264351, "uuid": "090ccc85-67ac-4444-b05a-b1debe59369d", "comment": "Malware payload (Neshta)", "value": "fe25db33279694973af77722ff80c4da4da557b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264351, "uuid": "16b3f9f4-2150-4bbb-8c03-802497df25ed", "comment": "Malware payload (Neshta)", "value": "daf578000b852db82274e9b18b0a62cd69b05865fae0ebf99dcdb25229144e9dec32c5d5be6018a6240e75f7b97ddc0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264351, "uuid": "cb78f696-a39c-40d5-b84f-037168b35860", "value": "T152741252FAF1C833C2311974ED27EBB8C3BDBE62A825155327B06F5EACB5391560D242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264351, "uuid": "d128dc9f-cc4c-43d1-aea9-6a871c3281a0", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264351, "uuid": "e5258875-4904-4215-ae85-6300086e8531", "value": "6144:k9nuULFp3nvuOJPXL7wPt9H46axjamKbixDUAzX6g6RMGYGi/:OLFp3vuOJXMtl4jamKbObzXKR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637264351, "uuid": "d19dcbff-92b2-4c51-848f-741f9964546a", "value": 340343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637264351, "uuid": "fb242976-e74c-47e3-bd15-7a63a854bf46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264351, "uuid": "44fa7827-e038-4219-8449-3348ea08271d", "value": "c39a71d53744e830f775ee130f8828db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4316038f-48a1-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637261799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261799, "uuid": "8eb73c17-5c18-4139-9450-a8f2272d7626", "comment": "Malware payload (RedLineStealer)", "value": "06ec0d66da32bcc9e61fca3bc81702db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261799, "uuid": "9fa10a61-3318-4112-bfa2-77be041549cc", "comment": "Malware payload (RedLineStealer)", "value": "1aba3ebf5fc7d6221270fa7e13713216e06b678b197524a35d3a5cd9b1e0d857", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261799, "uuid": "67aae552-4a8c-4b63-9f18-37cb38de0dbf", "comment": "Malware payload (RedLineStealer)", "value": "4865ff2f446ca21ab39ea56ccff64bfdaf6d0444", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261799, "uuid": "c7847936-8cd0-42d3-89cc-b518eb5f16d9", "comment": "Malware payload (RedLineStealer)", "value": "4af911ece4b9f54b32bacd21bbaa582dcd6986facf70e37d5495c47de64f974d1167919bced1456429063cce74d3564e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261799, "uuid": "0c137c48-69d1-4afd-af31-e5f9db88a581", "value": "T109448E10BBA0C034F5F712F9497A93A8B93F79A16B7491CF62D516EA5634AE0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261799, "uuid": "c927f687-4e1c-4c7c-9ec2-39c576eb18b4", "value": "5ec00bbaa469943db4b6795b01cc4091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261799, "uuid": "b4045a80-c000-47a5-a81e-939029b1f5d4", "value": "3072:S0Dpf7yKf59RUdO3wCZSZJuiP355EqMFlogBdO3JMu/DNhaTvWhMrVZJvNvsh:jf59FdCJuirELFtdO3CurTCvY0zvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637261799, "uuid": "fa5f5f2e-3c89-4d19-8e85-cae94f935fa2", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637261799, "uuid": "fba1a0f8-e44a-4dd9-b5e8-9e14dd7a77c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261799, "uuid": "5c7a3cdc-9ce5-4c32-83ed-16e90be2a0b6", "value": "06ec0d66da32bcc9e61fca3bc81702db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6854f77-48a9-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1637265482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265482, "uuid": "a9c5abf6-ec9c-42be-bf39-8a744a99abfb", "comment": "Malware payload (DanaBot)", "value": "d187b3090459a7b56d8c8d3f34ceed5c", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265482, "uuid": "c43ab1c0-c07f-45e5-9ed8-393fd460c055", "comment": "Malware payload (DanaBot)", "value": "1b66defbea4f416df3e25f4289193c9eb5e5fb8f57c3a0c679980b9bb4605dcc", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265482, "uuid": "85fa35e4-826d-4da8-a5d1-280ec1ff2de1", "comment": "Malware payload (DanaBot)", "value": "41d1dba0618e06bcf84ef9b75b9c6a0fc465cd6a", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265482, "uuid": "ecaa6a09-9606-4ba7-9dd2-043f75585a70", "comment": "Malware payload (DanaBot)", "value": "51b4a600870bc4e1d9cd16c22da7a62ee590493a08e90ea34ff631e2fd28abcba550e9303a68328e2b810121cb80c4ca", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265482, "uuid": "164e60d4-a956-4170-b38d-7c5726533218", "value": "T1A3852304B7A1C03AF1F245F85DB68368BA3E39E1637995CB11D206EE89256D4ECB2707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265482, "uuid": "6e427678-8245-4ed8-94da-19af552c2074", "value": "9abf03d4e22c0a12cb29c8d67fb192e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265482, "uuid": "35f6414d-bbba-4d91-90f6-d9809fd47842", "value": "24576:/uvVuc0qqCJwy/3EL+8Kwz1X04LiyrjXkIqN0YId3X66gzrMF9EnbvLEgShjT0xt:/uvVuKwbq7wBX0ujXkF+gzr9nbvL0T3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637265482, "uuid": "dce64ba6-5087-4107-bb22-f9ab1e2144cc", "value": 1836032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637265482, "uuid": "2ccfe547-b4b3-42ad-b15e-8c9e2f975f3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265482, "uuid": "2832b0a0-1dd8-49e8-b7e9-2ae40bab58fd", "value": "d187b3090459a7b56d8c8d3f34ceed5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786c10c6-483a-11ec-843c-42010a9c0014", "comment": "Malware payload (Pony)", "timestamp": 1637217650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637217650, "uuid": "efc48bbb-ec98-4d0f-ab57-7cc0b4bcdc98", "comment": "Malware payload (Pony)", "value": "c09221558e6d555b2287c93e5f659498", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637217650, "uuid": "bd12bf97-255b-467d-92e7-d0da66a6fb95", "comment": "Malware payload (Pony)", "value": "1bd1650f3dea59f95579ef84563d4594cfd059f3d9babc665a396e4fc1393afb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637217650, "uuid": "1120cf33-def3-4d5f-a505-e41238ea3447", "comment": "Malware payload (Pony)", "value": "9d1c85c627c88f4873c8c1350b6fd27a7ad623cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637217650, "uuid": "21b89282-fc06-4bcb-90ef-3858064bed4f", "comment": "Malware payload (Pony)", "value": "ac686335f78da7521d9f14c56961734d6a6bb3d92570a4a87f628589e93fd0e06b1f3ba38bbbfc1c26e3002f3c620145", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637217650, "uuid": "5187886f-8091-42ee-8cd0-0ba60ec2bfa4", "value": "T17E04AED69BF69388C42BA23857A2097C024D28F41DC8A45FCBAD570E3E726FEB151177", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637217650, "uuid": "dd995c22-c5a3-40fb-8ac6-0f0a1a1490e4", "value": "192c5dacd7a6182e429655b8cc448bcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637217650, "uuid": "c0cd02a8-3ebb-4e16-bf1e-ea6f26d1b973", "value": "3072:+mxXkpdNS7w3AOAmev8nf1fk5IJ3sykognI7fEr8:bxUp2M3ApsBkWJ8yEnI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637217650, "uuid": "f14060e1-3ef1-4f2a-a044-52ee84ca6623", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637217650, "uuid": "3363c1b5-e0af-4fee-ae2c-f5971a31ad1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637217650, "uuid": "9d91ee39-b82e-44df-97e7-6d4d5f601d15", "value": "1BD1650F3DEA59F95579EF84563D4594CFD059F3D9BAB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa18ea3e-487a-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637245356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "602a394e-382a-4368-93a9-000d0c348cec", "comment": "Malware payload (Heodo)", "value": "b728ee302801bc4ae230faa5b49dcc3d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "7039cda8-9157-49a4-8edd-7233769ec6e1", "comment": "Malware payload (Heodo)", "value": "1c9f611ce78ab0efd09337c06fd8c65b926ebe932bc91b272e97c6b268ab13a1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "eac66bd4-56bc-4b95-933b-485dad627889", "comment": "Malware payload (Heodo)", "value": "0005d1859d86c8dd002ea0edc0fffd55e856399f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "adda26eb-c7ec-4897-b19c-a36ce772bc87", "comment": "Malware payload (Heodo)", "value": "cbada0a51f79cd140c01d20c73b5cbdcb494f40195699b22b175f23c40172cec86dc08c9405780f3c58254535c2f00a3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "d4eff578-01ef-4efc-ae0a-0c4c0c756b6c", "value": "T1B8A4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "b887e4e6-c16e-4c6c-8e1b-cd84716d7a7f", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "17a68cdb-94aa-4145-adfa-3895bdcd9cf6", "value": "12288:bdv8jkvzqZvv2wLBLmTi12yD88kYwZ1h1:b2Zvv2ciTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637245356, "uuid": "ba94a402-f384-4f1f-b7be-e767b0a1e9a4", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637245356, "uuid": "6a682124-4dde-4941-89dd-1253eeac0354", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "0084a004-cf25-4d52-aa3a-30c2c2b0ff81", "value": "emotet_exe_e5_1c9f611ce78ab0efd09337c06fd8c65b926ebe932bc91b272e97c6b268ab13a1_2021-11-18__142229.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "144452f6-48b5-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637270310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637270310, "uuid": "e3785c89-abef-4de4-ae2a-57cf625fb0a0", "comment": "Malware payload (Loki)", "value": "15c25318271a12106cf7582d429ef152", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637270310, "uuid": "0acfb045-69db-4a72-8154-35994552d0d9", "comment": "Malware payload (Loki)", "value": "1cdb57dcad8da970a4e8cc71225c3e2afbbf8312fc02cde58771533c7cc71127", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637270310, "uuid": "fd515f09-8ad0-4522-aba0-c12379ecd266", "comment": "Malware payload (Loki)", "value": "ce2092b2192ca97928e4181cb763576b2ffdf3ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637270310, "uuid": "135b1072-5f0f-48a9-9c10-2cbd6222b809", "comment": "Malware payload (Loki)", "value": "bbcd77d716276e4aa82b2fcadecbd2bcd18281680aa75422c1bfd7c867e64f8b36cc5fa9ab3c303f19bad8ced4d7cdde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637270310, "uuid": "741bf670-4029-4f89-8816-1de5cf9d1233", "value": "T13584F1259798872BD6AD03FC91A5FB3947765EE4BC28C7086EC178DB3E713420825B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637270310, "uuid": "99ffb60c-e744-4b97-aa99-0134efb31213", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637270310, "uuid": "9fa4670d-803c-4bc3-8d7e-75281fe2e6dd", "value": "6144:do9fBlq9qMUW8n0sgVldxcg9w+4Hx+Tz2vXEV0ekTENqidyU3vpj6Y:do9ZlWcnZgV7qvq0ekA196Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637270310, "uuid": "c494d5ec-f719-4148-94d8-4df835612b77", "value": 391168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637270310, "uuid": "2ebf7bbf-528c-44a4-9e9b-2a57c008721f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637270310, "uuid": "3a08ad95-f17d-40c4-a2ec-979b5703d011", "value": "Olij Breeding Ethiopia Revised Proforma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc059dd-4822-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637207482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207482, "uuid": "8a4ef02b-12c9-475e-ab55-efbe6f37b481", "comment": "Malware payload (AgentTesla)", "value": "a192f0b48a46890b35370723150eaf39", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207482, "uuid": "8c462836-2fb1-4a78-9670-77494aac053a", "comment": "Malware payload (AgentTesla)", "value": "1cf22420a396d9602d5028670b9e175550da36e8fe4c3bbe85a4de01419d8f2f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207482, "uuid": "4a625b77-fbb6-4c8d-92f6-c602b559f98e", "comment": "Malware payload (AgentTesla)", "value": "034e3e2ac199c499f7fda50bbb6b854ed72f45ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207482, "uuid": "0522f9d6-8382-4e0a-837f-a2854168964c", "comment": "Malware payload (AgentTesla)", "value": "3e10eb5000d15c9af8e4b768504fc8dd577dc03bba9c6c40620867fdc5b859eefae7f3e40000d620dfcf85bdbcb84423", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207482, "uuid": "933699de-6977-4513-adef-25943d4aa482", "value": "T1A054E13869E7612EF2B2AF75DAC17293A53F6323350A5C5A41C30306BBCB9825DD052F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207482, "uuid": "d5d3e64a-9d74-4fb8-a6f0-5b2e6823ecfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207482, "uuid": "148e27ff-9510-47e6-82a1-fb435f0f4cff", "value": "6144:QsvPnRSsqKQqY16PrzK9DBLlMFMtKE4QaHnHoKP:lnRSssxAeZRKpFnII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637207482, "uuid": "2d3b1382-2649-411c-8b3d-9161753679ef", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637207482, "uuid": "ef1e3d42-3bd0-481a-a9ea-afdb6c8aba75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207482, "uuid": "fe732fce-a5a0-4b36-9bc0-52d40ba7284b", "value": "1CF22420A396D9602D5028670B9E175550DA36E8FE4C3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b12a414-48af-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637267852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267852, "uuid": "cc393fb4-6594-4b9c-a112-0d6aa3c3920b", "comment": "Malware payload", "value": "abea9522c9351119bd9f7db9c6a70bc1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267852, "uuid": "b7e28644-d566-40d4-8331-b93fada576d4", "comment": "Malware payload", "value": "1d1dc50fac47825b545ae57f3197151aec53ca53f2b93e6fcc5682932fdaa5f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267852, "uuid": "965b1eed-87fb-4ebb-8136-9ac75dc531cf", "comment": "Malware payload", "value": "caca0c1ab8360d79fb553238b3cc0628ae81bf5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267852, "uuid": "d654af05-06b9-411d-b54b-44d227f66dcb", "comment": "Malware payload", "value": "d51168955416392d0df035a1068eb7b5d0c89987021b71abb200cead0e928533468b0d4176414c634755c095e367ee2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267852, "uuid": "5c0597b0-2e10-4fdf-aaa1-026df53a2e4c", "value": "T1FFB4F126A398876AD1BD13F89474F73907795EE57869E309BEC0B8DB3E367800414B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267852, "uuid": "23d75f49-285f-49ce-ba2d-c0fdf9286a2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267852, "uuid": "627b3e93-ed21-4e54-b2f6-c299c8b558b6", "value": "12288:V2y9ZiWdNZoIl1H+kLWBjlBylTIIY8CXPQ:cy9ZVdl1tc3/IYtPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637267852, "uuid": "f54e7d78-4515-4779-8071-f258509479ff", "value": 532992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637267852, "uuid": "d7b93990-afbb-4f4a-b0bb-5cfce0a967f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267852, "uuid": "be61cee8-a099-489e-a1e8-6e9b6e13d8b0", "value": "abea9522c9351119bd9f7db9c6a70bc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6727a12-48b4-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637270153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637270153, "uuid": "f6ee4a2f-a5b8-43e5-be61-bc64c305b3f2", "comment": "Malware payload (Heodo)", "value": "c1875fcb3e13b7716ab2bb010e3f12ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637270153, "uuid": "9ea2fc32-bb32-4410-8fed-26a88e166f62", "comment": "Malware payload (Heodo)", "value": "1e6881b4a3d26ec8d9c2f6a483c0904f3e15f337eb99776e737b4a476b7085af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637270153, "uuid": "f1b3ae79-e51b-4145-9c99-96783996a6f2", "comment": "Malware payload (Heodo)", "value": "4e7fa3938de16893735f05da06349f44b56cfd6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637270153, "uuid": "b136750f-df9e-441a-8e66-6dd146b84ac4", "comment": "Malware payload (Heodo)", "value": "836bb6f746c257bffc3e744ffbd1c373037cb577f1befcaa5efd48374c64913ebd12c2f3645b2f977690c3c83a2096b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637270153, "uuid": "352e6f68-db46-4cf8-a422-36019f48a6da", "value": "T18BA4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637270153, "uuid": "01aa6920-cc8b-40b2-bca4-16ade1f356d6", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637270153, "uuid": "e124106a-3fdf-45bb-89be-6ea2929bfb34", "value": "12288:bdv8jkvzqZvv2wLB3mTi12yD88kYwZ1h1:b2Zvv2cWTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637270153, "uuid": "ac170a0c-932c-457b-94c4-dc17446a851d", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637270153, "uuid": "416d8f3a-926e-4a43-9eed-6e973fa6e592", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637270153, "uuid": "b787dd95-93c7-493a-a1a2-ff3e343ed3fc", "value": "c1875fcb3e13b7716ab2bb010e3f12ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f134a90f-484c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637225584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225584, "uuid": "0dcd450f-adb6-4a33-9c0d-6362d49cb841", "comment": "Malware payload", "value": "7329b9679b71bede54488583aa517853", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225584, "uuid": "4e466474-f901-47bb-b896-590d09612b54", "comment": "Malware payload", "value": "1ec3f1ae0b59152d86277d6ed5041cf39e5ddbfca31bddbcbe2ca33862e51252", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225584, "uuid": "6dc33e54-6405-4768-9f4b-99d6689abbd5", "comment": "Malware payload", "value": "80c37f015c51788ffed3888b7cee0db6d198285d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225584, "uuid": "71fa76de-737a-414e-9b8e-3a40ec99d3ea", "comment": "Malware payload", "value": "f7327dfd00809680c0a0a23e3143c99d2ce4cea8ab9bc4637059dc77561f58dacd7be93a777972811046edb827ca90e6", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225584, "uuid": "2422a42c-54fe-42d5-b960-368c0396b326", "value": "T168E52307B6C74B3AC4AE0A31A69BC3368166BC705561C41B639D5B1D2EF36A4B3E33D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225584, "uuid": "9a5c8556-5676-40cb-9182-50aaf367e6aa", "value": "49152:5axb1Y5AYRFtk1F2dRj45Zize1bpQ0LrUSw9C8gTJq/19n+s9RFz+p:Eb1Y5ACtW8dRj4JlnvizR1Ys9RFz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637225584, "uuid": "f343134f-9531-47ec-9ddb-0167ea2e5f2d", "value": 3090944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637225584, "uuid": "06872fa8-5f2c-4075-bdbf-76ceef5ec66c", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225584, "uuid": "529618c7-9d77-4bdb-b994-8bacb67009a0", "value": "7329b9679b71bede54488583aa517853.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497843fa-4888-11ec-843c-42010a9c0014", "comment": "Malware payload (Rapid)", "timestamp": 1637251072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251072, "uuid": "0de15894-bd74-438e-a849-58928fe32915", "comment": "Malware payload (Rapid)", "value": "3c7110cd4465acf2d7d005e39af4e7d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rapid", "colour": "#5FB088", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251072, "uuid": "442b4642-2686-4e40-86a0-ca7b2464841a", "comment": "Malware payload (Rapid)", "value": "1f1a072cd749503399a11f5cf75ee70295b4281dcf8fac0f27275b600571a699", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rapid", "colour": "#5FB088", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251072, "uuid": "116ce9d3-078c-42b7-abfe-99698b6a79ed", "comment": "Malware payload (Rapid)", "value": "49dc25f6d47d21f6a94b2eefe33d9c2b4a27359a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rapid", "colour": "#5FB088", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251072, "uuid": "dbab9cc9-d997-4d53-bf85-d70f0a02902a", "comment": "Malware payload (Rapid)", "value": "a8a2c39a525cab201f3c65861189843835a2e9c500f8bde56878ab198d6f42aaed641f57f527b8f0deb99dbb0f1a4259", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rapid", "colour": "#5FB088", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251072, "uuid": "82ae47fe-6d12-4e01-8b9b-a69b73ac2d04", "value": "T1C6152801B7900018FDF316FA5AFE70AC993DBAF21768A0C761C46AED9625AF07C31657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251072, "uuid": "7e3c3844-fe98-44a3-9f16-23d94fe40bc9", "value": "329b190bfe054353d35a5d82fc60cf22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251072, "uuid": "08a67afc-785c-4164-9860-5d1a8e282fcc", "value": "12288:jSuk39WlyES/13ZyiiSuuy05W6WGxs6WxkqkO5Dl3vMPNmF5OqMJcN:jemSFZnJxs6WxtkO5xMP0ZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637251072, "uuid": "2dd20fe6-c3d3-4c94-96ea-d864b8f923b8", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637251072, "uuid": "747c28bb-fb0e-4b60-8352-bf89d16f9aa9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251072, "uuid": "3ffb2032-77e5-42e0-8683-f4c06de00e14", "value": "1f1a072cd749503399a11f5cf75ee70295b4281dcf8fac0f27275b600571a699", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa1ce6d-489d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637260317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637260317, "uuid": "aff402af-f625-4d52-8d95-6b08d8d7fbc6", "comment": "Malware payload (RedLineStealer)", "value": "993c5e7586dee73bedd651276d9e78cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637260317, "uuid": "69439b37-e3a5-47da-8f56-c3cbccde398b", "comment": "Malware payload (RedLineStealer)", "value": "1f26f76187b3a9d8a0a3273d2ef63a604fceb3ad7e8fe38b374c624c1abb778a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637260317, "uuid": "c809de42-be09-4906-8d08-bc577a61b00b", "comment": "Malware payload (RedLineStealer)", "value": "2c2d0d8ad979baa321b5ae4008e64d45730ff849", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637260317, "uuid": "c542ded3-c3c5-4750-a493-57759de35387", "comment": "Malware payload (RedLineStealer)", "value": "cf51467321a8d09a322b507df4050c6f9ed89f1168e15cd20bc0bf1be375c03e56cf13036d3d1c51be7ebae1aa31612a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637260317, "uuid": "b6c2e2d6-213b-44bc-9479-db3ae0e148c9", "value": "T1B7448D10BBA0C034F1B756B949BA93ACB93FB9A16B3494CF53D516EA56346D0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637260317, "uuid": "b689a68a-9745-4e4f-90f3-30246c6ad4df", "value": "5ec00bbaa469943db4b6795b01cc4091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637260317, "uuid": "6bd93408-e2db-469c-a720-d48ee64518cb", "value": "6144:2waF1kSkyun60QJFS5OQ9uwGfH9wQvNT:Y2ZnVQJ05O8oH9VT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637260317, "uuid": "719e9eb6-e8be-4450-82a0-f80ca75ab801", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637260317, "uuid": "9729863a-6236-4041-bc8f-66e1f64c9c41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637260317, "uuid": "04d4e23a-7d4d-474f-822e-ab90ba640e52", "value": "993c5e7586dee73bedd651276d9e78cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0694b136-489b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637259120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259120, "uuid": "4b207ef9-8031-4ffd-97dc-9ab8641997a8", "comment": "Malware payload (RedLineStealer)", "value": "6c4e1c469e325f9176aaa763fcd0ce22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259120, "uuid": "79d4ff7c-405d-426a-bffe-aa5f602de06b", "comment": "Malware payload (RedLineStealer)", "value": "1f32c94f55bcefb65e8f03108025a8439afa500ae6a5bcba56e762c168e96e67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259120, "uuid": "8d800235-e08c-4456-b8f0-227184a7b42e", "comment": "Malware payload (RedLineStealer)", "value": "d8e46f06e1f55f8158eec17a698c4540cd744184", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259120, "uuid": "7d62cda6-689c-4f23-9598-b3e4395366dd", "comment": "Malware payload (RedLineStealer)", "value": "a207c1f51214126f973687ab082445c5b2970534412fcf37230acff7ec35901cd977a02b97392023f2c5e5873c6aed8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259120, "uuid": "66120913-5ec0-4260-8994-1f836f8506e1", "value": "T14D4533C998C3F518E15C2BF8EC52FD4686C4703140E16AED35FA1D3259988DFEB992E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259120, "uuid": "ac98de2a-9701-4449-aae9-028b089adc3a", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259120, "uuid": "7a61a581-97b3-4065-ad6f-a5341984e528", "value": "24576:VBK/RZa4mhTgu8wfAAljhLzzZ4A6uzRjNztYLx5Tq604YkEaHNYK3gmLgQ9Q:nkRZtOTgKYqlHOAx3z0i65YNa+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637259120, "uuid": "53523af9-e8ca-4046-8d8a-ecff37a49921", "value": 1246208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637259120, "uuid": "d83dff18-55a4-49ca-b39a-6349fbfacfe4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259120, "uuid": "0e63bb24-237f-462b-a2ab-e9400415494a", "value": "6c4e1c469e325f9176aaa763fcd0ce22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893e7686-4860-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637233999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233999, "uuid": "6a5534e5-849e-4fd2-82bf-cc5b8892bb42", "comment": "Malware payload (Heodo)", "value": "97a1fc3f1776040e28f83d26b2388468", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233999, "uuid": "5897f924-34b4-4614-b7c0-0f5dffd1a0ee", "comment": "Malware payload (Heodo)", "value": "1f565ad47dd6520e252a7256073fc053d0cbbeedcc1612d49c097b1288221569", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233999, "uuid": "a8c71921-5d91-4245-8b60-2d03fc9ed361", "comment": "Malware payload (Heodo)", "value": "b6f93acf8824312772f953c112abbfe88e6a3aa4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233999, "uuid": "b1794cef-66f9-48dc-9891-9db96b346660", "comment": "Malware payload (Heodo)", "value": "43e6fbd338a73a6b5f24a822d85483db384347f05b6915ff5d09e3064f7a3c0d07689f7ee05d915e2a5caf5b88e4bde1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233999, "uuid": "13f948db-5427-4fcf-8953-ce80f885b957", "value": "T159D4D0112843606FEC9C153C049977BD8FED6B55C2F4E8A7CF80E9E4AAC5CC185B6A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233999, "uuid": "73a5d099-51d2-423e-97af-81b498fd01bf", "value": "9147e5ab6cd2dcc785393175990a85b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233999, "uuid": "0772707c-4752-4958-83ce-5e0d3b2e550a", "value": "12288:uOyVoxITHISr3VYRJ0QvcaqNqMWMeWXm6QrXmZ5YIsp4:ZkVYPZ9169Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637233999, "uuid": "e2ff4abb-0a3d-4678-98ea-071dffe5682e", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637233999, "uuid": "799c55b8-116a-436b-86cd-2fc68bfd5e5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233999, "uuid": "b44c78e8-6dfa-48cd-8597-c710ab09ff44", "value": "emotet_exe_e5_1f565ad47dd6520e252a7256073fc053d0cbbeedcc1612d49c097b1288221569_2021-11-18__111314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4829ef73-484e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637226159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226159, "uuid": "814258ee-aa26-4ee4-8060-3dc2690a3a9e", "comment": "Malware payload (Formbook)", "value": "ef768c501f00d152f8f26e40544b2c37", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226159, "uuid": "67618581-2d06-420c-9acd-cbc5fdb0ed87", "comment": "Malware payload (Formbook)", "value": "1f764ecb3551ec24549ca065ea22a797c044d5b9bb65e00cd4a9e18c2bc7e904", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226159, "uuid": "16e7c696-92d8-4e7f-8aba-8171983cb5d6", "comment": "Malware payload (Formbook)", "value": "31755afe691a347cac070007e82b2a2e6e2af7a0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226159, "uuid": "70a29650-8aa8-4d64-bb14-65eb0631eea0", "comment": "Malware payload (Formbook)", "value": "81b296049ff76571b39f78411b3ce6ca6a55cd21301a3f70037d40c82742f8a8c5fdd11fdeba484dfc881052f0e8ebef", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226159, "uuid": "bcdb79bb-b0ab-42a5-81b9-04b08f27d863", "value": "T1533412083D624319E7BA2BB09E2FC5E499AEFD193540028F7E3D7A95B47B010657D7C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226159, "uuid": "e122ad1d-e5c9-49f2-9393-35e8d1325ff4", "value": "6144:316oAB6M6jYrwhWvYTcl6rk3HUu7TrkHnTgPqZFftjz:31vA8Jnh7clMosnTpZvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226159, "uuid": "b5050d30-501a-4a09-bc3c-13950e554ebe", "value": 234152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226159, "uuid": "de78e557-7655-4bb0-9839-78b8d5bddcf1", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226159, "uuid": "9116cdd7-ffcf-41f7-aec3-e01f3285563a", "value": "BANK DETAILS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20288fba-482f-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1637212778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637212778, "uuid": "4ddf2de5-f811-426c-9662-f4d1333b7b73", "comment": "Malware payload (AsyncRAT)", "value": "71b3afe849551ddf64a444f9fe6ba56e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637212778, "uuid": "ead6f26a-eeff-43ff-8b9a-987916cae4c2", "comment": "Malware payload (AsyncRAT)", "value": "1fdb9cb37d92253a8cf2461d719dd2411a63f0429eb870d5412bbbf4557b02ec", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637212778, "uuid": "33109462-a47b-4cfa-bf60-fdfe3b5458d9", "comment": "Malware payload (AsyncRAT)", "value": "75eafbb8c58bc30ca63f097742884d1faf7e26e6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637212778, "uuid": "27408c24-ce16-4836-a70e-56035412e7ec", "comment": "Malware payload (AsyncRAT)", "value": "7cc90f7b56896034a0c680abd42f8b14f02d4b84de6f0ca5b277218caba38ea385e091651f94d9652dec98145e5447c5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637212778, "uuid": "64bfa4dc-3350-4c74-8240-0b0b5a764949", "value": "T1E0D1FE6A4255C27EEE14263C3DB064538681CF9B304CF98A37B4EA3DD7E6189F54CCA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637212778, "uuid": "681e901f-b352-4520-a99e-111dba0e9080", "value": "96:B5IV6f4rW/ogcKRKfOOfuN3SVFVCDNZyRxGHIBtEs:ByIfebJF0ZyRkIBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637212778, "uuid": "2e497268-613e-4cf0-ac21-8f8a17fbef41", "value": 6274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637212778, "uuid": "ff3151fb-1c39-4c7f-bf2f-6066d03a3f46", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637212778, "uuid": "c975ac68-d56c-4f74-994d-68a9922e401f", "value": "Suspension-order-MHA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10dc8b4-4812-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637200646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637200646, "uuid": "86dc9b3c-6f85-44bc-a232-b2bef4dc003d", "comment": "Malware payload (AgentTesla)", "value": "5fb63d05d083b616afece87408bc4551", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637200646, "uuid": "e85cce8a-1492-445f-86c0-4cd0e5dd5184", "comment": "Malware payload (AgentTesla)", "value": "200e1450c66634b04e7f586cf70d83a1f5f9f7825c4b64c097f7cbbe665f0dd1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637200646, "uuid": "12d41e91-8cdb-4f66-8a69-29d2ab4c99ae", "comment": "Malware payload (AgentTesla)", "value": "1b719bc13bd04b5e371e9b92fa6d1ff8da6d900c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637200646, "uuid": "8138d6a7-24fe-4dc4-9f32-e35af7a6131d", "comment": "Malware payload (AgentTesla)", "value": "e1d0f916478b5f52dbbf3cce145c6ecfc03aafba3e2460cc94b6fd9678366584f651f8e8d6ac8f8ef00c450ea6b4d95e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637200646, "uuid": "fa6cef8a-dfc7-4ef2-bd4b-63c9ad750a52", "value": "T1A264234F71C2543BC26309362ABBE776E3F5A24D4DAC69531354AFAF37D02490D438AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637200646, "uuid": "d78806f1-7f21-4f7e-9906-53c95bad3275", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637200646, "uuid": "82b62c38-2234-40d0-8393-b55c93d409ce", "value": "6144:rGirgFfG62gozvTy4tyZTDALKPBYj0pC/C7X5F2+IJ1od15iFoQQ:3iz2g8by4ty/A0pWCj2m15j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637200646, "uuid": "d6c364c7-8014-48b4-b127-7a15e3dd6e0f", "value": 333772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637200646, "uuid": "66ef1e05-e489-47f2-bc96-ca4aa4ad9382", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637200646, "uuid": "f4586599-7f51-4aeb-a44f-294a464f30c0", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.1777.569.28940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd11b0a-48a7-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637264285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264285, "uuid": "07f1b184-ec8b-4cd4-945f-94748bbc6d5f", "comment": "Malware payload (Smoke Loader)", "value": "a44beb71e3a6e58b7943ab95455dc6d1", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264285, "uuid": "11a75f3e-0660-4e35-bfaa-8bf07c51d9cf", "comment": "Malware payload (Smoke Loader)", "value": "20363f9d72c4503b4fa41bcbc0e69b62b2e05e4878ce6fe443f0a488f0777fef", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264285, "uuid": "f8887b17-9650-4b3f-871d-fec6dc417a90", "comment": "Malware payload (Smoke Loader)", "value": "7d773b541dd1eb315c7dbcb3c54c66e1b0536a75", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264285, "uuid": "72a964d8-25cc-490d-add9-3471b7900256", "comment": "Malware payload (Smoke Loader)", "value": "4ee702884cbf692d634b21c93f75ba8f9ed76c6c0375b1b95cc6b05bc594347f54d52847fd3888b8a1ccfdbeccf54d41", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264285, "uuid": "2c58e53d-6d60-4b61-ac72-6c82427d6c19", "value": "T1F9548D10A7A0C035F5B312F84AB993B8793FB9B16B2594CF62D516EA4735AE0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264285, "uuid": "5f8ff928-7049-4c9b-a061-68f7fd8d8f80", "value": "323504891562b22c6999415c44b3f208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264285, "uuid": "6c8e36bb-2204-4e23-894d-ba9b0e6664b9", "value": "3072:G0ZpH7y+qBTvIY1ofwXaolS+TOh65a1S3I4MdIcPLenDIABC4EYVoDIcwNrfouZZ:NM0hcROrShWLenHB7VODIcyZsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637264285, "uuid": "9315fdc9-7ccb-4720-aeda-d20e22435295", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637264285, "uuid": "bf78c36f-3dd6-4099-adf4-02a7ea8bb37c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264285, "uuid": "3abaa1fd-7734-4706-b2ef-21a73ccec4f9", "value": "a44beb71e3a6e58b7943ab95455dc6d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f511ae-4852-11ec-843c-42010a9c0014", "comment": "Malware payload (BazaLoader)", "timestamp": 1637228118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228118, "uuid": "d2e5a99f-d4a5-422c-bece-0d15fa984aad", "comment": "Malware payload (BazaLoader)", "value": "192a6549b847170493ab1ad95387b1c7", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228118, "uuid": "99d27138-fb5c-4115-bdfc-ac7e6faf2d2a", "comment": "Malware payload (BazaLoader)", "value": "20eaf0edffd1aa711a0c05b69d377b9d2c7479a5b3b1e9608977cee511d59599", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228118, "uuid": "04fcee1c-053e-4381-a61d-680db76c4651", "comment": "Malware payload (BazaLoader)", "value": "1914ca9d4b3b79cd0342321e619b4283e2f8d558", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228118, "uuid": "6060fc07-15a1-4cb1-825f-1febd8b1be0e", "comment": "Malware payload (BazaLoader)", "value": "a6033db222b019af7f58617f647728c066c71b9b5a6a8aaebb9c66bcb5a61ddbda31b0f6ad910a9d718c9c8fc35acb15", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarBackdoor", "colour": "#1E24DF", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228118, "uuid": "001b1dae-3673-4670-a3bb-969ac041c6d7", "value": "T1D8D47D9AF995D070F26781358A739541D5B33C460BA1CEEF6395662E3F32BE01E3A720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228118, "uuid": "c9b53896-1b66-4bc8-bc6f-8e1efcb089d4", "value": "a7abef23aa4abf8dc36e4de8b3a8ba8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228118, "uuid": "b6450365-25ed-49fa-85f8-29090ef603d7", "value": "12288:RJZ6WAZKTmKEbNtqiUjLoox5uqPMhEBSa+kjlhdQcD1g1YbR:RLtAZxtHUjLo4gRhEBXSGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637228118, "uuid": "d95fb745-b43a-4a58-b5a5-9b36cc50f891", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637228118, "uuid": "df3c8924-4146-416b-9b43-4522f47598c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228118, "uuid": "7fd7219d-3b6a-49ed-ab3f-65d11c8a035f", "value": "192a6549b847170493ab1ad95387b1c7.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deab5e16-4851-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637227700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227700, "uuid": "512c12d2-3a72-4ce3-b4a7-c60fa5374c52", "comment": "Malware payload (ArkeiStealer)", "value": "8ef6e32a9f9ba8d54206a27da2d6e9cf", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227700, "uuid": "e4966edb-fa18-4d5f-88ab-fd813d2ffeaa", "comment": "Malware payload (ArkeiStealer)", "value": "219eb8db67f49d9faa3b11d61ef4e71dd3df12e9d1daf04412e291412130eb91", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227700, "uuid": "ad180472-67df-448f-ae9f-09ef9c238f04", "comment": "Malware payload (ArkeiStealer)", "value": "9db723dead8ed25f44d7ac27810df8cffa8a2f74", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227700, "uuid": "0aca1a6b-b649-4eb1-a88e-4732b77c1b8e", "comment": "Malware payload (ArkeiStealer)", "value": "125a8a6fe00bbd857a469dedec029fd0638d6c9f07755a81aa623bca7390234922ba0c51035107cf0f6b0fab653f849c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227700, "uuid": "9eb8f559-fd81-47cb-87e6-946a7c4fdaba", "value": "T1CE748D10B7A0C038F5F712F85ABAA268A53E7A91AB7494CF53C516EE46346E0FC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227700, "uuid": "ea0c18ac-ad67-45c9-914f-3fff403210e5", "value": "b2e29795cf26e2405a95e142d139ea34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227700, "uuid": "82be6c99-993f-478b-82cc-191aa8e7ff43", "value": "6144:pE7RPg6uXgZvgKCt3LdUVmlTifJvZ69ZCkKeGi:4gzXgRgKCt3LJ8fJo3Ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637227700, "uuid": "6e3c5305-0f6f-4238-ac73-828a6595aeb3", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637227700, "uuid": "c31fe94c-7aeb-4f0d-8cfb-fc86e21f866a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227700, "uuid": "f0f2108b-658e-46bc-add2-9fdf7f6f6788", "value": "8ef6e32a9f9ba8d54206a27da2d6e9cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325e3a32-4853-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637228270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228270, "uuid": "c124ddb8-f35c-4274-a650-501f556ba111", "comment": "Malware payload (Formbook)", "value": "b09ab8719dcc03b2b931e03789d5d819", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228270, "uuid": "968a2eee-bb2d-44db-8703-faade1601d07", "comment": "Malware payload (Formbook)", "value": "224eb07d990d08e707703af962de0b3f8414749f1a5a5a20d46d7c98337e036b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228270, "uuid": "64c49848-ef01-4b89-ac9e-3ee7139750b4", "comment": "Malware payload (Formbook)", "value": "3090e297245c31f9a031cd01f2ada6b84417b0db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228270, "uuid": "57719ffe-8fb2-4b2b-b3aa-a608d92754d2", "comment": "Malware payload (Formbook)", "value": "ef6b454567b275755025395cf15f0c66db7d98709f156d6d45dda0680f470c988fce08b9f36a2794255a51b500700bb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228270, "uuid": "774cc12d-09eb-41ae-a601-8f6366e36af5", "value": "T1F3D4D0A03AB8C813E7708576CAB0D3BA4BB0B16D1DD6C6027CDE6ADF76587647C18312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228270, "uuid": "6f64090d-f6f1-4d28-9e44-d54d7efde863", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228270, "uuid": "6dd107fe-dad6-483a-abad-6d5b80e4e1fa", "value": "6144:t9AVQlUa3HXkh22hlECn/KqS15VIFI7M5IBOyVZsPl+3JJrZ+bhZpKMjUMx+v4VK:QQ+m31gW7vYbfpNTjwR7cJ9DSaVZ+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637228270, "uuid": "a6f9072c-2aa7-4083-8478-c95c7250d31c", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637228270, "uuid": "c8964f61-7c75-498c-a957-780c2a5c9a34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228270, "uuid": "6cf9b612-9168-49b6-b90b-b91893bccd35", "value": "b09ab8719dcc03b2b931e03789d5d819.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58ae422-4857-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637230181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637230181, "uuid": "70c22294-ef88-4322-b700-1ed517f7f846", "comment": "Malware payload (Heodo)", "value": "bbf5a4df070a2910feb73726f5e6d8d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637230181, "uuid": "f81d91a1-a082-4ee0-94bf-8bd0aaf9e995", "comment": "Malware payload (Heodo)", "value": "232a8ac87d49ef253033a723671da32e837e6230a97f7255aa7ad8903c30c47a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637230181, "uuid": "79a3bc7d-0f2a-48f0-9984-f5d6d6139683", "comment": "Malware payload (Heodo)", "value": "2164120a222b9057b54042b419ab13eb19abde1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637230181, "uuid": "256e1e47-861d-446e-9f1c-ca141bdcd6da", "comment": "Malware payload (Heodo)", "value": "ede09ea5c244e1af8be2daeafa1dca5160514bbe197ff8b51f65704b613a5ed12715a9e60b3bf04a1110abe1e8110432", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637230181, "uuid": "84e5377f-d437-4b69-8062-88a35fa508c7", "value": "T17144BF10B1809032E9BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637230181, "uuid": "cbca366a-c4b0-4fcd-8ce1-38e8cb20d966", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637230181, "uuid": "31d82206-f401-4d14-8fb1-a17baaa9b166", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBR6asb:prf+WPVXNcwUKaWTMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637230181, "uuid": "a151c0f0-a7c9-44a3-9504-08e60c29e133", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637230181, "uuid": "07fd8476-bf26-415a-b0f6-5c2ebfb28d02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637230181, "uuid": "ed117bdc-e95d-4be5-9d12-9ba20a3d7023", "value": "bbf5a4df070a2910feb73726f5e6d8d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ca0675-4890-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637254762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637254762, "uuid": "6c6c4076-06b8-4b4e-ae3c-af5fdf6bec47", "comment": "Malware payload (Formbook)", "value": "a1ce13a80829e9abbf85a3c5429896a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637254762, "uuid": "36c2d37a-6a0c-490a-ac81-11f631c12e58", "comment": "Malware payload (Formbook)", "value": "2495bc16feccab6c1e1a151993ca42fdb98caa81f11d5933226bf1f72bf7bf70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637254762, "uuid": "316a112e-1d03-48d4-b96b-0a2be27ed178", "comment": "Malware payload (Formbook)", "value": "67a59bcf8bf3d0f675d100dba0494497e7f56783", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637254762, "uuid": "588df8b8-3ac9-4c8c-a487-fae5d3639712", "comment": "Malware payload (Formbook)", "value": "080ce992a3f28c394dc29fd60f99d94230a1d8ea26930e2b836dfaa9e3ac41f8d9ab8fd2447cd7aa713c2f83376ff341", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637254762, "uuid": "433409e1-85ea-4863-b0e6-fbdb53a8f904", "value": "T1A135AE7237C0A937C5B31FF89B0B82E49415BD912DA0980B26F63D4C9B77F91782E256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637254762, "uuid": "dfa28d07-f885-43c1-a1b1-f735120d9756", "value": "9932ed6ef0f007ba412ff7a0ba590c83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637254762, "uuid": "eb63b296-5e8a-4d38-89f2-36e860a1683a", "value": "24576:IAysw0SxuOso3abg4gGJaysrP/mJXgESvLqA:IAySo3vGJaysrP/mJXg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637254762, "uuid": "4691f42c-4feb-489a-ac89-bf7bc0b6d270", "value": 1112576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637254762, "uuid": "8fe81652-c5a5-4ee6-ad95-23ea0fc4d897", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637254762, "uuid": "7ecf955c-0d0f-4479-b416-a56eea7e5f0e", "value": "Novi poredak. 03526128920.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374b306e-485d-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637232573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232573, "uuid": "07a2c625-795b-41b9-9ef8-3e7fdcee9c23", "comment": "Malware payload (Loki)", "value": "8788403c75f9e4ba7b98dd2137c2432c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232573, "uuid": "034b07e4-ebc9-44b4-8193-8cd12f16b4bf", "comment": "Malware payload (Loki)", "value": "25b6d7b98d8e7f25765817157048b46e814a6e9ce2386db49da1f1e2a09e18a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232573, "uuid": "d58d8400-9cb6-4d81-a70d-63fa6b5914ce", "comment": "Malware payload (Loki)", "value": "daa74dd5073de5cec2097c4d3453d89daa736a15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232573, "uuid": "4061b766-941d-451b-a4fd-64da13632ef7", "comment": "Malware payload (Loki)", "value": "2ea56a19cbb7141695bd1dcc1df5eabb114a8539f408b126fa9b9b4f0b68931b16ef23c6490fef9f2f9ce2ccd9caf828", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232573, "uuid": "e1197637-347a-402d-a770-5e42ed9d52f3", "value": "T1BED4F10836BC9F45D73A4E76963390518771BD7AB921D28B6EC03DEE206EF4106A0F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232573, "uuid": "49717073-43b5-4ab1-8b74-60fbb5921b54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232573, "uuid": "5abd7b4e-3702-488d-b38f-6195114c96d5", "value": "12288:9vFvGueyjdRRiFT+SZp1mHDk18nwGN8pBIll15DCZWoEbopWLvXtD00:nGzCdRwKs1bmwNBIllCvEboQXC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637232573, "uuid": "0f868da0-6637-406c-88a7-1f2320afba93", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637232573, "uuid": "1b19c562-7e2a-4f65-b9ea-cd71d2640720", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232573, "uuid": "fb179822-4f2c-4d06-aac4-0ce53534a4e3", "value": "8788403c75f9e4ba7b98dd2137c2432c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1123be62-4863-11ec-843c-42010a9c0014", "comment": "Malware payload (Pony)", "timestamp": 1637235086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637235086, "uuid": "50917170-ffdc-4315-9c71-fd425d92776b", "comment": "Malware payload (Pony)", "value": "d30c56c57aa1e946318e4a303be8f44e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637235086, "uuid": "23818154-6586-41c0-ad76-175d558421c6", "comment": "Malware payload (Pony)", "value": "25be2b7b07982bf591c50b0c488e1a63a6ae233e4f061b42c8198a1e5993802e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637235086, "uuid": "8a5d5551-1b8a-4a44-9512-a233e0d3f99b", "comment": "Malware payload (Pony)", "value": "d413d1006b160d27d25e23d330aebaa69c912125", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637235086, "uuid": "48d62690-b7cf-4f27-b1ab-12fc9eeef42c", "comment": "Malware payload (Pony)", "value": "1905a04fc99c3bfd88f6c43b38994a6cb43105ee8e6ccd113ecb3fb82321f23012853decd422e257ec584f61d303edf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637235086, "uuid": "057c9690-cd70-40fa-84d4-0b327c8d802f", "value": "T12114026F7A729468C52E1F72D112BC1044379950DA06FB5DBEDA3930AF33289C3C6A6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637235086, "uuid": "51a0666c-b9e0-4369-b197-0b7f7cee8701", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637235086, "uuid": "c4abd38c-2dda-4d34-b7d9-9d247d80298f", "value": "3072:ksrjX5/p6wMVMSswRYqNO8GEblF1+GugyS3gSNxEXPWgjNHtP3tUyo0VrjXVZ:/rjX5sswRYAGuldotNHxSoHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637235086, "uuid": "5ea77b5e-ea7e-4fe7-8609-7412c9542525", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637235086, "uuid": "95089148-f21a-4eee-9e60-215851012544", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637235086, "uuid": "2d8d7df2-fa4f-479e-b243-e9ac311b59c8", "value": "25BE2B7B07982BF591C50B0C488E1A63A6AE233E4F061.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d60c1a7-484b-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637225014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225014, "uuid": "d61af50b-4e5d-453a-93fa-83d40e2d1721", "comment": "Malware payload (NanoCore)", "value": "e4d832b77babf3496f6e0a81e73752b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225014, "uuid": "9db6cc36-949a-435c-b38d-ad7620290d54", "comment": "Malware payload (NanoCore)", "value": "25dc1c67a35ee480f36d1ec2590f935ec6c8d70eacbd95e96208374c402cac99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225014, "uuid": "78abf278-54cf-4043-9e5c-6c5e86b9b2ff", "comment": "Malware payload (NanoCore)", "value": "2e0843bc7a6b40e23f3fc283e5a19ee87cb13fd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225014, "uuid": "b02f0ec6-f632-43d3-8088-4efafbf4541f", "comment": "Malware payload (NanoCore)", "value": "2b18d6b179bf4d6dd1f9ad468f46d8251d06fa8ad0a409c0175c7d4b069a627c522ca0b752f3464c156a27e070a3628c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225014, "uuid": "e246fddc-4c41-436e-b419-511987be16f4", "value": "T18AE523E136B8D463F77085B9D1B0E2B98B74B66E0DD4C6023C9E658F75A9734BC24312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225014, "uuid": "7e84f36f-3e5f-4476-8771-a923ca3f9ea8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225014, "uuid": "0c341909-3053-47cb-934a-6aecaac27d3e", "value": "49152:N3FGm9TRm6Vd6PfqJK/uz0KZtUTVZjG9iK45stxW49ICbfjPTqo6KGbfO35zGvC:fG906PfqJV0kKZmiKi/4ZL3JEXvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637225014, "uuid": "dccf911c-8fcc-43f5-95b5-7b1211a5778d", "value": 3170304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637225014, "uuid": "092c555c-73a0-49af-8b5d-bbf94e83dd3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225014, "uuid": "02910193-5e5d-4a7e-845c-671d65819230", "value": "e4d832b77babf3496f6e0a81e73752b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b139fb4-48a2-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637262242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262242, "uuid": "5aebcb29-aec8-49eb-b899-1886fe659c10", "comment": "Malware payload (Formbook)", "value": "9b959d581080c28b9f83588dcfa79deb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262242, "uuid": "837c2ce3-66c2-4a36-8d2c-3b0fdb312454", "comment": "Malware payload (Formbook)", "value": "25ed68175c29bd77c86f7e576e85fe500c2251b8c9c0a5f54e138bfa5060f115", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262242, "uuid": "9371865e-5de2-44f1-98bd-0c9a0556718d", "comment": "Malware payload (Formbook)", "value": "39d52e2eb121b9bdacef8f5ec2b8570d2d9909a9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262242, "uuid": "7f6f5b96-35d6-4ab7-a61b-e7843208e5df", "comment": "Malware payload (Formbook)", "value": "af1b2d9454110536ef5647684b476ab96156c653dcc17b86a0589899275da278eb253a5123c090dd2adcde0c3e068270", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262242, "uuid": "aaa4e729-ef9d-4fca-9ec3-eea8ae20e24e", "value": "T12F341266B1A6C0D5E0CA5AB065362C695030FCDC4869B2E7BD72326EA475437F1F11F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262242, "uuid": "f6aac6c2-031c-43db-8617-4970e54e9cd2", "value": "6144:BSkvpEXbkzjDQN1ACGIq/+STxG8oTVVwzUK1V:ZEL3rAuq/K8aVVcUK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637262242, "uuid": "cb8a4a04-fde6-4da7-95bd-acc320b47bf2", "value": 234184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637262242, "uuid": "7f1f81d2-d88f-437b-97c5-fb96b594994c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262242, "uuid": "6dec2c27-cd24-4816-9d64-63063fc46776", "value": "588885.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447987d3-484b-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637224865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637224865, "uuid": "f3d5f0f9-d545-4f8a-823e-70c53aa72bd4", "comment": "Malware payload (Loki)", "value": "c7d89afff557f5bb8030447fee1c8f7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637224865, "uuid": "457674fd-d5e7-44c7-81d4-531f1c14137e", "comment": "Malware payload (Loki)", "value": "25fc6a034e6fc15084d6c128dc3a7bc268ce9dd6964d2e399f9a9818cf714aeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637224865, "uuid": "3e369bdd-e16a-41b5-a4b7-43bf8cea22a8", "comment": "Malware payload (Loki)", "value": "a6a12edd5308e60af04e1d00ed3974a598eb4a82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637224865, "uuid": "f45703e1-7bfc-4623-96c8-f6d1fffc0bf6", "comment": "Malware payload (Loki)", "value": "eb3cbbdec9e3bfbbd89d851f40432960daa2fda8d990ec2878c9af994f8a75e232b10b2c807457ffa79b8e7732eb5374", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637224865, "uuid": "60c977b6-acf4-497e-b242-b2a5072d08d3", "value": "T1D4342A2438EE512DF637AFB26FDAE4FA889BFE722506655610C10F037911E80ED6193D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637224865, "uuid": "f08bba8c-03c5-4112-a601-1e77ee6557b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637224865, "uuid": "9d418730-5956-4d7e-b51b-f9919c215b54", "value": "6144:5G5FR1Qg6t2XDYMOtWKcFrLQ7E6mEXp35kUU:5G5FR1Qg6t2zYM2SFrFM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637224865, "uuid": "0f4802cf-78d2-4a0b-b3c4-845ab9809e87", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637224865, "uuid": "da0f49cb-5b7f-4a82-aa18-5916672a399c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637224865, "uuid": "834d860a-a1d3-44cb-9cbd-0f58f35f4a3d", "value": "25FC6A034E6FC15084D6C128DC3A7BC268CE9DD6964D2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a18785-4850-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1637226979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226979, "uuid": "b127bae8-fb9e-4578-ab3d-4a7d0928ef8c", "comment": "Malware payload (Metamorfo)", "value": "c4c282c62426b85ed1f0d5277f125f72", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226979, "uuid": "2cd2255d-9bc2-49be-bbee-40a07b7c289d", "comment": "Malware payload (Metamorfo)", "value": "26486d6aefe4ac585dfc41bc9a9dd6818873f856e9c4464bfa8845ef9abeb2d7", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226979, "uuid": "b82814d6-1222-4adc-ae35-55523688ab70", "comment": "Malware payload (Metamorfo)", "value": "34a49726360200f38d39b274699dc0e5ee396ce3", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226979, "uuid": "ceb3afee-e334-4f3c-b118-2dfd941515c3", "comment": "Malware payload (Metamorfo)", "value": "245ce77bb6c18c73a8be8e3f8ebd839ae015a296e1a49cbcb6396bc997f7d3e96d1d1beeb957da60cc8c9c230714a721", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226979, "uuid": "ee21f488-f37e-452e-a3b2-fa646a908324", "value": "T1514112041DEB032AC273CF7A28FEA19689BBFE51AD834F5E404043CB1861594EC35E6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226979, "uuid": "7575b8d3-6777-47c0-a881-c52a713b9f7e", "value": "48:8+uH+M+LsLqyb9AwbO6EO1cIXv3KaIqiHkb6NS6:8+ueFLQq2GMO5O1cGvKdEbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226979, "uuid": "bfdcb9c8-50f5-457d-9d7d-8315a1b772c8", "value": 2016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226979, "uuid": "724d375f-716d-4b10-b442-3372a653b544", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226979, "uuid": "33319948-1bbf-4409-8e93-ed3b01fa48de", "value": "BoIetos - 17-11.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecff85fe-4850-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637227295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227295, "uuid": "c00305c7-2ff2-4da8-a3f4-93c502536a89", "comment": "Malware payload (Loki)", "value": "04566f9cbd7b258a9a639b401bac1d41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227295, "uuid": "32950724-a046-4df4-a7b2-430efab9bfad", "comment": "Malware payload (Loki)", "value": "2895d107db3956c0ca188f1e58901660883272ad920a9d081d88eedd3b205041", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227295, "uuid": "cfe33038-7e68-41a6-90c1-7bc8f1a397d9", "comment": "Malware payload (Loki)", "value": "15716d5d9fc60dba04cc7fe9dcd6464927fac131", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227295, "uuid": "325a8424-3d82-469d-87c5-b716333dcbf1", "comment": "Malware payload (Loki)", "value": "b812bd53f715506b7007b5dbf35106b064af7647aaec8bc7e309b63d504c39687b67d48ca0ce3c8832516cbd39d462c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227295, "uuid": "fd55f101-ebc8-4585-aea3-bdb71e30a245", "value": "T174B4CEA036B8C427E37080B5C6B0D7BA4FB0746D0ED1C6427C9E6ADF7659764BC69312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227295, "uuid": "5d331486-b623-4558-a443-376de0cf4cb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227295, "uuid": "7d931d71-d044-4ea9-9540-cf503bcfd78c", "value": "12288:OMm31gW7BHQivyuenC4ac7he5Fz07onhh:/m3KWlw2y3nCq7hwzDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637227295, "uuid": "483ba166-a4e0-4be8-8798-2e439decd3f1", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637227295, "uuid": "40366494-1746-479d-be44-1aa9fc1e1ad0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227295, "uuid": "dc28055c-6769-4d75-a2c0-ddcaadfbbca8", "value": "04566f9cbd7b258a9a639b401bac1d41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd7d939-4885-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637249925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637249925, "uuid": "06cf9fc1-a730-432d-8cec-93f5e7c95892", "comment": "Malware payload (Dridex)", "value": "9d596dcf3fa212f9b6fc47c6f31cc5f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637249925, "uuid": "de344873-adcb-434e-b129-ac80cd6f795d", "comment": "Malware payload (Dridex)", "value": "289bbd7c84e632bd35795623e60e1aea165eb25ebd20a6d979b7f01cf43eb0fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637249925, "uuid": "dd989383-b423-4ed3-9b76-47eaa6bc037d", "comment": "Malware payload (Dridex)", "value": "fc689d94b5c806f1e165dedeeffd96288f0643ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637249925, "uuid": "a7ef375f-4628-46fa-a2b3-19b5ed294378", "comment": "Malware payload (Dridex)", "value": "991217918d3d6079ed86000c4a75c1ab3c3ae46c9fc1eeff2f69b15d33765679d701192309d3c7887dddad6bd5258623", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637249925, "uuid": "f12babf9-04f7-4c91-9aa3-f50dcd2bd153", "value": "T151E48E0250D512FCFA898ABF155A67C1C6B310824ED1CB9E25CD07EADF64A03EE6D1B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637249925, "uuid": "c6d3afea-12ac-4216-854e-9b7957367c71", "value": "fe16443ce39f2fcea9c5accdb27a9eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637249925, "uuid": "0af45c61-acd6-44d5-9086-8481fa0594bf", "value": "12288:8STlJzJzJBJZn/JH3lJxJLJZJdPgA1VKBUA1rlldJJw:8SJtpDv/lVbdT3IA1wBUA1rlldJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637249925, "uuid": "59373278-6be3-4978-ae1d-e6e20d12e193", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637249925, "uuid": "cee0528e-4447-4d87-8e17-f5b31b50dee1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637249925, "uuid": "5d33f3b0-36eb-4179-8d4b-aeb63732c986", "value": "9d596dcf3fa212f9b6fc47c6f31cc5f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bffe018-4887-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637250566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637250566, "uuid": "4feff5b8-ade4-4c3f-825a-029b9c4ee23f", "comment": "Malware payload (Formbook)", "value": "945c01f8a6a6f7d932fe923fb663c1f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637250566, "uuid": "62660e5b-6acf-43a1-bee2-e50e4ee17d15", "comment": "Malware payload (Formbook)", "value": "28b7c509a791caa6448666e9ea27d735770665cce23d0ca8a05404f41db299ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637250566, "uuid": "67a12f44-eb0a-4b9c-97a2-05a0b46632c4", "comment": "Malware payload (Formbook)", "value": "51101d919375043e0cb47b85256395ab689da5c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637250566, "uuid": "548a9647-4525-4a21-a9ab-3908dc7ec5a0", "comment": "Malware payload (Formbook)", "value": "1fe1c0e83624e9fbb3cf7f62642b1afbaf1454179f597e15d6ac5f65f8ebbefcb49a55e78ae109f3ece8a50ab7406d6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637250566, "uuid": "08bbb8eb-d245-48bf-be4c-6e43a0dc0d29", "value": "T1E374238529A6C531EBE072B00BB65AF5F7F38AED806712CF9F643F6830B35469615381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637250566, "uuid": "758ee534-c806-46a1-84a9-5f09f24d1b4b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637250566, "uuid": "0fd05354-c0f3-401d-ae0c-9434f5c6523f", "value": "6144:rGiqZygRceZklveu6LL0AJTN9LbyCDXoGrRLPMmiR170Qf4OvLLd1:yyaBqsuMTN9XyCDYG1LP3OvPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637250566, "uuid": "186f08c3-0d52-4cf1-9c08-1d86f5526188", "value": 338895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637250566, "uuid": "b56e44d1-84d8-4f80-9953-984e3a9e065e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637250566, "uuid": "e6333a55-1ff9-42b4-8fd5-815a984cccd5", "value": "SecuriteInfo.com.Dropped.Trojan.GenericKDZ.80240.31980.4427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa32a3c5-487a-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637245356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "2dccb615-4aee-4b2f-899e-2cc9234274a1", "comment": "Malware payload (Heodo)", "value": "ffc547f515d8ad986ce680ba9de8d183", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "90e3324c-c94a-4148-a055-57dceac6595d", "comment": "Malware payload (Heodo)", "value": "28f918ad42fa8ff3b0a6dbd9de50cba7bbf544be7ff0d80b8184c27383997f52", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "c95e438d-9985-4b99-a6ab-39d910ab1053", "comment": "Malware payload (Heodo)", "value": "c8d57e2d8e8e8281cce94514fc6f6f17e4163596", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "0429c0ed-1e88-4a0a-86d3-4248c6e41254", "comment": "Malware payload (Heodo)", "value": "99ad03e90f776e1faa121fb64a11b2e09a27aa5a4ab877a430318407ec0b603f0e6d287014513d163af407da57c1e68a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "9aeb81f8-05f0-424d-87ed-faec1aa192bb", "value": "T182A4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "be360135-4c53-4ed7-8b06-02208b80640f", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "03b35cfa-ce5f-455b-a14b-64b2bf4274fe", "value": "12288:bdv8jkvzqZvv2wLBEmTi12yD88kYwZ1h1:b2Zvv2c3Ti1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637245356, "uuid": "2fcf677f-411a-4d9d-9323-db93f5059edd", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637245356, "uuid": "310cbb5c-b109-494c-afac-ae3498ef7fde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "d4dec02b-047f-4506-8f73-6da7b9949693", "value": "emotet_exe_e5_28f918ad42fa8ff3b0a6dbd9de50cba7bbf544be7ff0d80b8184c27383997f52_2021-11-18__142229.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e78ac56-48af-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637267858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267858, "uuid": "558fc92f-fda8-49d6-a62b-3bf775d3237c", "comment": "Malware payload (Mirai)", "value": "06bd76692d94fec5526fd9dd310a1a8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267858, "uuid": "0d514621-6301-4aec-815e-d9a702297d4b", "comment": "Malware payload (Mirai)", "value": "291d52b470694c6bf888ed851f26fd6470fd8449dbc41ff17d5f0c1beaa85d33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267858, "uuid": "33eab289-61cc-47a1-9b8e-7fed183e0dda", "comment": "Malware payload (Mirai)", "value": "db3ec76f107aae650bf68a49707b6a22fe1d4714", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267858, "uuid": "58af19e2-9106-4af7-a828-e7bf8e7a17b3", "comment": "Malware payload (Mirai)", "value": "df30f6bf78614caa640085dbd64f357f3bbdb7c3be6a55cfe3b7901b30a45feefa4f55e01c24096f33f1a7af4244c930", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267858, "uuid": "11b44d33-a08e-45ad-af5f-cd9f00c7424a", "value": "T192530A85B8819A25C6D117BBFE1F018E3316975CE2DE73128D145F607BCBD5F0E2AA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267858, "uuid": "05c59db5-6d1e-4671-a48d-5cb03bba4cfe", "value": "1536:4dniGUODYDv3MsDP8NGTP/yAMX1TanR2NLpIaiu7RVUKWhD:23DavMCENEP6XXRZ7RVUKWhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637267858, "uuid": "012d5227-152e-47b6-a332-9bd9e7bea9bf", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637267858, "uuid": "2e65c09f-d367-4f71-a32c-40f93fbc4287", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267858, "uuid": "3f855879-a712-4d59-9a43-cb1d83e5ad79", "value": "06bd76692d94fec5526fd9dd310a1a8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a40192-484f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637226618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226618, "uuid": "7183f592-154a-4721-8c34-3f75ab9d32cf", "comment": "Malware payload (AgentTesla)", "value": "48b5a661bfb1eea63c43697a533feee3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226618, "uuid": "9eeea575-befc-4531-b218-76b20dc87dd2", "comment": "Malware payload (AgentTesla)", "value": "292cd37c65ef9c766ae2294e2758569cd0339207d8ad6a20f80cd63d13a949c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226618, "uuid": "4be246c5-bff3-435c-8891-58375f7aa5f9", "comment": "Malware payload (AgentTesla)", "value": "b1cdeff50fb4309e8274bc54e61a820ee7a13a37", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226618, "uuid": "9d22bfb5-a2cd-4ec3-96f2-ad91024e11f5", "comment": "Malware payload (AgentTesla)", "value": "3cee64b3579d7ea59ca31ec611ac9315a8d330e841c2682cb720e465be8b12db7a8a69713afe328c6ecc08dcc0940afa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226618, "uuid": "efb2a4df-e2f4-4acf-94c1-972417db01d5", "value": "T1EC05020433ECAF47DA3983F48772A06043B67A2AA571D65D6EC574CF2672F005AA1F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226618, "uuid": "bacb1df1-478b-4a1a-adea-32fe9cdaff5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226618, "uuid": "f1b84ca7-d3cf-4a74-82e8-76aab9747531", "value": "12288:yzGaYPY23pWpSsZC7QMOKFdfpkQlk4fTfBLTO/5qkBfAXFaBf/l8tv5vgOvtD00:9aOY8+knD0Qz1oKsft87vgaC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226618, "uuid": "ae6ef8ab-71ee-418b-9afe-7d4cfdb00969", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226618, "uuid": "6498eda0-2ce2-416f-8069-074d88c4d2ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226618, "uuid": "24a04ed8-fa7b-4c80-bbfe-6810f7c627e9", "value": "dhl_doc9548255382.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9a89e1-4881-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637247964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247964, "uuid": "1ee77d9d-42b9-4729-808d-9b19c1520752", "comment": "Malware payload", "value": "abec4df88b31f733fa7af25e1650cc77", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247964, "uuid": "4ca08712-3ae4-40f3-b42c-4f049d3300bc", "comment": "Malware payload", "value": "2a046ad862cf2c7f7e323fe9d3ea6b1a5870dd6113df67182c2f6dbc7b0d9bde", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247964, "uuid": "79a5b593-6cf8-49cc-83b9-f730eea922a1", "comment": "Malware payload", "value": "5e85c7f12ab3fc7a47f6df8a3db2756c711c3d66", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247964, "uuid": "fae84e58-8a86-46a9-a7e5-9eadb2e85d84", "comment": "Malware payload", "value": "d148418b01875a25ae538c2125502e8d4f46d2f2c6740c7c117c70aaa6f46ac4822b3963270904c25de8bbc7da5d35f5", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247964, "uuid": "2b19617b-ff19-405f-b957-704c8691d14f", "value": "T1E793E18B265BC98FD54A023DE307261F1FA73320DC32B9261E963E0186971B75DBD5D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247964, "uuid": "b0a01ff7-31e1-4a59-a434-202468725c68", "value": "1536:Sm3pB5SOqcuTUdehXyvl0f4CZpUcab2GFVbgPuDF7exsylBviKsUHc:Sc6EehCfCZpUHKGXbBKsiiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637247964, "uuid": "e6ef0e2a-5af8-4612-b52d-dfe3d7f26771", "value": 97292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637247964, "uuid": "7ed2cbf0-0adb-4344-8c90-00cc397f6bae", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247964, "uuid": "c6b991e6-1b49-459f-8a05-7dbeab863bb3", "value": "ContractCopy-1699198810-Nov-18.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8f7fc1-487a-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637245356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "b34f9586-8396-4dd2-ab16-92ed249c6d36", "comment": "Malware payload (Heodo)", "value": "b9c3fb7b0e328e679da0ca754a6f733a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "55793024-551d-4069-a84c-b865968fbfc6", "comment": "Malware payload (Heodo)", "value": "2aaa0b4a47a3fb6111b925ada5bbdc2a11b3878ad7c99db6666d1921e9c6f584", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "ebb83801-77ca-4883-9fa9-dbaa275010df", "comment": "Malware payload (Heodo)", "value": "2b329b0122027fc8a8964a7a1316beb779e87f86", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "94cbc377-8872-488b-a2a6-2aba8237ac90", "comment": "Malware payload (Heodo)", "value": "ea46b8137456ee2b8ad32a89ecd45ba7c327477f9844df226b70a8202cfd59be32bba86808ce1d7d5a29afcc58c6c53d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "86aba6f5-6d3e-4c15-8190-b6953aebef32", "value": "T1F6A4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "2566e808-abe2-4ffa-81f7-0833cfcd9713", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "8fcdbcc7-ec20-43ff-a9b6-c3b7e9c3d04a", "value": "12288:bdv8jkvzqZvv2wLBMmTi12yD88kYwZ1h1:b2Zvv2cPTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637245356, "uuid": "134be35a-bbc8-4a95-9681-574b0c6135d6", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637245356, "uuid": "0518d662-abed-46c6-b471-72f5ad8ab12e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "e8432db0-c044-4f36-a659-dde77ab96bd0", "value": "emotet_exe_e5_2aaa0b4a47a3fb6111b925ada5bbdc2a11b3878ad7c99db6666d1921e9c6f584_2021-11-18__142232.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c3bd56-48a9-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1637265479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265479, "uuid": "3e9f684c-a1a6-42bd-b33a-ef7b55efcba8", "comment": "Malware payload (DanaBot)", "value": "025f597d78c6726441f6e58b0739d3e4", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265479, "uuid": "beff3bfb-94fd-4c5c-9db6-c83f38868457", "comment": "Malware payload (DanaBot)", "value": "2b1b7d717550deb3f5a991732df037b3c8425a112ff775ea1f0ddaad5474eebb", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265479, "uuid": "d1bc8871-7b8a-43d2-942c-e02007f805b8", "comment": "Malware payload (DanaBot)", "value": "e701a268c47b965ec6e34a176f6b85e092e518c5", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265479, "uuid": "203c443f-8f38-4901-b2dd-f58cf935f5b2", "comment": "Malware payload (DanaBot)", "value": "7f259c14db47a9d8eb7d6e8d77c9434367da88f5fe7ee3f94dc810988ffa4ed65ce17299f15d6fa3dea4cffa9a271b7b", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265479, "uuid": "ba73a9e8-4ce2-4083-8f99-b45858f597f2", "value": "T130958C51B602E726D6A86CB8FC00C5EF14F0BD49FE44D267F6C17F9FA932241A82519B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265479, "uuid": "a0d4f830-6aac-4e41-a2dc-e5291b36ddb4", "value": "722d15dbee4dc887dbacefd834daf41f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265479, "uuid": "e5d02392-00c9-4ae2-9c3c-8f4a3148dec5", "value": "49152:lQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4B5eJqfn8+nFFQCxEsJwKQy:lfaNQh+NUABO/c0Y9AdGJqf8+gqJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637265479, "uuid": "a0f1a74e-4e5a-4923-9ac6-7d592935fb3c", "value": 1945600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637265479, "uuid": "42527e6a-fcf3-48d7-b5bb-774fd939f4f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265479, "uuid": "101c1e37-3510-42ff-8822-3d527274819e", "value": "025f597d78c6726441f6e58b0739d3e4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3d61ca-487a-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637245356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "128d0d2f-a3ae-450f-acae-3edcb72ea9c5", "comment": "Malware payload (Heodo)", "value": "f19602c3b760e948fb40f6e31c2f0f40", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "30599bad-18f8-484d-87f9-3106897d1358", "comment": "Malware payload (Heodo)", "value": "2b89895e439f9b65fbd1188e5773e3241b3213ea1a818e1040cc978e63a696a5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "1a2b06b3-0d16-4f47-9e11-3cc389035cfc", "comment": "Malware payload (Heodo)", "value": "9a331f1c15a8c4ec1310943777f900d74e2684a8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "44bda364-aaf3-4c66-8809-f832468323c5", "comment": "Malware payload (Heodo)", "value": "4d8f93c8c8ec78fd7e020e9c8ef3442e839b3f7b05a4cf7ec2688f80218af049b7b2f9b85a66b0eeac25acee82db6f1f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "d7e7d14d-f22c-4bd1-a3bd-1d906b65d3bc", "value": "T1B3A4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "e2b3c50f-6916-4b3a-a72b-7c855af63902", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "4d0208ce-5aac-4438-8a61-7df6ec28e8ba", "value": "12288:bdv8jkvzqZvv2wLBTmTi12yD88kYwZ1h1:b2Zvv2caTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637245356, "uuid": "931aa009-79d4-46ea-b6d5-edd09771bc0d", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637245356, "uuid": "6648d1b4-38e6-4c0e-94ba-b2587360d0bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "d846d7c9-fc80-4a7b-9711-164150145d9a", "value": "emotet_exe_e5_2b89895e439f9b65fbd1188e5773e3241b3213ea1a818e1040cc978e63a696a5_2021-11-18__142229.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc56df7d-4879-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637244849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637244849, "uuid": "485f7170-0864-42ac-b7d0-cf2ac2b392e3", "comment": "Malware payload", "value": "3a7f4f5e00d1da41d75b5c72c641b38a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637244849, "uuid": "4dc5a74d-6f4b-450c-ba4d-8ffb55bcfb23", "comment": "Malware payload", "value": "2babd17cf9c0ec284c2e79cffbc2509d941267dcca9a879d9d70f895218cc48c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637244849, "uuid": "c1cf40f6-3544-422f-a1c6-e06aeed2d3a1", "comment": "Malware payload", "value": "0fce262a5d3121bef531d6e5692cd6098ff6b2b7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637244849, "uuid": "978a1764-d39c-4e7c-a54a-603c61198f1e", "comment": "Malware payload", "value": "388f2f9af35abfa343d43b83815326c84eadbbfcbd5035cbdff5a89c07967fb394f5c6ec253e10ae43aa9fb6eebf21e5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637244849, "uuid": "b666e474-acac-4c77-9b29-1229c03fb1d3", "value": "T125549D641C4A348EDD8C6A6081C77ACE6BD507CEA6E8F5D1CD81FC60F6C8C4E45A7A63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637244849, "uuid": "88b727aa-7c98-41e2-a1bf-230be26e563e", "value": "6144:uOyVoxITHPgpEu+r3VT5ORuY0QzLnGv2sV4qR2kqMY:uOyVoxITHISr3VYRJ0QvcaqNqMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637244849, "uuid": "24217f35-7eaa-4554-aea6-e954c9c90d7a", "value": 294243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637244849, "uuid": "19e3c023-5d03-4bc0-a289-311d4ce845f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637244849, "uuid": "5d6439b9-22fb-4d7b-990a-143ddf657bbc", "value": "emotet_exe_e5_2babd17cf9c0ec284c2e79cffbc2509d941267dcca9a879d9d70f895218cc48c_2021-11-18__141404.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b78812-48af-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637267845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267845, "uuid": "6bc9ea41-c373-475e-ac78-b10c96901140", "comment": "Malware payload (Mirai)", "value": "00340b1e73703bd9d6fb8b9db4c25b72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267845, "uuid": "48985edf-c695-4b62-bf4b-8f6dbca1ba8e", "comment": "Malware payload (Mirai)", "value": "2bbd47e5db59d8c790d7e8bca30b669d43571928751aadbc0bdcf54279e9e1d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267845, "uuid": "f98d422b-2f74-42d7-95a1-d25f647e6f32", "comment": "Malware payload (Mirai)", "value": "d49d3e207931fd968648e7038f3161a99cf256f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267845, "uuid": "87d4a6e1-516c-4e2a-a83c-b8898428ed95", "comment": "Malware payload (Mirai)", "value": "9e37a7c1c41db627db66f46b228d51f4a1460f097e156c2fe2c8f572aa47744921ab29463e8f26acb86a6753ac657666", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267845, "uuid": "c5ebbe34-718c-4902-b193-8b0247702367", "value": "T1AB23D8C27941B639C2D157BBEE5F014E3354A7DCD1EE336388281B947A8AA0F0D67B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267845, "uuid": "0bf3a24b-6b23-4e42-b1f5-55be81270bcf", "value": "768:mDtWN4BmrWFRxGkL9sl0j1XZe1w0meoDoCerCSqgOUqiJU7wCVy/rCxHghW1/Kwt:moWm6TGkGHmetqgXq8vhWo5kkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637267845, "uuid": "217cdc06-5f8a-45d5-9880-cea8b7787523", "value": 49424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637267845, "uuid": "18c95ef8-b726-4472-85c5-75e87aec88c9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267845, "uuid": "d672ffbc-71e4-4a27-ac98-27609b727e0b", "value": "00340b1e73703bd9d6fb8b9db4c25b72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cdc7c33-482d-11ec-843c-42010a9c0014", "comment": "Malware payload (Socelars)", "timestamp": 1637211913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637211913, "uuid": "bc6c73f2-6fa1-4ea4-b554-dfd1452071f8", "comment": "Malware payload (Socelars)", "value": "503a913a1c1f9ee1fd30251823beaf13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637211913, "uuid": "b371c0ea-3f34-41d2-bb8f-5ee7956ca783", "comment": "Malware payload (Socelars)", "value": "2c18d41dff60fd0ef4bd2bc9f6346c6f6e0de229e872e05b30cd3e7918ca4e5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637211913, "uuid": "d5a9f2ec-05a5-42fa-8d1f-400e269e167e", "comment": "Malware payload (Socelars)", "value": "8f2ac32d76a060c4fcfe858958021fee362a9d1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637211913, "uuid": "92138682-5424-4cd9-882d-4a3711ad8d7f", "comment": "Malware payload (Socelars)", "value": "e0039b91a0890b460f36028c0735a90263c6a5cfa8463b8c6424399307d46ce78ceef7707b5c9bed2e8d4bdec7b5dede", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637211913, "uuid": "70a2960a-f884-4dc7-9e53-33dcc3362c6b", "value": "T1F8845A34E601F426F4F20435AC9DD7FA64286B30675558EFF3C54E69AAB16C2E230B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637211913, "uuid": "e8493908-5a63-4738-8904-8554642a3992", "value": "9734ba8626408cec04bb8fa7d8bb6e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637211913, "uuid": "570f2a6c-7cba-4ffe-adf7-d810f6cbfacd", "value": "12288:X7ww87egHPRKA/oKRefRUGe0ISuPKq/wOBp/Bi:X7ww87NKA/lY60S/wOBlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637211913, "uuid": "94b29713-f48c-4edf-bfc9-5ac606ffd47c", "value": 394752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637211913, "uuid": "88d7b283-330d-44e3-b183-55d27768e6b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637211913, "uuid": "f03f603f-3df7-48cf-af63-150c7f9321d9", "value": "503a913a1c1f9ee1fd30251823beaf13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce945e1c-484c-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637225526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225526, "uuid": "230879c0-140a-4ca4-9004-ead824a3fbf4", "comment": "Malware payload (SnakeKeylogger)", "value": "970673cfebca6ee67dfe1e931f4fb20d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225526, "uuid": "a7e53900-7725-4f2d-92f4-22fb94350b8c", "comment": "Malware payload (SnakeKeylogger)", "value": "2c989813ceb9b5618214c126b981cb6b944b8105b6c741c1ba9433aa897b3c15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225526, "uuid": "ae35578e-939f-42eb-9f85-8b9103179f3a", "comment": "Malware payload (SnakeKeylogger)", "value": "4bf3b1b39847f07605934fde10271c861783c972", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225526, "uuid": "e99fbc67-21b3-4105-ab3b-368e4e616707", "comment": "Malware payload (SnakeKeylogger)", "value": "c9c8829fdd79d4107fdb373d923279ebbd995930136e78fdc15e130bb8042beea36532b3ede03e3a1ba365bb96c437dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225526, "uuid": "40dda102-7232-48e3-8678-60c21495d6a8", "value": "T1B9052347F3C0A377E9240479046706699F7F5C3A44420FA377D8FAEE9CB0553A12AA1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225526, "uuid": "25ae9f19-e715-435c-bb71-060b32a056ed", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225526, "uuid": "3788505b-99ac-4b7a-af4a-98f04f3de086", "value": "12288:tdyW98QZHt74lGflnIGRDbBq4+9yLAOONPj2N3bqMZcUP/2PTQ3LAqwCIYhH:rlZd42lDRDb4PyER2N3mMhaQ7AgIYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637225526, "uuid": "8e7dbf7f-9554-48be-a707-c1b56f4fa836", "value": 849991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637225526, "uuid": "4af06493-c5bb-4043-88a9-5891e6860a2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225526, "uuid": "f4013852-f0ce-472c-b356-c709945d9f43", "value": "2098765432345678909876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a7879a5-4852-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637227935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227935, "uuid": "907d52fa-612b-420f-b59a-8bb1b74fedf5", "comment": "Malware payload (ArkeiStealer)", "value": "742b8e5b9cc80ad26404367ab378b7a8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227935, "uuid": "5f7527b9-5be5-439f-a9cd-ac6a0a2309be", "comment": "Malware payload (ArkeiStealer)", "value": "2d162f57aec42d53839923f8f3f98cb381bd9f406b57475d9cd9716d24ab6fcd", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227935, "uuid": "1e7ca986-9ea6-434f-a24c-02e804610f15", "comment": "Malware payload (ArkeiStealer)", "value": "e69bdb09c6df9ebe728ee27b1801c7da6f0810d5", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227935, "uuid": "b6a7901f-1b5f-4769-a363-d26107012602", "comment": "Malware payload (ArkeiStealer)", "value": "c079419c0c408f04aa9a6e70c214555102d3a7c4f69c40f6455741d60490c781fc2e2c22998bce575ccf5a6e8ce88b79", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227935, "uuid": "3d844d0e-57a7-49d3-a485-c0d27cd781d3", "value": "T12B54AE00A7E0C434F4B756F84AB59378B93F79A1AB34A4CF62D516EA4A34AD4EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227935, "uuid": "6ace7a05-2a81-4021-b026-0837c28b7ca7", "value": "ff6439958bc7d1b926a3ea41188420fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227935, "uuid": "d0a319ad-0317-43a7-a249-3162961d9fcd", "value": "6144:Zyf7JCeVmvckf59ymQCjh7UNeOiB6Uj9L6ICEgUb7:QVmvh5UrCjh7UNePt9LXy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637227935, "uuid": "57e8f40a-af2d-499a-95f3-69f46a09842c", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637227935, "uuid": "14ec9319-6421-478b-9a56-89bab1f19fe2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227935, "uuid": "80be16aa-ee38-432c-a399-12574b3632fc", "value": "742b8e5b9cc80ad26404367ab378b7a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e037b06a-4852-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637228132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228132, "uuid": "0cfa401c-f01f-451c-b430-d9a6aede917b", "comment": "Malware payload", "value": "697da35568395eb30d990af1d15ae33a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228132, "uuid": "af4fb559-6e87-43bd-9af3-c8f7624915ab", "comment": "Malware payload", "value": "2e54d4d61f4ba0e4828f0597e5fd0992cdc8120eeed9f57543b0f2304f62bb68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228132, "uuid": "05126ff9-7774-4291-b2c5-5bf9d1090459", "comment": "Malware payload", "value": "4fdf7c27437e50bd63592b974361c74819736e53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228132, "uuid": "47cf1be5-fb25-4050-8152-aee5ff97f5a5", "comment": "Malware payload", "value": "a37db867fb9583f963a61f5b39ccdd6e39bc72d6133345264e7c5cdb042c708d6a5331412ee1d88a5ef7e4372120a684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228132, "uuid": "859dc707-0159-4ec3-95d5-a3baf6c050a2", "value": "T1DE563355729A18F8E47B8277D581D52EC6B2F0122358828F4B6CDB26CF177806E3EB71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228132, "uuid": "0f01b169-a9d5-44ef-99e3-e074c6f66cd7", "value": "1861bc6d7cdbc03b4f60bf54c0a672fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228132, "uuid": "4645ecea-5fff-4edd-a34b-8247104e782d", "value": "98304:UA0xoEgGh5vBHAq+xapjlZVqYucrK7W/Qeqn3nHZkOhqFWyq8N26x+pGVnwg3D29:UAAJlh5vBH+apjlTBd/Hq3HmO/yq8ND+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637228132, "uuid": "0c8a382a-8a6e-4b90-a2b7-bec06c6c2517", "value": 5963352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637228132, "uuid": "a501ec26-a8ca-4108-a84c-344a03c92a58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228132, "uuid": "db8867d5-2013-46a1-84b9-239f55a90008", "value": "697da35568395eb30d990af1d15ae33a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef9ad5d-4842-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637221205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221205, "uuid": "8a3fe2d7-09fd-4e68-bb22-fc8891cced0e", "comment": "Malware payload (Formbook)", "value": "8dc41c543923107b312ed5a92d5a8344", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221205, "uuid": "871cb20f-f036-4968-bfc0-11ab4c9b9714", "comment": "Malware payload (Formbook)", "value": "2e8eb37bc9214aa2e543cd544dd7ccedd02e1b10df9410260ad837061747f50b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221205, "uuid": "f4679efb-e357-44d8-8074-1c8290768fd0", "comment": "Malware payload (Formbook)", "value": "dccd7ba057e84ec22b681679be4ace7b0e383687", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221205, "uuid": "91c686d3-9002-458e-9e96-265898c69906", "comment": "Malware payload (Formbook)", "value": "008f917ce8fc363b6872acdd4188292693ff97fd059e3956133071a863772d44d38b69c87c5d89b717d2591f11e1448e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221205, "uuid": "c0621087-dcfe-413a-8f21-effab9111159", "value": "T1F374CF9B3842C6B5C7698C71F06E80F306602E69DDD5D16BF7DCBF9835312423A2E9A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221205, "uuid": "89ae4b0c-077a-49ba-82d5-a419d220a2c1", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221205, "uuid": "90ac8324-4af4-4dc6-a2f0-cb45804b825b", "value": "6144:TGiCwsyxYR5MOoImVxBHmWst+pssHIRfcDn5NY+FjG5IQ3ID:+wERn85GWsw2siAdG5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637221205, "uuid": "b9bb538b-a38d-44b3-850d-d651e5499e58", "value": 362464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637221205, "uuid": "8c0f47c9-2b65-48a5-a37f-500e39013f8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221205, "uuid": "eb7ccda4-d99f-4144-9659-a35bbe10c48f", "value": "Order RFQ#2021-16-11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7fba9b4-48c7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637278316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637278316, "uuid": "82517c19-df06-46fd-a5cb-9708b8b0489e", "comment": "Malware payload", "value": "bba71bbf358b7f7b1f40f55246343c66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637278316, "uuid": "ea91448e-3be1-4e91-ba26-86997ad3b22e", "comment": "Malware payload", "value": "2f013b6c0a13830f5fb60d799623ce6131f6b37ff9b47b8de35f2daa9631feee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637278316, "uuid": "83a3ab21-dfc1-4a7f-a70e-cd388d52da93", "comment": "Malware payload", "value": "d3ba7425acddf0c5bc98fbf46530f369e60f16e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637278316, "uuid": "4a2fc49e-7489-48e4-9c3b-b315dac0fb21", "comment": "Malware payload", "value": "274f6610705d159a4780b64a71fa61a114e4a20156ee5a1532653cfd0d0095bfe9cda379384a7c1b4196e0ad880b97dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637278316, "uuid": "6522afe8-ad46-4497-b2b2-2b85f7cef827", "value": "T178D4D0A03AB8D413E7708579DAB0D3BA8BB0B16C1DE5C6427CED2ADF76597607C58302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637278316, "uuid": "ebb51a21-31ab-4607-b65b-10cfb67e488e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637278316, "uuid": "8c35c828-12b2-4a6a-936a-e6021208e826", "value": "12288:vl6n+m31gW7Vr+euuq6UXrGM/nY+xRqSzq3Seyd:vl6n+m3KWhr+/dGKxwSxe0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637278316, "uuid": "132eb87f-0d46-4afc-a6da-414cf87c042b", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637278316, "uuid": "4d768c74-458c-41f6-b83a-17bf3e77a3a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637278316, "uuid": "d26477f3-5e4b-4572-b38e-a33fcc6ac56c", "value": "bba71bbf358b7f7b1f40f55246343c66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a0e758-485b-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637231847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231847, "uuid": "5186c495-2bd2-4809-807b-9d65b9cf4c95", "comment": "Malware payload (Formbook)", "value": "3b7ed2c43e608053f737b3a1e82a1cfe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231847, "uuid": "02eeeed4-5caf-4a79-b5e3-04359dd6e8d5", "comment": "Malware payload (Formbook)", "value": "2f6e89afd122fb052c5ad063bfe784b854157f9ff99af0a8aae4b7d19641ff61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231847, "uuid": "0f7009af-1c47-4367-8c07-9c14dca98c00", "comment": "Malware payload (Formbook)", "value": "2ba38118cc730c85f6ffa27e7def97473f9c397d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231847, "uuid": "e395ffc0-ff1d-4c07-b739-390b159258f6", "comment": "Malware payload (Formbook)", "value": "67c619804826a6f5382cefbcc03ce2a649b7e059c9f846436cabfd74837ab712dee2e894767de49b733ae35212a01c19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231847, "uuid": "7bee3aa5-9f81-404a-9c3d-20871a2d7d31", "value": "T10854121BE5D95AB7C8A84B366633DF389B77B18E03360E4767289F359CE36124B14281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231847, "uuid": "8706c0f4-04b1-481a-acde-a6615a431ed3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231847, "uuid": "bd8f6ab2-f3fe-45c1-9f49-3e6e1a7dd836", "value": "6144:rGi2oU42WmpwE/7NgSIgEDwu2stKkTtq6h:dxmpw2XgtKKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637231847, "uuid": "78e205be-1d56-42ab-b87b-c5ab86d3fef6", "value": 298861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637231847, "uuid": "18623d4c-17cc-4fde-98e6-bf0f42d02f2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231847, "uuid": "ccafa90d-910d-4037-a74f-044ca586a3b5", "value": "3b7ed2c43e608053f737b3a1e82a1cfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17d92e7-486e-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637240160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240160, "uuid": "a3b96206-2b98-49dc-ad51-fbbcbc7b9d46", "comment": "Malware payload (Loki)", "value": "cc48c6c3ca95535e13ce6fee9648254a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240160, "uuid": "b0656fea-5e61-405f-a86d-2e15ab003ed2", "comment": "Malware payload (Loki)", "value": "2fb79fb59abd67a4db2d1e307700692835d3d7585c13eb23f1b6b2b4f7459a4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240160, "uuid": "4eefe0e3-ca5d-4ff2-91f7-6d8c0ff540ed", "comment": "Malware payload (Loki)", "value": "fadd7a667079fb0d9cffeec9bbf9d23bc854b5f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240160, "uuid": "b44f966c-aa0e-4227-9d4c-b60963ab8e71", "comment": "Malware payload (Loki)", "value": "596504b1e7eadc4e6fcdecd179af2da1c5dab22a6ceea669cb18026720a12e99efef1abdcf0a3b2895450fd044b9a5e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240160, "uuid": "328763eb-8a59-4588-a21a-1a52acc03c31", "value": "T1E9C4F1057BAD5E42CB394FB69933B0408372BD7A5E21D2C79EC129DE216EF840161F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240160, "uuid": "c643b54d-d5b0-4dc2-8c87-f1787d5c7583", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240160, "uuid": "559f9c55-79a4-4213-a0c0-24e86edb4c5d", "value": "12288:5mkibEotdnHIQnlC9nz2b15OvYsfWW7I25EDwtD00:5uEenHLlszM1545vC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637240160, "uuid": "09971831-998c-499e-867b-0e6433d4b38e", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637240160, "uuid": "f3fbcbe2-b636-40b4-b5ea-c90cf434fc3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240160, "uuid": "64d218d0-58c0-477b-812c-79289d4e0ca8", "value": "cc48c6c3ca95535e13ce6fee9648254a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a3a2e0-481f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637206262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637206262, "uuid": "9f9535c1-68d8-4d69-bbcf-4a1c5e8f9d20", "comment": "Malware payload", "value": "065f2d7e157ab8e18acb4981e0ffee15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637206262, "uuid": "b1a94dc1-a1a2-4854-ae35-c44763693515", "comment": "Malware payload", "value": "3093fc14a0bb06b811cfd1551715b43f74fdbe75b179e27e44f737a2a1c7154c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637206262, "uuid": "29fb72af-87ad-4550-a38d-b7c9c1daf6f9", "comment": "Malware payload", "value": "fead21dd89c64c80a4619fa1af208afc0a768692", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637206262, "uuid": "8adc8b19-b688-4bcd-9140-12c688ddeabd", "comment": "Malware payload", "value": "7285fd5a74a98b3b4544c971818c20fb7f9892c48b9180bfd9d42256aa930e9ca9773f9b2d466be3c14660693621515c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637206262, "uuid": "c82d6d18-5f0d-4d2e-909a-b02a998595f3", "value": "T10D75E00373DE83A4C3725273BE56B756AE7B7C2506A1F59B2FD8093DA920121522F633", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637206262, "uuid": "7095f58f-3995-4077-a8dc-043f33624f54", "value": "bbac62fd99326ea68ec5a33b36925dd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637206262, "uuid": "aeb72243-7a41-42fa-857f-2e347ae69b2a", "value": "24576:O4lavt0LkLL9IMixoEgeawwKBsURd7ibrIz/J1+BNLQrrv0hq9MmCS:5kwkn9IMHeaww+ozQrrYaPCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637206262, "uuid": "6da2d563-fa8b-4d86-aaa1-f824bc6cd784", "value": 1573376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637206262, "uuid": "69f1f0ea-4b2f-4712-831c-6b53a129e337", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637206262, "uuid": "157f3388-3411-414b-ace0-eacfa8209ba3", "value": "JGKWRU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f91ebd9-4852-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637227943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227943, "uuid": "c87851ce-94b5-40b8-9dfb-3f4a600f8ceb", "comment": "Malware payload (RedLineStealer)", "value": "82ac0e251996e14101753c3511760d4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227943, "uuid": "155dd82b-e8f5-421e-a237-01aa187bef88", "comment": "Malware payload (RedLineStealer)", "value": "30d39f83d5df83960c7eb229e2f11efbd8068df72e8983bc754cfac786a32fc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227943, "uuid": "ede4638c-e87b-42b3-9648-264fea5c83b4", "comment": "Malware payload (RedLineStealer)", "value": "b8dfa94d146f5d741667eca62779380789fc5f39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227943, "uuid": "86c1dc52-e7ad-4419-b8fb-16bf03569039", "comment": "Malware payload (RedLineStealer)", "value": "959f9b4da791b9502297d8a80b8b295d761acdc13cce9f08b81b76f2aff4fe09be660dee601eb7d0f5bb464bb34465ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227943, "uuid": "7ba1b8cd-1fb2-4e5c-93a4-8a4d3224867b", "value": "T13D74CF00A7F0C039F5F716B85A7A9375B93E79A1AB7494CF52D116EA5634AE0EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227943, "uuid": "87374f8b-aae4-43ab-b742-80bef456f0eb", "value": "ff6439958bc7d1b926a3ea41188420fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227943, "uuid": "0d350f77-ab06-4451-94b2-8cd6095aa70a", "value": "6144:EtPuteb1z2cpS3k2jVRO7kQfoTPyH+0yQZtwGZGY7:8Put8tpS3k2j7O7kQgTPyH+0XwGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637227943, "uuid": "9567fc70-fbf6-42dc-b769-3b8b3cadc733", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637227943, "uuid": "2c4a797d-23d1-48fe-ab2c-d44a298eda48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227943, "uuid": "4e1388b7-24d9-4b02-97c6-ea443601605b", "value": "82ac0e251996e14101753c3511760d4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8e01f3-48be-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637274352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637274352, "uuid": "5bee4231-1680-4180-bf12-603305e19f6f", "comment": "Malware payload (Formbook)", "value": "748bbd4f61306940a61925b292f262d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637274352, "uuid": "56275d26-f572-4d90-aa27-602858a038d4", "comment": "Malware payload (Formbook)", "value": "3126bcfd452b2bc621ca61b815ef76ba2544907c95035bbb29357541481b461b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637274352, "uuid": "05e99f94-0aff-4c37-9fba-a08456ea10be", "comment": "Malware payload (Formbook)", "value": "e2d153a3dfab7adc58d75366a64b5b570c8e27b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637274352, "uuid": "fa0dbc9d-5a12-4301-b208-67a9e73cec97", "comment": "Malware payload (Formbook)", "value": "e0076543a54f19e1c133f2f55dc31dcf7936830d55f17d4875780b642c564316e972deee694aa47f2e931e30cf248582", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637274352, "uuid": "3d88dbd2-2563-4547-aee4-b810e5a7d05d", "value": "T15E55231827A54F2BC5A203B87865F33847B56EE03559E748AFC0BD973E7634086267E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637274352, "uuid": "19d5bf71-4dc1-4656-8ad9-dd34bee96d99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637274352, "uuid": "eb5031ad-44cd-4035-8d08-72aceb3d35b7", "value": "24576:A9htdpNuPTUFHUuLHgFrZSP54y9REl3Rsgk8PtyeuyMJh+m:A9htd0+94WcaX8In6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637274352, "uuid": "42dc0148-061f-49af-91f3-4692c5c82b7c", "value": 1297408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637274352, "uuid": "996e8a4a-eeb2-4db6-9914-2dfa0bae2b5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637274352, "uuid": "adb12f5d-cd43-41e0-ac83-2982e3127585", "value": "Ilb06BsW9UN6Zeu 3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc532de-489d-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637259995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259995, "uuid": "a50536d9-aa51-476d-a44d-550a51b92ea8", "comment": "Malware payload (SnakeKeylogger)", "value": "cbd437d05e327c0efeb24cc35b303c70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259995, "uuid": "d385f77b-0918-425f-9ef9-4e30ad090239", "comment": "Malware payload (SnakeKeylogger)", "value": "314c94862ddfbf8dcd0389097df59a852b7689f7ff69cfab9d5bdada760a2958", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259995, "uuid": "ed8b793c-4477-4bbf-adb4-d2ee8da767ec", "comment": "Malware payload (SnakeKeylogger)", "value": "3df32bef41429eab279d635389fb05852140ee56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259995, "uuid": "96a3efa1-33c5-46bf-b2e3-f84e9ea820be", "comment": "Malware payload (SnakeKeylogger)", "value": "4838ffc1d9906895de60013e37d2182b2796f77c88c7c454479dfb28918d4166b15dbd034f3b74b90cdf9a117b73861e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259995, "uuid": "8c6d4878-9499-4888-b066-cc32626cc9e3", "value": "T163943F1DFA060672FEBEA1B04C110A44BBE60F433E40A99657CB25E6875FCE69D4DC87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259995, "uuid": "661c85f9-0d68-4158-bc70-b7e45b40f2ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259995, "uuid": "86787c0b-7b43-4d01-acce-120a90c3e92b", "value": "6144:EEY2NrvJ1MdM6sKPJuiz9lWTdsgzs0CtFm9BmP5:En2NbJ1Mq6sKPJuc9U8tFmHw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637259995, "uuid": "452175f1-6376-4a7a-8bda-71e57b5df92b", "value": 438784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637259995, "uuid": "651e7c3e-97f8-4807-b342-3aefcee32661", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259995, "uuid": "d5e27a1a-453c-48c9-8f36-49bb349ff7ae", "value": "cbd437d05e327c0efeb24cc35b303c70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1dcd3f-484e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637226090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226090, "uuid": "c37c0ccb-befd-4abc-acad-3b8ba46f5b9a", "comment": "Malware payload (Formbook)", "value": "14be4834507505c85ed0790ceeebe5ba", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226090, "uuid": "b1fcc811-38e5-4390-9892-bdf4b7d25da9", "comment": "Malware payload (Formbook)", "value": "315b35059792a62e53ef2443f0fd5ce87509a4b7d9c84b3a679940ef785adb42", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226090, "uuid": "69c6fbc0-b8a1-4ca0-9975-7f8229b53b18", "comment": "Malware payload (Formbook)", "value": "61e1afbec7f215e598a424614bb43df95e5d4fbc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226090, "uuid": "40af1d6e-ba61-490d-82c4-15e2ad9bb263", "comment": "Malware payload (Formbook)", "value": "3c80894d00ae23294cea3dfa2c12f35be468e6ccdeb5b4a8800c865147e716a23b79f2600f407f4adab5bb353e1a16ff", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226090, "uuid": "d7790318-bb58-4793-b518-d9cc9c758e81", "value": "T1FB426EACC0A706888F8567B82B2B9F8411CC762DF748A533767C53352BD6E7A516393C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226090, "uuid": "8652541c-605f-498c-a6a4-3a720abf5ddc", "value": "192:uxv6ppoERArIn5rx7fXx/gDNfhKwDQLOYMWoTD1LQLa2tEzSLAKmFR9H:JppfRfPtgDN5VDQL1Md6La2tEuLA3R5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226090, "uuid": "4f2146e9-9236-4b7f-9cee-dbf47227485a", "value": 12841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226090, "uuid": "af2925f8-f5ab-4f9f-a531-942e9ec67f04", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226090, "uuid": "ec56a2e0-b01d-40c9-8ea6-c4e05d8eb096", "value": "Sales Agreement 17-11-21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2ff3c1-48a5-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1637263448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263448, "uuid": "1f05dfea-4f97-4d65-b2b0-26ac55f2a0ca", "comment": "Malware payload (DanaBot)", "value": "88dd9303f42e9572ebc795233e0fbb19", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "DanabotLoader", "colour": "#BDCAD1", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263448, "uuid": "51f49c6a-5ddf-4a69-a303-8e9eb406a4b7", "comment": "Malware payload (DanaBot)", "value": "32a11ff2e2b338b0c909460ebfdb2874a3cbdc27f379f8a45fc82aa232062f19", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "DanabotLoader", "colour": "#BDCAD1", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263448, "uuid": "8f9bd729-8bdb-4f18-addc-3266181ed522", "comment": "Malware payload (DanaBot)", "value": "c9c2a1a8a9c7e3c650183038a4a654d219929ef9", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "DanabotLoader", "colour": "#BDCAD1", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263448, "uuid": "dacb28c5-ee5a-4140-8ec8-b49861ecc360", "comment": "Malware payload (DanaBot)", "value": "15b8babcf30342c29c38294242631b2faf0072568f82e8ad4b4ce86771aafc45c393c2333686dfb87a9f6f5e47c4198d", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "DanabotLoader", "colour": "#BDCAD1", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263448, "uuid": "5e05dc99-cca3-4a5a-b67a-1566687dd125", "value": "T1B152BFA83DA80A1F5651962D28E87F24258DE4E78D2BF4D021F601384EDBD7D0B1D1BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263448, "uuid": "8195dbc6-5c55-4193-9215-ab6208131258", "value": "384:hBrQxlhgcnyOPh9aqbl8RDNY49owQ7tv2+3Uxreb:3rOkcdJvbGRRYDwQ7tv2uUxreb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637263448, "uuid": "ff02a0b8-7fd4-42f6-9f17-4048365c3af9", "value": 14264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637263448, "uuid": "72afc4b7-2a5f-4df2-972b-b808600c87b8", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263448, "uuid": "2fcf2788-da06-4272-8d77-5d0ec7dee6b0", "value": "flastname-x344063qg.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893a8f9e-4802-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637193627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193627, "uuid": "afbe6041-6bca-4fb0-a8de-031511008cab", "comment": "Malware payload (Dridex)", "value": "e1106797647ca122fa34e757632c146a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193627, "uuid": "e71f3bc4-0b42-4b03-a47b-4e87f9035803", "comment": "Malware payload (Dridex)", "value": "32d586a56d67479bfb6a97af3946d36eef30763c090fe183ea859235b2b41be2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193627, "uuid": "967f9e50-1f6a-4875-af28-c91f578548eb", "comment": "Malware payload (Dridex)", "value": "e16da3924cd9bd42a2414627bf0137c3508edb49", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193627, "uuid": "6da92f15-6227-4961-9058-d15f9fcdfc7b", "comment": "Malware payload (Dridex)", "value": "44337b7bc01f3c279f519c815d0e1bef34532e600ee47e10e7f0776b50fc9f9a452659a38b45ae2c0b4e779514243fb4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193627, "uuid": "b96ce0a0-aed1-4f3c-a24c-348ef0aab56a", "value": "T1C3E4B01E7188C05BC5CAACB974B37B646585943C2DE9A4F7F06336A8D74B2B8BC17078", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193627, "uuid": "ab423f02-b3c0-4a41-8c0b-3ab03bc25cf8", "value": "b7c97a32f8446f2667c75327c69c37cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193627, "uuid": "ffd76ae0-9809-4dd3-bba0-5a033759b2e5", "value": "6144:LHG2WUYYUeWUkWk+WUCWUmWUOWUwWUA4UUWqqWUGWU8YUCWC4WUiWUrHw9GlzgYy:KOHwszfO5snBpZf4w0IAZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193627, "uuid": "355ed4be-c93d-407b-83b3-ad822288d559", "value": 668520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193627, "uuid": "28b7d652-291c-4e80-a9ca-8040ff74e573", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193627, "uuid": "ea859770-1825-4b17-9410-d6306f5f0017", "value": "SecuriteInfo.com.Trojan.Dridex.777.11918.677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81debf51-4802-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637193614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193614, "uuid": "6711a13c-b6b7-42d9-a835-b5e203e47d6c", "comment": "Malware payload (Heodo)", "value": "a56d5d12fd7467f24a33e27c42a72ed0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193614, "uuid": "a993dc30-bd97-4e8d-a3c5-28eb1d4fafcb", "comment": "Malware payload (Heodo)", "value": "33071cfe4a660d03766c50095a72e1c696c614a0c701fb5b2365f3bb54f1fec7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193614, "uuid": "0c1fb07a-fbc6-4579-865c-13fa4054c74f", "comment": "Malware payload (Heodo)", "value": "4bb944628d40f6197b0f04c1a320c32fe08c609d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193614, "uuid": "4dac5c1a-2904-40f3-a053-57e0e86319f8", "comment": "Malware payload (Heodo)", "value": "684ed6ad52ded38ecc5d14dfa876c2f0537779b9decf237227836f4575e32b60fb07125d1dea3e1698a91f59a074b36b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193614, "uuid": "b8f0d4fa-1764-4145-9db4-15e9d05dbdb4", "value": "T1AD44CF01B280A072D9FF193A85F5C66A4A6C7A500F90D9CF53D80DBE5B765C2B6309EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193614, "uuid": "194c9817-f4ce-4740-8dd2-bf0561217679", "value": "822ae775303d14fd9c529b33f0deaf77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193614, "uuid": "2a43e0d2-48ad-4d44-bbd8-054d67441858", "value": "6144:ndH09uYgR7OJSuwuZc2HEaYTy7beWTBdom:dHJtlec2HEaYTXWT/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193614, "uuid": "11fb043e-bb9b-44aa-a2ea-ffc482333bef", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193614, "uuid": "aa13b80d-6d93-4c84-88e8-3a9e84bbf250", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193614, "uuid": "dcf61c0e-6e05-4d6f-b6fb-6a9f02f10808", "value": "emotet_exe_e4_33071cfe4a660d03766c50095a72e1c696c614a0c701fb5b2365f3bb54f1fec7_2021-11-18__000008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb2b46b2-48c1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637275825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275825, "uuid": "4aef27ba-7cb8-4081-bd1b-d8be5915e697", "comment": "Malware payload", "value": "cb3921b78a80ac2a545189ce30054a03", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275825, "uuid": "c26b6c0b-0dc7-4de0-95d3-42fa8c0a9ccb", "comment": "Malware payload", "value": "341bc86bc9b76ac69dca0a48a328fd37d74c96c2e37210304cfa66ccdbe72b27", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275825, "uuid": "f1a62b84-2d70-40cc-82ab-eed6b0a7bb8c", "comment": "Malware payload", "value": "77a86a6b26a6d0f15f0cb40df62c88249ba80773", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275825, "uuid": "510e6cef-7524-46e5-8fa5-1a3aa39dec6b", "comment": "Malware payload", "value": "f3d4b01ff0b219e031086cf7db93540b025bc8c30445222e662802e70bd01355843d01f1fade1372cfdbaeba78b7e8ba", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275825, "uuid": "7e118d2e-56f5-4f8c-bf19-56d414bc56fb", "value": "T1C862C5A1FB98C51AD40DC1B484EB0BC051E4FD600AA9632F47C1E6795FF7B892A5A70F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275825, "uuid": "75e07547-5103-48ba-84b0-a2b9a827160c", "value": "96:x1hhFQbN3LLkvD53o626WhsvAuHIt/rYTV/A26OqE5y/yMRWDTVx7dF7GQvUL9tc:T/hvDhowWPzpcAjOte/0fVZ7GdJLmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637275825, "uuid": "1207fe7c-2d0c-4bf4-b576-e139ee6e4bc7", "value": 15292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637275825, "uuid": "d7f96746-335d-499b-9f85-dfd384cae17a", "value": "application/x-mach-binary", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275825, "uuid": "b8639942-c2a5-4584-8024-f9127c84ebf6", "value": "341bc86bc9b76ac69dca0a48a328fd37d74c96c2e37210304cfa66ccdbe72b27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3d4d26-487a-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637245356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "d8e99217-f53a-4fa2-8778-ada2b9c4b293", "comment": "Malware payload (Heodo)", "value": "c05c75e4cfc4ffa0a9e444e8522bfd0c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "91ec9ac5-af92-4a6a-9ac4-0080d27d8809", "comment": "Malware payload (Heodo)", "value": "34793d5d05416fea3472ff62b2d953fbfdce5efe088d1409a8ef684d94dd5dc0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "db726a68-6511-4bef-ae86-77a51ae9a8ab", "comment": "Malware payload (Heodo)", "value": "468a30e689862ec7a840e64ca5a0d9429d7cde96", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "55b31df3-4de7-482e-8142-d438df148ab2", "comment": "Malware payload (Heodo)", "value": "bf39521b79315d14d0d304465508807e5e8947495f8bc371831049bff379452ee75a1afee1db9a77d101986bd79fc2f5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "a87cb7fd-d627-4f25-a526-8137bff567be", "value": "T1EBA4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "1787c654-a701-4afc-99d2-806060404a65", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "708eb1f3-5036-491e-8f50-37a6468681bc", "value": "12288:bdv8jkvzqZvv2wLBCmTi12yD88kYwZ1h1:b2Zvv2clTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637245356, "uuid": "75d279bc-7126-4f8c-9f64-22f5d19a49cd", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637245356, "uuid": "05de5294-d5c7-46d6-b465-e536d50493b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "31ca2104-14f0-4fc8-9075-5c248a00ab24", "value": "emotet_exe_e5_34793d5d05416fea3472ff62b2d953fbfdce5efe088d1409a8ef684d94dd5dc0_2021-11-18__142230.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a786802-4855-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637229062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637229062, "uuid": "217cc0e7-98c3-4636-aacd-5583bc8f69a0", "comment": "Malware payload (Formbook)", "value": "836defaa62ead456b88f4ff5b376ced5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637229062, "uuid": "52a41914-a4d2-4886-b866-02b351f7db88", "comment": "Malware payload (Formbook)", "value": "355da352f5a3782b61c87156e127d0ad167a379a7b9a0889574c2a773b55a122", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637229062, "uuid": "136608ad-49c0-41e2-aa58-a6776f9f8cc6", "comment": "Malware payload (Formbook)", "value": "1806b010ac7de322829d37e147b7f7c39b279c93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637229062, "uuid": "f6c57fc6-9bac-45ba-9a5b-b9debbfaffe0", "comment": "Malware payload (Formbook)", "value": "60892855db63d34ea3e9c9ab69cec95725b5d7faed0dcd52fa94bcf2836e99bd4ca73566af2c0a1df9ee81f16cbe10e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637229062, "uuid": "9c329568-7356-4148-857c-5202e21afe11", "value": "T178D4D0A036B8C413E720867AD6A0D3BA4FB0B11D1EE5C7427DEE2ADF76597607C58312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637229062, "uuid": "44a39afb-d46e-4468-b54b-60754a443bc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637229062, "uuid": "2e59c7f7-2bda-424d-9537-364748bed1cb", "value": "12288:x4zlm31gW7Ixgyxb0QwM8YneKC6xH28EK8xr38WH:azlm3KWExgGpwM8YnXFEhp3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637229062, "uuid": "8f907a82-e7f1-47f6-b0b8-8067f5219e37", "value": 601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637229062, "uuid": "dc54f472-8801-4d68-8cf6-226bb732b8da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637229062, "uuid": "0d7353e9-73b1-4d72-bfb9-25b27af6cafe", "value": "Booking Confirmation 548464656_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37341ec-4843-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637221642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221642, "uuid": "fce0e735-50ad-46b3-9aa6-e7ca6c88452b", "comment": "Malware payload", "value": "49aeda79e3955d30c8313cd20403da17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221642, "uuid": "109b2921-eaff-479d-a757-b7caebae2a06", "comment": "Malware payload", "value": "358010e032bda5a420d783bf111a7efe6bb838695580dfe69a572f258925594f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221642, "uuid": "f6d7d5c6-cea5-4a23-87fe-980a1c4072fc", "comment": "Malware payload", "value": "dc2604c4d4abdb1290ad585ef2c6c0343e37f012", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221642, "uuid": "a44ef71e-d7f6-4172-abb6-3f4c0d778a95", "comment": "Malware payload", "value": "f0acff5d080589b8e4a01edf37f7d7c5119c4be3e44258e34cfb8e9da043da4f313b645ca97cf2b9f137594b9f3b0013", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221642, "uuid": "7cc0f171-1cd5-49b1-90b8-f5672020d6e5", "value": "T1CDB5330C1376B8FDF85E422937634ED0C2B9A1E1F5426192926848A85D3F5BE13EF972", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221642, "uuid": "b03d3156-37e2-4815-b9b8-0e6088ee6f33", "value": "49152:IDSOgOhntWID2I0WkAfMtjNA2zT2VYRfl3PvJD/8axYytFOdW25LfprN:IDSTOhnXSI0Wk5jG2nfBtkaeytFOfdpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637221642, "uuid": "5146d5ae-5dd7-4719-9091-ea6d71096a08", "value": 2379776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637221642, "uuid": "5c996a79-c570-450c-b167-6ac0e63584b3", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221642, "uuid": "5bd42fc0-ce81-4618-9445-96d564f683fb", "value": "358010e032bda5a420d783bf111a7efe6bb838695580dfe69a572f258925594f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ac46fa-48bb-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637273242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637273242, "uuid": "47d34915-6d1e-41b7-9007-4d19c8ef1cdc", "comment": "Malware payload (AgentTesla)", "value": "2f2ba71a059d04898275370bb3f2130c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637273242, "uuid": "40a0e266-f024-4520-aa94-be3b22c471ee", "comment": "Malware payload (AgentTesla)", "value": "358bc7bb784febfd9119a4bd893abd283de9a261f70abf91f1e974459216139b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637273242, "uuid": "2c2c95d1-6ade-4330-b14f-6fb19fe1bc8c", "comment": "Malware payload (AgentTesla)", "value": "ac2bccafdff44e4c3ffa759d0c94354eaef93fe3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637273242, "uuid": "c8a469ed-62f3-43e1-8322-e10e42a0a2c3", "comment": "Malware payload (AgentTesla)", "value": "934fd89212a60eb04480cb78e57cc0663adefa7494ab0c43f7585ae86fd0b385b890c3cf889d82142b638384b104c8be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637273242, "uuid": "2c37dc1b-93d1-4923-87f6-eb6f6a799449", "value": "T14505120433DC6B62E67993F48A71E07043B67E7A0A31E2AD6DD164CF2572F045AE5E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637273242, "uuid": "248b583e-f0bb-44c3-a34c-9cdd55e953c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637273242, "uuid": "e68002c2-58f7-4c25-95b3-b65d7541c495", "value": "24576:f2HjzZs9D5ztUjZxYIGOnKmi6UWk5nEC0:OH+p5ztUdiIIWmEC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637273242, "uuid": "636c1dac-24dc-4005-8016-5248609b3e55", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637273242, "uuid": "7d615b6c-aa4c-4d9b-afcc-e5170cd63890", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637273242, "uuid": "0a361eb5-f848-46a2-be96-2f033d8b7910", "value": "StK0hTNVyxxIPrJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f41da51-487f-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637247136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247136, "uuid": "57908fbb-0148-4791-b6ea-2091a1aca796", "comment": "Malware payload (Smoke Loader)", "value": "4c72e48b856d03386fe5d7f0af228f34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247136, "uuid": "c0948916-2411-4255-b036-452fa02c2f7e", "comment": "Malware payload (Smoke Loader)", "value": "364e6eb302ea9226c69d3efc8485f827e61bab6e2ea34fb85c8a87a604e3ed5c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247136, "uuid": "99d75234-90f3-4c7f-8d52-2150cd6d1cb7", "comment": "Malware payload (Smoke Loader)", "value": "6a9b57f02965c7673e41b8605dad98dfa7220cdd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247136, "uuid": "0ee3ec6c-2558-499f-9da5-2976b6f94368", "comment": "Malware payload (Smoke Loader)", "value": "49a6e4f4422567944620821e70992095d49cc3fb1c1ab14f014c3a9cceaa26a428f80be1a6a7221b80a2d1ba20e7fd9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247136, "uuid": "3a8d08b7-1732-4be1-b747-4a1600115fb4", "value": "T19F448E10BBA0C035F1B752F849B993B9B93F7AA16B7490CB62D116EE5635AD0EC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247136, "uuid": "f91e6103-6646-4881-8f2e-a953709ba34a", "value": "9abf03d4e22c0a12cb29c8d67fb192e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247136, "uuid": "973cd42c-67ec-4c16-974c-c8ad9ff85ff7", "value": "3072:70NpU7yPWu8y75Wp9QY+s8xPJpfk85R/lRYYdR4TO44RFZY3416PiqVuLzmLBNkN:Up845Wf8xhpTt+nTOPRYIcP/VfLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637247136, "uuid": "c016414d-c2ff-4fdf-b880-c614f53e72ba", "value": 261632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637247136, "uuid": "a400e56b-5b33-47a1-91b8-9179175309b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247136, "uuid": "5140cb84-4c23-4dcb-bace-3a15d9faa517", "value": "4c72e48b856d03386fe5d7f0af228f34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9c3601-48a9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637265382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265382, "uuid": "93b2f757-62dd-495a-9799-96abb934d3a6", "comment": "Malware payload", "value": "5a68da6b106ec8490e7b7071480fdf8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265382, "uuid": "ec9464e8-c741-4984-a922-07fe8408f508", "comment": "Malware payload", "value": "36bd5c9ee48bc187184cf4cc9958a54ed65d04bc4a3cab022de3ede4277c97af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265382, "uuid": "574ed3e0-8dc1-4b66-ae1d-0178c9e315aa", "comment": "Malware payload", "value": "2d2dc484c488158b94f7caf13955557321f68b2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265382, "uuid": "b9a852c1-0ada-41b3-b28d-8beb4ab378a2", "comment": "Malware payload", "value": "2e0e0ce0ea04e31ada7a8e2af44bb06c55a4993ba38f6529f78c6ab90c540b08d7d87c4273f61c8e5ead641f1162064e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265382, "uuid": "dde14775-0882-4eee-ba51-7ea574313880", "value": "T10E84E6553C1A9254DC6E73F5C42FE0FF53CB2E339462B81CA2E03A554B31A10EA5E79A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265382, "uuid": "55ba276b-2ce0-47fa-bb84-192f54c105b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265382, "uuid": "c89a1f7f-8e08-490d-a1e3-18efefcba68e", "value": "6144:sbBj18jeeeeVeeeeeegeeKV8j3zJIahUsWoq0s1QEk3FNPzk+:NeeeeVeeeeeegeeKVe3zJ5hUhMbPzL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637265382, "uuid": "b4e53dc9-6a59-4385-9e11-eefd8a983ad1", "value": 373760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637265382, "uuid": "f3af18fc-b3ed-4d85-8e87-164066122b50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265382, "uuid": "0a16900f-2d6d-4956-b65b-35c146b92049", "value": "5a68da6b106ec8490e7b7071480fdf8d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829433b4-4866-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1637236565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637236565, "uuid": "c91fae6d-dca1-42cf-b32b-ecaeedd7c415", "comment": "Malware payload (AveMariaRAT)", "value": "a3d1c8702fa951601c31d8944e795863", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637236565, "uuid": "62d4372d-fc18-4b1a-a4ff-51cc4d6bc535", "comment": "Malware payload (AveMariaRAT)", "value": "37a556c2bebb6a81a89ce582e688ab3ef69e82aead7e46d0763971a416194a53", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637236565, "uuid": "70b8d66e-58f3-425b-b5d4-901791f00eee", "comment": "Malware payload (AveMariaRAT)", "value": "d436198623e2cac7bba4ac641bbb6c09701075e4", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637236565, "uuid": "b464a69a-4e8c-4e8d-874c-d97a86bda30e", "comment": "Malware payload (AveMariaRAT)", "value": "a43b909837577039785479226e0ca9c88272bf4cdc50240cd8994f05b23dbaa74567030ef8930e74219864bfc5ca5b4f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637236565, "uuid": "b612ff29-40fa-4b41-8496-05055fc66b0a", "value": "T1B8C4CFA036B8D813E7708575C9B0D3BA8AB0B26D1DD5C6427CEE2A9F761D770BC58312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637236565, "uuid": "5080224d-f5a7-4775-898d-dda50ee14dca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637236565, "uuid": "2b4802a2-28e2-4ed2-8332-480e513b6d3f", "value": "12288:ORc/v4m31gW7/DS+VaDBUAgT9BsD5r1Y7:/34m3KWTO+EFbg4D5rw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637236565, "uuid": "4132daee-4fce-426a-a9e8-90286141510c", "value": 545792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637236565, "uuid": "9e20d849-f797-4277-9f82-24e6dbaabf9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637236565, "uuid": "0003f354-c340-43cc-bc0c-204b37d27390", "value": "Bank_Draft_Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07a6da2-485d-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637232884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232884, "uuid": "c15a94b1-bbbc-4a86-ae35-2e69acdd5fa1", "comment": "Malware payload (Loki)", "value": "8e7f8e88aec31a4a7ceee224e539f1a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232884, "uuid": "9cd44a5b-6b99-44e7-a7e1-988f03d7019a", "comment": "Malware payload (Loki)", "value": "3802d1b1db3b7f301142d8d4cf0d4a0e3873dc1a1e7efe931c0486b3c4207293", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232884, "uuid": "7164f7b5-4c30-4f68-9b04-a1d841ab990e", "comment": "Malware payload (Loki)", "value": "177a497c2879e9a7b8e4d463baa14544c3162066", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232884, "uuid": "24d55d5a-8a86-4dba-b181-b2a1639a69c0", "comment": "Malware payload (Loki)", "value": "36b6df753a666cf099aa144bf59a3fbc4512da36a306a56f3e1d17d5833e59efb2626a7089034b62ac0d3854d48da2a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232884, "uuid": "7c61b982-2c88-4857-b4e7-75de54c38823", "value": "T10AF4F11137B55F13C5FE87F49625D14007F6766962ABEB0E2CC3B1DB3D62B928A42A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232884, "uuid": "c04d7e2c-d80a-46b3-bee8-994decd62f73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232884, "uuid": "749c64a2-6582-44ef-9a8c-683810c798f3", "value": "12288:JCPodhCcfZ/2Yp44S2gZRR325SiOKU3m3Prgs/zG9+aw9cNq0p2W:ck/2Yp44G39Kx3TVZqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637232884, "uuid": "41fd1f83-b71a-4f6e-a5a7-cfd1031deaf2", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637232884, "uuid": "d22f9ef9-b238-4e81-abbb-57e4a2057801", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232884, "uuid": "dcd661c9-e061-4a8a-b587-5e94783214e5", "value": "8e7f8e88aec31a4a7ceee224e539f1a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53aefbb-48ca-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637279573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279573, "uuid": "77c3f72c-4bf8-4c46-b6a4-e172c72ff214", "comment": "Malware payload", "value": "adc744136c4fc15ac2cb996ac47a3353", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279573, "uuid": "5c5732ce-ce97-41a3-bff5-fb52227e004f", "comment": "Malware payload", "value": "383ed10d57154f953b64055a45ddeb55248b03d599b459a40b5f2d74439c5bde", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279573, "uuid": "d16b3b9b-ffc4-40b5-9ced-fa2cadf5cf6c", "comment": "Malware payload", "value": "0d710fc189e60c81dd4d034ecddcbf67cc540142", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279573, "uuid": "915b81a4-c0fc-431e-be0c-bbac0856119a", "comment": "Malware payload", "value": "86a50dbb1569285a13dc53ba36cc43984da28296cae8ba34858ae50a74ae85a77abfab51f52ce72f065c3959c54b9652", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279573, "uuid": "bc5703bc-a051-4906-a6ce-4521131aad4e", "value": "T13EA4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279573, "uuid": "2a726f38-2965-4185-8138-d00d456abe9f", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279573, "uuid": "95198e53-ec7d-4ad4-9e75-86aabe962129", "value": "12288:bdv8jkvzqZvv2wLBfmTi12yD88kYwZ1h1:b2Zvv2cOTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637279573, "uuid": "da216ade-d7a8-41d6-ae9f-a5b12d372586", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637279573, "uuid": "8810a256-b110-4237-bd77-8e87bdc84762", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279573, "uuid": "0fd5193c-ddf3-48ca-8600-fae240cfe582", "value": "adc744136c4fc15ac2cb996ac47a3353", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f2e784-48c2-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637276192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637276192, "uuid": "3f62c219-3177-487b-adf4-100c021bf0a6", "comment": "Malware payload (Loki)", "value": "470711a8c1e49ad4e6202e21ebce34a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637276192, "uuid": "41c8f7c9-a4d2-42a0-b06c-9bff484aa954", "comment": "Malware payload (Loki)", "value": "38566f9a331bb8503835d7abfdc027d9d3fa45c65f388d7fd84b2c97f297ba85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637276192, "uuid": "408c18ca-79a1-487a-a8be-7868ee04ecf0", "comment": "Malware payload (Loki)", "value": "f74ffca223feb25c1bda6229c245d7aa31234cfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637276192, "uuid": "5d5479e0-9977-4906-b2dd-681665c69fc9", "comment": "Malware payload (Loki)", "value": "d684a6a6e906b7a139ac1b226b9b395027715e5afe93fae09e6b71ca2a3cb1cdd71ed60793586b0dcc63eb8ade3980a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637276192, "uuid": "35154af2-a539-40e5-9acd-cff747ddeae8", "value": "T1A2A49E027350F033C23A04711B89A39366BD7E310B25897BB7D97A1967B56D1AE3236F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637276192, "uuid": "5d47e381-2aeb-49aa-b5d4-0d1ad1d8621a", "value": "1b444fe65947029a0ab286441263bb0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637276192, "uuid": "2aad7ca5-f185-4c5e-a116-8ca5a1594692", "value": "6144:5YFmEvMGFpB5fzKL87p7yC5KCpQSZc/t6KiuOVRDyXteftTOj:5YQyFpB5fzKL8dL5G+J0XYTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637276192, "uuid": "94374c66-14a6-4941-863b-88c9c834bdcb", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637276192, "uuid": "ab28f158-b875-4594-a226-9cc758eb9b4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637276192, "uuid": "051625a8-b3e6-4dcd-8eb9-7c7879cbc906", "value": "38566F9A331BB8503835D7ABFDC027D9D3FA45C65F388.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25cff8b8-4870-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637240704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240704, "uuid": "3cd94ff8-0775-4b72-8f41-660f32524810", "comment": "Malware payload", "value": "ff3ec8845fbf8dfbec4ec4fae0d454de", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240704, "uuid": "f904d9d8-12a4-4673-8e9f-86e66b2575e5", "comment": "Malware payload", "value": "38b32b4b81d7a85de57efe5fbaff4dba63771277241d5ee645d3b841ea2b3526", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240704, "uuid": "d4f80537-0790-47aa-b3c1-682ae719fc6c", "comment": "Malware payload", "value": "3f994200e88e959d56bc716c1cccc5670f43a3db", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240704, "uuid": "6534ef95-4e9e-469b-b31c-8945ee3e6e81", "comment": "Malware payload", "value": "e93e70edc612245c3cb47f0b8b9dad5e71ecd5edb9d79e58dc8839eca603751e4800b61d9cbf4442a5a3cb7194f8403c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240704, "uuid": "733d9c4c-9d28-4d51-a395-40213062f625", "value": "T1AFA34B11B2A1C030D1BF16B9066985106B3A7D32DB695FDF6F982D4D4BB81C0BE35BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240704, "uuid": "970162a4-6d97-4564-9c35-40efb2afb1c1", "value": "ca2d7a56ab9b099fba0237ea2d0c374c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240704, "uuid": "2f655d02-fc14-4e19-9fb5-acb8ceaae418", "value": "1536:FqjKzHsu0bpy1tOf/Et/8MnzVPuRSqZnAMSNW4HphMy7q5nsWjcd5Ew8yxf:YDVgjt/NzFqACy0I/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637240704, "uuid": "97eeca16-2c7d-4c1f-9f9c-191e319847a2", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637240704, "uuid": "8d0b8142-f886-4940-b71c-8b4f8aec601a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240704, "uuid": "8d84ee54-9073-48d3-8c43-ffa8254f3d9d", "value": "SecuriteInfo.com.Trojan.GenericKDZ.80240.1853.17030", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23bb2f6d-484f-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1637226528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226528, "uuid": "11b17a74-0e2a-42df-8a71-207582e26cdb", "comment": "Malware payload (AsyncRAT)", "value": "e5d2ae2d1e8670551f5ada45aec78819", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226528, "uuid": "504ee017-82e4-4ce0-9b8b-a1a10a9bf557", "comment": "Malware payload (AsyncRAT)", "value": "395ef8e861d364f35902f6f89fa77684dd860cead76740802bb9053e7e5e6e14", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226528, "uuid": "11fa969a-7a40-4987-93f0-75865c543754", "comment": "Malware payload (AsyncRAT)", "value": "4e9cd23471c3bdbdeba52777f703643d5dd4fd9d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226528, "uuid": "2e9691f4-152c-4193-bf11-965efb5100eb", "comment": "Malware payload (AsyncRAT)", "value": "28fed009e354d1ddc945f843186b7df33fbc1b4a73d2144d81b1718741f0b7c19e1225c5295d5443ccb10953cbc39e35", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226528, "uuid": "9aa21069-a5d0-4974-925b-fd1a746579ee", "value": "T10101D08894EEF7778756327A08DBB841B43852430FA39AB4352DD251C56B47485E9981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226528, "uuid": "9d89bf97-228b-4a7f-976d-df1336d2788f", "value": "24:+tMFg1gbXLnucF2EUMgqjZK7UuCSZc3M0hiMghmict:+WSarTwEUM1SZcgM6mZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226528, "uuid": "ca16fbfe-a850-4381-97e5-2b96761c4a58", "value": 815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226528, "uuid": "b41a0618-0fd5-428d-b352-4f53170e386b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226528, "uuid": "a4c87f4e-e448-49c9-abc0-6882e017e907", "value": "BKHDGAM73508.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c838eb92-48a5-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1637263740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263740, "uuid": "9bfafed3-6201-4258-bb6d-2435f7d3bc01", "comment": "Malware payload (Metamorfo)", "value": "3523d8f8c28da179034d37934ef68e2e", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263740, "uuid": "fb85a84d-6a22-41b4-9efd-4c9d637941ee", "comment": "Malware payload (Metamorfo)", "value": "39973d2b57ad4a212ed116c55053a6e47b49a47a68e9da195c9164fe2ccedc46", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263740, "uuid": "14250da1-3d50-44fd-91c4-583336c94380", "comment": "Malware payload (Metamorfo)", "value": "bdf95314a74a566b706f5691c8a7cb4f6459f009", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263740, "uuid": "1ce18e90-611f-479b-bd91-a796dec0019e", "comment": "Malware payload (Metamorfo)", "value": "1eadab5ea53df988eeae2541127a7c5ab151a501877c3a6f57ad603675bb0fcdd8cb4edf56b186c66cc6820328ac8e39", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263740, "uuid": "da2b3af7-cfd4-439e-b258-10dd993c6c90", "value": "T130411A126BFD0359F3F2AA35E07F55BB0D7778A2E9724B4D4040498628626019D68F9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263740, "uuid": "fe841717-f9c7-4070-a36f-4746d72db998", "value": "24:8+JUHRlVo5kcbA+PzcffffffffffffffffZ+/P+cHp41cV3ZUXQaR3+habMq1UHX:8+uH+M+LvLH21cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637263740, "uuid": "69e4c003-b7c2-4339-ba11-a12ad9f93537", "value": 2038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637263740, "uuid": "464f4598-0e48-44f5-a591-1ad47d9af157", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263740, "uuid": "b12cac0a-c6be-4b51-97ac-d2da399f7187", "value": "18 de Novembro.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b294e87-4802-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637193630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193630, "uuid": "708a15f9-61fa-488d-80ea-6a538d603afe", "comment": "Malware payload (Dridex)", "value": "65389378f7f042448abf25df58d2206e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193630, "uuid": "e4b131ca-39be-4556-b163-9c6c5136ef49", "comment": "Malware payload (Dridex)", "value": "39b7a98df99d10c45344b5380e9521a8450630800b66164fe376f384c32d1375", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193630, "uuid": "6a73d792-a0f8-46aa-b33f-9fe5987121ec", "comment": "Malware payload (Dridex)", "value": "7b7603dc76e84b9aa5bd0d4ad96326c64993db05", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193630, "uuid": "2cc817e9-56ad-44c1-9416-1f8ff541901f", "comment": "Malware payload (Dridex)", "value": "791360164420bd8787634b5e7ab20f4afe85e58c6fa348fec64c48511522c75c5046199f3ff3c5aa17bddd93f715b5ab", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193630, "uuid": "fbc67210-b5a4-462e-9329-9fde9b4313fc", "value": "T110E49E067CF9989CD511ABBD421E86FB8BB089B784D0CAC1C1199F3A5C07BDBE54C62C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193630, "uuid": "2696c32c-f27f-40e2-83e9-27b7401d613a", "value": "43b460ede91c0828a2b4acde6b98d16d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193630, "uuid": "bdd481a4-b4b1-44e8-b325-feb7606dbaa4", "value": "12288:o9we+YtfLwxfZYnfh0xnf2xfH6xfpaEdk9qcK05GDdiO2cGoOUwg20:o9we+YtfufkfonsfYfpuN5GxiO2cGoO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193630, "uuid": "438e7334-22fa-4ebc-82c8-45d1f6fc42f6", "value": 668520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193630, "uuid": "746eb205-9eef-42d2-8d86-080c123c2109", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193630, "uuid": "b2678364-3760-4dd4-8367-ba4212822c11", "value": "SecuriteInfo.com.Trojan.Dridex.777.23771.23228", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80c76f3-48b6-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637271041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637271041, "uuid": "fa7d759a-f048-4abd-a11b-8b18a25596a7", "comment": "Malware payload (Heodo)", "value": "03a4ee3fdb6523d77e7e32535e314ba3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637271041, "uuid": "a4bdab3d-2e3e-4a57-9934-c8130b521ee6", "comment": "Malware payload (Heodo)", "value": "3a5ffcc090403892f0cc077505cf81b225b33063b309aa5c7c2e991caf8571ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637271041, "uuid": "19c105aa-dde3-4afe-9cd4-3793c797ddce", "comment": "Malware payload (Heodo)", "value": "fb59da771d751134c47464b80abd69c817d11596", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637271041, "uuid": "a2cbf444-814e-4004-9518-7c7d033df78a", "comment": "Malware payload (Heodo)", "value": "468ce129e07f7512ebf52e2f074ba0f085ac446231f3017b334604fd67565e87f6193bfc8770f60ee80f9cb9d45bef81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637271041, "uuid": "83319bd2-14e7-44ca-8376-236d46b5bdfa", "value": "T17EA4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637271041, "uuid": "464c5b2a-4bfc-4e19-985c-5b99d7237173", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637271041, "uuid": "cf53f300-19e5-4c35-88bb-6ce9e4c4f6cf", "value": "12288:bdv8jkvzqZvv2wLBTmTi12yD88kYwZ1h1:b2Zvv2caTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637271041, "uuid": "de10fe15-447a-4286-b60d-4a8850d1f040", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637271041, "uuid": "6e951d1e-689a-4170-89fd-f1fc235f1a3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637271041, "uuid": "a22e4aa5-47bb-4cff-8181-8fff0265a4be", "value": "03a4ee3fdb6523d77e7e32535e314ba3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5745a0c3-4852-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637227903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227903, "uuid": "34273b16-0ec5-480f-9f39-8d6c193f22d1", "comment": "Malware payload", "value": "08ccc0a5851a5f2ff6032173fe9627b1", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227903, "uuid": "6b5aac71-1f69-429e-9b5f-d2446d39dbd5", "comment": "Malware payload", "value": "3ad6c74adeb3461e006f9eea820804cd7006664bc3472db0981381aab525d10e", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227903, "uuid": "b363d017-c88d-4795-ace9-35c1da2fdddc", "comment": "Malware payload", "value": "1beead8a9b2477e32d665029bbf0e92d3482ae32", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227903, "uuid": "71f29144-8c7b-4d91-b7ef-faa651807e81", "comment": "Malware payload", "value": "fcdd9fa5147061240e7e07626821ffc7d585c9e3ea9ac23482a850857663fc4d9884f71a52438ba186b11ac474fe9bf0", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227903, "uuid": "d79a40b6-c23a-4bf0-b36f-2ee6b17c1759", "value": "T15634122B8C415BB0D65CAB38B9470EAC3B0B8A4DA6C9728F05B54D5DB7CC16718CA37D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227903, "uuid": "2bd51e2f-653b-490a-99a5-9953be4cf660", "value": "6144:IHeX4Uk2GCZZzFEp2G/cjv5ZHME5RMl9RC:IHg4UPGaQ2G/cTB5mRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637227903, "uuid": "a1bd99c0-57bf-4db0-844e-0c099fc53f31", "value": 240708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637227903, "uuid": "61781596-d5d3-4628-8fd6-472887438dba", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227903, "uuid": "31a5b315-574e-4512-936b-324e191d948c", "value": "CLMCP 9462 Nov 15 (467).xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9db54a3-480f-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637199265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637199265, "uuid": "93c77671-beb2-4f9f-84ae-993432b4a9c5", "comment": "Malware payload (Heodo)", "value": "d99833549b044be46de655829ba23525", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637199265, "uuid": "b1472c2f-2724-42d2-8947-6a5a8e72cc43", "comment": "Malware payload (Heodo)", "value": "3b0180b4dd0f30d55d5ee0b79ffc251a0d1f043365cbaff6eeb9700e75164fbc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637199265, "uuid": "585a11b1-6802-4e47-a29d-e4fd485b5a41", "comment": "Malware payload (Heodo)", "value": "de2378d00166860165baccfec7486ae35ccbda1a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637199265, "uuid": "356aa1b7-417c-4d67-b329-898f6ad0cb76", "comment": "Malware payload (Heodo)", "value": "dd68869e4bd35182c18d3dff6df32159f9f02e548b1ac29a3de19800c2e4d8e16f879d1136ad62c1448b5e93e7f3d5cc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637199265, "uuid": "86b474af-f6b4-41c4-bf7f-7b5364716664", "value": "T1DC44CF01B280A072D9FF193A85F5C66A4A6C7A500F90D9CF53D80DBE5B765C2B6309EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637199265, "uuid": "90d14d16-dd36-4c86-8c48-ec1261b81053", "value": "822ae775303d14fd9c529b33f0deaf77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637199265, "uuid": "8e24913a-53c9-4ec0-8601-a587f9c382d4", "value": "6144:ndH09uYgR7OJSuwuZc2HEaYTy7beWTBdXm:dHJtlec2HEaYTXWT/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637199265, "uuid": "5749c50f-9620-47b7-a146-9070e44b49d7", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637199265, "uuid": "375ffbff-60ad-4094-aff4-740a6d8b8830", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637199265, "uuid": "0160e779-2e3e-4fae-8692-b615ab959c81", "value": "vblDG2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df83238-48a4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637263240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263240, "uuid": "6e8fceee-1e41-4d02-baff-8d1d0cee0a8e", "comment": "Malware payload (AgentTesla)", "value": "a274678f71d9aa863576d1b2c5b0d352", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263240, "uuid": "af8f70cc-3b27-4dff-b6d8-bff3b458a8a6", "comment": "Malware payload (AgentTesla)", "value": "3c47bf1c054a93080e17846c3b1d2bfb98cc7c6dcb548ae35530b3c3c03aaecf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263240, "uuid": "25c1d264-e855-41ce-80b5-54cd4a120471", "comment": "Malware payload (AgentTesla)", "value": "40663d3fda979aa38c4716963052febc9d3166c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263240, "uuid": "ca9d0a2e-14ca-4b55-9fbb-823a412f3372", "comment": "Malware payload (AgentTesla)", "value": "4b833fc1a05bc864c4f88165319e8ce8abcfe97c15888bde666ddfd09921093a1fe90d973d913a28779b7256488667ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263240, "uuid": "5433dc09-abc6-461b-b8d3-9e16e5ac63fe", "value": "T15FF17E05DA97F2C8CB4C2D33D1224969F7A0C9DDADEF5B0FA808500449D23A27F2E365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263240, "uuid": "2ff89af4-382f-4815-9337-971898660c80", "value": "192:HCPIeIZyy4cqijNafhH7JFoWk3GjSywlS+p0n:HCPdI0fcqiJafhtOWQG6lPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637263240, "uuid": "c7080eb2-9bb9-42f2-8f79-f4a13e3ed11b", "value": 8116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637263240, "uuid": "2b2cd87b-8675-45bf-b81e-0e17664a57de", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263240, "uuid": "5ebc72b5-5566-457f-8abe-26ba86acb040", "value": "original shipping documents.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae76501a-48bd-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637274005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637274005, "uuid": "809f603d-8a2a-4ef4-baf2-5a9590ca86d3", "comment": "Malware payload", "value": "399f15724c1717b850d63118868ce4a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637274005, "uuid": "0b18d96f-21b2-43a4-aaa6-c93c2abc7da2", "comment": "Malware payload", "value": "3c9eae80d9fe591f6646acd2b497b8b879a14be6d48180b366dfe1c5c4720d51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637274005, "uuid": "dd929d89-3deb-4e83-8147-a1c09e62fdff", "comment": "Malware payload", "value": "7a4687605de543d9a60eedc12fba05aa305c1597", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637274005, "uuid": "d54e4847-f13b-402f-a4d7-af8080f46d4d", "comment": "Malware payload", "value": "7e373e3b8d6f45599a19b44a39c9bd39f1809431202aa6b33ed9d77f05c73f389818ad8332fefa5b1ab1696d6d3c3fbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637274005, "uuid": "f60cdb0a-bb8f-453d-b434-454fe0d8611f", "value": "T1C4A4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637274005, "uuid": "7ce4a7ad-83b0-471b-aca5-b52fee136d07", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637274005, "uuid": "6b4099cf-0c4b-46d5-9172-cf1e24995aad", "value": "12288:bdv8jkvzqZvv2wLBymTi12yD88kYwZ1h1:b2Zvv2c1Ti1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637274005, "uuid": "7a79c518-cd81-4b10-9fe0-fc8278c08fe0", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637274005, "uuid": "2c44098d-baee-41a8-a164-952a99865666", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637274005, "uuid": "009928a9-f3dd-4445-8009-60272f6c7e59", "value": "399f15724c1717b850d63118868ce4a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f255a42c-4805-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637195091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637195091, "uuid": "53ac9482-89ba-44a4-b891-c08b6104583c", "comment": "Malware payload", "value": "325f8c0fcc87998e2bda7f8e8ab2e843", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637195091, "uuid": "f5dd6b3f-5741-4f72-b7b1-3e5d776dd975", "comment": "Malware payload", "value": "3d0ca4604a0effdd7d12700991d223fc96ea02b49531fcea2e4e4d3db521e9b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637195091, "uuid": "5c169627-5b51-48dd-b95d-9d963db2619d", "comment": "Malware payload", "value": "c270872ab49c78b3f71b832a89f14de81977d8ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637195091, "uuid": "2bb46773-8e62-4ac9-98e6-7dcfd0810651", "comment": "Malware payload", "value": "b74ee6d81c9fcf703028198b9bf36ecaafb3f84252bf4c537eb4400942e61f0d622a487e7866ff41fedccd099ccf242e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637195091, "uuid": "9d185b6d-ced2-42fe-bde7-77a5a9c01989", "value": "T1B766330867900CFCF5B30034A5908821D27ABC324744DD9B5AA8A6775FA7FD5BE7BE84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637195091, "uuid": "585320cf-930a-4ad6-a885-a823d4c93a13", "value": "51a5e6ba413b3d4c2f9ffde72d1f2a95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637195091, "uuid": "adb3f573-98e7-4291-ade0-2767aee16703", "value": "196608:Rkgx7QICteEroXxWVfEqlbkkwR7VTEJZFH3X7rJ1s:ZQInEroXgfEqirRRoJZR3X79O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637195091, "uuid": "f785dc9f-7f6d-4423-8784-a802452fcceb", "value": 6961468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637195091, "uuid": "4b97e3a4-48be-4237-842c-bcf62bcd81d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637195091, "uuid": "658c2fb1-e768-4ea0-9cff-a36e169b2c80", "value": "Pencil_of_Death.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1aa6a0-48ca-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637279563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279563, "uuid": "1f17d82b-1d30-42a5-910f-32e503406180", "comment": "Malware payload", "value": "fee9ba8d79bcbc58800fda0cafbe5f64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279563, "uuid": "418ae34e-de63-4a9e-a91c-975532d78732", "comment": "Malware payload", "value": "3e8acc4d85b6ffc06b18b97a33a43628e8c11bc4dde8648bcc8a2ad9b1154150", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279563, "uuid": "2070a60b-96ee-46f1-aa44-45ebcf8306a1", "comment": "Malware payload", "value": "82eb29987e6ed568a5ae01816de7240df1490c0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279563, "uuid": "f156b971-51ce-43f2-a9bc-83a301da5528", "comment": "Malware payload", "value": "415c4ecdc02a9c4d451467c097978f01bfa548a505f6728b97c76c782887a8b4962f9ba63553a2a0d58aa273b7981e2e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279563, "uuid": "eb6f8ce5-79f9-45d0-8984-275daa59f272", "value": "T151A4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279563, "uuid": "1e40a19e-fe19-4fe4-ad73-dbdd3ac1101b", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279563, "uuid": "dfcd87ee-e59c-4cdb-aa40-1f71c8b0bae1", "value": "12288:bdv8jkvzqZvv2wLBVmTi12yD88kYwZ1h1:b2Zvv2ccTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637279563, "uuid": "537750eb-0f8e-477b-ae0b-7506726816aa", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637279563, "uuid": "f961ed71-37ee-4818-8be7-7211676f7fff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279563, "uuid": "a20a26df-b39f-4d80-b1ec-6781f2c730f1", "value": "fee9ba8d79bcbc58800fda0cafbe5f64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e41af3-4893-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637255948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637255948, "uuid": "8767c1de-af4c-45f2-8113-547e86babc0d", "comment": "Malware payload (RedLineStealer)", "value": "9efe8e4ded001b65e90aceb1644ce1d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637255948, "uuid": "3ee737f4-503d-4ee7-bb40-1e146e11aca9", "comment": "Malware payload (RedLineStealer)", "value": "3ed3b03c36265ddffd8382859b7545cec6955331f85907018adc4bacde22e70e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637255948, "uuid": "7705db57-f071-460a-bb96-f235f3fef579", "comment": "Malware payload (RedLineStealer)", "value": "6b32870883a8a1710816377606780394854dfd2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637255948, "uuid": "b5f25c66-4bdb-43cf-a98e-7397d816009c", "comment": "Malware payload (RedLineStealer)", "value": "226e4892a8fbcaf1274df7054bb0f35fa70fa8f459de09810d7bae4e8651f0b356a92127c667c1ae148983baecf5a68e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637255948, "uuid": "075c0acb-eb8f-4ceb-aab5-f3ac44b0c528", "value": "T1F62633D2B8426137F82D53385F812594E03C5EDE6E125683BB2AA3D1C8065E7A6F13F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637255948, "uuid": "0c8ed598-d1bf-442e-9331-94d076918295", "value": "e48cc266501c282987b27f2c1f654e2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637255948, "uuid": "070027a7-12ef-4ff9-a254-83936b0c77bb", "value": "98304:rwQYC7xOpUYPEV8KQJawEvGK7BenjDsHNdQ+sHEyGT:rMC7xOJPqB/9GK7BejD+A2yS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637255948, "uuid": "fc85e865-c5d2-4e80-a4c0-3f4651e4cfcd", "value": 4429312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637255948, "uuid": "4c461a39-ac74-4379-8e2d-682bdeef9868", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637255948, "uuid": "09708630-c34d-4597-b548-683baaafd992", "value": "9efe8e4ded001b65e90aceb1644ce1d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50630309-484e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637226173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226173, "uuid": "9e7c98f2-6165-4e64-a9ff-9cbbb714e92c", "comment": "Malware payload (Formbook)", "value": "0f04c5237cc3057e1265707041a00500", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226173, "uuid": "7289b96a-856a-4666-a7fb-3c4c034f0a86", "comment": "Malware payload (Formbook)", "value": "3f26bd0ead469e8d36f291dded13a28df45cccbcd8971d81d1e1a88236ddc46c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226173, "uuid": "81083dc7-395b-4725-b810-f96fc7d749b9", "comment": "Malware payload (Formbook)", "value": "e33dd4a39d6aefb6f442358c129c2313ee5a0f90", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226173, "uuid": "afce521e-0b58-41a7-89ed-1a0103b10adf", "comment": "Malware payload (Formbook)", "value": "4bb3e250e660963ba58d873b6456c5a504db5e6cba2b93b4b131b2e305bd4f8e5b42d83a3ac664cead58518becc39d0e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226173, "uuid": "882e3d1c-e18d-482e-8e84-c9f4445e3772", "value": "T11314029339F76467E5B62AB779C2B10A349DED24159BA13A13203D3E40F39B14C81B2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226173, "uuid": "1516a634-88f0-4dd3-b4ac-298f9092e966", "value": "6144:7RhVys8hDSFQap1QkJhM68WajFXK8RGc+:NhZPlp1QkJhM68WAFXd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226173, "uuid": "96244cfb-6c6a-408e-b505-3221bb6260ed", "value": 206664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226173, "uuid": "73e8e85e-9974-4ce5-88e9-8cbccbabd682", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226173, "uuid": "3702faf9-5e25-4a5d-8bd1-4e129277a9c6", "value": "ORDER 5200098370.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca86963f-4843-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637221653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221653, "uuid": "2315d243-d9f9-4e91-8dda-cbaa61d3cf6c", "comment": "Malware payload", "value": "e9648aedb4401efeb444a8e71d872c8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221653, "uuid": "ecba5ef2-a9c5-48ff-9901-690370cdec28", "comment": "Malware payload", "value": "3f5829014dc92a96d6a986142a16b5b255d1a27bcecb2441acc4ba1964c2e3b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221653, "uuid": "1eaa2179-bad3-415a-af93-d6ceeb95054a", "comment": "Malware payload", "value": "88088be5a2bec74fca36b3bfd9f3e78a2446e851", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221653, "uuid": "b226ff44-51f2-4f05-9dba-2a2017a0fe7d", "comment": "Malware payload", "value": "6e082a6b4f73105df60b7dd674d7a0c2e46ff8cee6cc2fa61d0ddfe42c642790bd4619356f47f741cff787c9a3ae0745", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221653, "uuid": "3f0b7c42-ce53-43c7-b212-8077888a3217", "value": "T1C416335059C013CAF694DD1E17DC3A35123FEECF68B8AEE3955283F1040EE89DA72696", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221653, "uuid": "b75fd2c7-6b2b-4e0d-b288-e72ce5adb5a0", "value": "98304:G1wwAjzIQOMK2GNKslgus10Y1/UJ7BdlRbTBAlYVk:G1wwAYBr21uQsJ7vTBAlYVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637221653, "uuid": "30281a39-93e9-46e0-9bd3-fc1bfa413aa6", "value": 4034560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637221653, "uuid": "774466b4-4e2d-4776-a9e7-29f3453d03f0", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221653, "uuid": "2a0a04bd-2fc2-49e2-a94d-10298fbbac48", "value": "3f5829014dc92a96d6a986142a16b5b255d1a27bcecb2441acc4ba1964c2e3b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8387e4f8-487f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637247304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247304, "uuid": "f894607b-673a-47f2-bb0c-16d4305bc0ea", "comment": "Malware payload (AgentTesla)", "value": "894bb10082c14f509eed3decec7b4dc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247304, "uuid": "394bae2e-c0bd-4815-9517-c7a347306dc0", "comment": "Malware payload (AgentTesla)", "value": "3fdca0627f4144ca4c5cae51240bdf72b809e26657cb8e21559f2fc7f1136894", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247304, "uuid": "aca75c4e-0907-4ce7-9a2e-315b6ea62826", "comment": "Malware payload (AgentTesla)", "value": "8db08e56e72520461227531d38f504837e28d5f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247304, "uuid": "e1c2a3fc-5833-4519-94cd-0139bbebb276", "comment": "Malware payload (AgentTesla)", "value": "4610e09f581e85fc63676916e012cb0c49890a89fe170e238f7da449911be74aef77fb8e7f57cec5ef4b78540f10568c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247304, "uuid": "b5f8209b-fd0d-4081-bae6-ed32ba22f525", "value": "T14A94E015BAEC4717D4AE2BF99FA585080372FD791237E30E1D91B0C729B6B424A01BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247304, "uuid": "a8433970-5446-4005-8d19-abedcbf3230c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247304, "uuid": "0e1d61c5-e2da-4ffe-8ab0-40923bfc55a7", "value": "6144:ZrqUSwtTkCSKcm2OVm5zqwB/NCmapZYEYvpt9c/VwVJF5jHX7ZKUC2zy1:pqbwyGm5d1w6Jc/VwPb770jcy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637247304, "uuid": "4070cb70-12ff-42b2-8823-ec3a137ed8cb", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637247304, "uuid": "5c8a8e26-d3ad-4f01-947f-91f8cefd113e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247304, "uuid": "4dc82fd2-9168-4344-9cc1-d57fea648c0c", "value": "Habasit Orden Urgente 7865-NOV ,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68efdd38-488b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637252413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637252413, "uuid": "8497c29f-36ce-42cc-b680-5a4b2174a3f9", "comment": "Malware payload (AgentTesla)", "value": "cace26e58f2c2bc3da8d50b5c76dc9bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637252413, "uuid": "ba797429-fbab-4254-b1b4-acf33f3ca556", "comment": "Malware payload (AgentTesla)", "value": "4053206d66d627d145d9da8d8e208d08c85755036a5393ccc6e8afd6117df864", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637252413, "uuid": "67476dad-92d9-419f-a1a9-6b6106f1372e", "comment": "Malware payload (AgentTesla)", "value": "2266d0c452c616b8b89bf7e486f71b50200c38ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637252413, "uuid": "bfc8a088-cb4a-4794-b822-0dc53352908d", "comment": "Malware payload (AgentTesla)", "value": "3ac8d8763456e829b431ca303e31ed7206b4156961beb39a6df23521c14dccdac06e6cbd9a34af43de82bb41b7d36b05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637252413, "uuid": "6d970b98-443a-4a30-aeb1-a73764dc1197", "value": "T103E4E0A03AB8C413E37085BAD6B0D3BA4B70B16C1DD5C6427CEE6AEF76197647C58312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637252413, "uuid": "811b723c-53ea-44a7-bf06-1b13621ac672", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637252413, "uuid": "f1e65e7f-b6e8-4c5c-9ac5-d3cde7d07621", "value": "12288:qs1km31gW7dft+xmi5vMqO8lT4ydGaui8ppMRk:qs1km3KWOgSEq1B4xcEpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637252413, "uuid": "184bb1a6-7fcc-4b94-bda4-b69780c6d5ba", "value": 663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637252413, "uuid": "8ce3a799-5946-4070-8975-23fffade2317", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637252413, "uuid": "a7897ece-6435-4b96-87b0-c831ad1ea6cf", "value": "Tr Standart 2021-11-18T05-22-03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c08257-48ac-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637266738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266738, "uuid": "f7359b26-0794-4b2d-bbd9-5a123068edbf", "comment": "Malware payload (Loki)", "value": "ceeb6d36fc3d5bd7f1fe5dcc2af495c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266738, "uuid": "b8d3614b-3360-473f-8fcd-a9aeca38a747", "comment": "Malware payload (Loki)", "value": "407e2a13d5a5f6a216c6314c8075bc1bc7ff5f02c27b96274456732b1e7c1f74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266738, "uuid": "62963f4b-c07e-45e9-8a7f-97fc65fd0d77", "comment": "Malware payload (Loki)", "value": "b87c13f6f13946f6ec617884fc14cda9cb20a83c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266738, "uuid": "ce2415fd-f662-42e5-89a1-6ef834661628", "comment": "Malware payload (Loki)", "value": "929bd517b242f50445fc48925a56ac763e04f4c7bdb6f72662974e68571cb02c6200a246c9dc0c15965dd61990abb429", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266738, "uuid": "863e82b8-0a84-486f-8fd4-8212ed48f5f0", "value": "T18DC4E00437B89F42D33A4EB29933A04187726D766A21D6DB6ED12CDF253EF4402A2F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266738, "uuid": "4f5a5d02-7978-493e-b56c-0a4ab5851d2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266738, "uuid": "f8e24667-7153-4f3e-8f5a-55c0ca7ee947", "value": "12288:d853Y0pI3KwZJ/5ifFdjKTsswOg0Mf84zartD00d:OlmKuJ8djFOg0yWC0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637266738, "uuid": "b3a2d685-7c7f-456d-8708-4f414159179e", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637266738, "uuid": "5a92f225-7afb-49f3-aae0-bbfcec337605", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266738, "uuid": "405f4d9b-10ed-4232-97f1-5f17e3c901f1", "value": "ceeb6d36fc3d5bd7f1fe5dcc2af495c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e90ce7c-48a2-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637262221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262221, "uuid": "d9c59449-e5f1-44ec-b085-bebfc2863d56", "comment": "Malware payload (AgentTesla)", "value": "60e2b558b0b7849a2b31f85c42764296", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262221, "uuid": "5aa5cafc-a48f-421b-aafb-9d77dd9e2d9b", "comment": "Malware payload (AgentTesla)", "value": "415b10841ad39aa7259d3b74cda31cef730b35b14500a32cc92aa22b0f99f750", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262221, "uuid": "0b5b2de1-87db-4d66-8419-4c918da016b3", "comment": "Malware payload (AgentTesla)", "value": "1acf6be6fcae335b8762c74a5b1ebc2e8317868c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262221, "uuid": "c396586c-09ed-4dce-b361-9a5fc9c5ed8f", "comment": "Malware payload (AgentTesla)", "value": "9551a336ea782849b17dd740d83d4f625e10a063f9c6c8412f49ba416ba6921baf7a6da26790d49e7e001723cc8d3011", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262221, "uuid": "65b7786c-ca85-44d5-98a7-01c0a4debacc", "value": "T18834125A783B8859E133EB31A1B3DE964D71CC6199631BA1D712F34D083A8DB75C02AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262221, "uuid": "330f42d7-e011-4706-a7e5-8b0e4c62fcec", "value": "3072:PrnrGRFMC4cADY2VCSr4h1zDksR6jDkBTXpbU9KSlzi6W6Y+bZtOhNMdPu5mktU:PHvvcAskdU1Xk8skFZI9FPyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637262221, "uuid": "a7c34898-f748-4ae3-b107-016ec63a26d3", "value": 234136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637262221, "uuid": "63d21202-553d-485e-a8a7-e3a00cc0dc9e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262221, "uuid": "46c265d4-afea-45f9-b7e7-2ad06aae490f", "value": "PRESUPUESTO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29838ef0-4848-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637223531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637223531, "uuid": "8a5194f7-bbd3-4b3b-80eb-01c34898e6d5", "comment": "Malware payload (AgentTesla)", "value": "6db6795fc46d32fb0caeacd5917ae83d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637223531, "uuid": "7c62846d-390a-4916-a06d-ddf26efc9b4d", "comment": "Malware payload (AgentTesla)", "value": "41896cd4f5051a4440e681c9138e8a43f1dbb938b88c8b291cfff816b47d0456", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637223531, "uuid": "f5fde50b-6fab-49e4-ab9b-6bc9b5e25096", "comment": "Malware payload (AgentTesla)", "value": "8d75ca72cf49f47e84d84b1eea33ad89af60ad98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637223531, "uuid": "7d6e948a-4b9a-465a-9413-6f5f9a8fe16b", "comment": "Malware payload (AgentTesla)", "value": "ee55945892c524876e45baeea87d626be8e985d755e20ee33810cf25d02ff6b5cfa9d29d0442a107e2f5493e5671fabb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637223531, "uuid": "478d43ad-6197-486c-8978-8aa6c994e24c", "value": "T186E4DFD03AB8C413E760457ADAB0D3BA4BB0B02D1DD6CA427CDE2ADF76697617C58312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637223531, "uuid": "f089b2fc-37ef-4969-8408-301cce183769", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637223531, "uuid": "cc5572ee-6763-4dee-9296-816e702f5aa0", "value": "12288:5W9Nvm31gW7+7Bj0evXu4l28/Q+ww0F1Gap5aO7Ly92Fjm:+Nvm3KWitVfvo53M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637223531, "uuid": "43d2ae85-65a3-4e21-8813-26936b4b98b4", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637223531, "uuid": "442b270b-ceef-4872-a724-b666ed1632b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637223531, "uuid": "35f9ab1e-af8f-4632-9f98-2c3ef659e651", "value": "Bank payment swift message.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2488d2-489d-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637259992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259992, "uuid": "117cb76f-a643-466b-84b2-7c7fe4e03b0e", "comment": "Malware payload (SnakeKeylogger)", "value": "d7f95f681f00cf6fe5ddad92743a7a72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259992, "uuid": "36808105-becf-453a-a9a4-596f170aefa9", "comment": "Malware payload (SnakeKeylogger)", "value": "41fb137ed9fb554b9f328049e23fad85d9abed210322a43ac54cac609e83f0f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259992, "uuid": "e5af1603-d5af-4c82-8ec0-5405eaf94420", "comment": "Malware payload (SnakeKeylogger)", "value": "39c8a1d32fa00acd7e175a21608b94f28bec0c82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259992, "uuid": "182947ec-ceaf-44fa-9d57-230b1832b04a", "comment": "Malware payload (SnakeKeylogger)", "value": "cebe02209af67e6d61504809b20d6b548417051d0b7dd359f2d3a1ae5bc51f261af29c309980851b87874d066a6b6587", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259992, "uuid": "6d0afbfa-03c4-4967-ab32-673ada431699", "value": "T14FC4DFE03AB8C413E36085BAD5B0D2BA8E70B16D1CE5CA427CED2ADF765D7647C58312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259992, "uuid": "50a00f47-072d-4d21-a61a-b5b3aecd301f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259992, "uuid": "80fa8b5f-1386-42d3-9b82-66e92b4f1218", "value": "12288:Rt7wtm31gW78ky5SjwuyeOS0oCA94M6KPm1fOyomtn:Rmtm3KWwkMU/Lwa4ePm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637259992, "uuid": "44116335-431a-49c5-a8a5-7ad6599818ed", "value": 561664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637259992, "uuid": "db3f2a5a-3a97-4611-ae2c-247ee2093d3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259992, "uuid": "9f969aca-d7de-4cf0-9004-abd0aa8f279b", "value": "swift payment 406878.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657765ea-4875-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637242959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242959, "uuid": "ee11e6e8-5639-4916-a9e5-955fa319f804", "comment": "Malware payload (Dridex)", "value": "1b26e658ab5f34d9790bf28512374b86", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242959, "uuid": "db10836b-a7fa-458f-a9c8-89ef8e09dcb3", "comment": "Malware payload (Dridex)", "value": "4256d5d1b3325408af8c2ea3f496e05d581bf1bfc45a08881f6f8d04fd26f60c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242959, "uuid": "05831bb3-31d3-450b-a528-4a7738d82915", "comment": "Malware payload (Dridex)", "value": "fbd0a618b230fade95419534b3324921e39dc0ff", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242959, "uuid": "d58019af-8c58-4fae-b5c8-b80a73fd63ff", "comment": "Malware payload (Dridex)", "value": "56b1739b50333b7df11724b57397c0b4cbe8beebd64a805a6c14222038105253e98c602da557a217a7200d54b6a8d358", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242959, "uuid": "dab1ad10-effd-4acf-a437-982c9edeca59", "value": "T1E173F1128F56D4A1CBBA11FC915C1FE2F156431C6890E95B3839B709B9A42EFA7DB023", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242959, "uuid": "f4b9e7e2-0622-445f-a10d-25530dd58ed5", "value": "1536:1WFZLsfC7yKE5Pp9xsPqrE3gpMokPF58Ik4kosQFVvSuMoyWeTLo9V++B:wFcC7yKsPp9LEwFkd58IXkOFVvMoyv8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637242959, "uuid": "febfb1b0-86bc-4a11-8530-6dfdce09ea71", "value": 77141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637242959, "uuid": "7dc5abd2-4621-4752-82af-431a2b6e0f40", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242959, "uuid": "6a27d10a-da86-4e15-9e1a-540590a19992", "value": "NR_Dinner 30282.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28cb2542-483c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637218376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218376, "uuid": "ae1efef2-5dfa-418f-b1fa-ffb7199d020c", "comment": "Malware payload (Formbook)", "value": "9fe1f089b2b03d41b044140d696ce476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218376, "uuid": "2c7f8ecc-6303-45cd-880c-465072c60281", "comment": "Malware payload (Formbook)", "value": "425d46c51bf681a37b1f34a602ebf6c7f571060bf698e70f2fd495169f804f92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218376, "uuid": "1e2b37b4-ea04-4482-9e2e-da8b025c61b8", "comment": "Malware payload (Formbook)", "value": "f2a9d35d3e0967ae1f625c208bffce47ccfb6f1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218376, "uuid": "625a2354-4b4b-42ec-ada1-e15198a4d83f", "comment": "Malware payload (Formbook)", "value": "89d48a719b5a8d9340241ea91a7d2435f232edf1b71bc5c061d4aca88a6ccbbbf4d26291a43b7567f283c2613273836f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218376, "uuid": "048e76f0-e624-4808-b1ef-e262efd09757", "value": "T11EC423642DEA4A6DE4934439C1B29148A7BDF05F1BA38D9B97283E70DE371C42DCF894", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218376, "uuid": "0a36ad4b-d9d4-4627-8191-cbd28405109c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218376, "uuid": "653b7d31-2434-4175-8a11-9f22ccdb429f", "value": "12288:7VwFfxeUFaGaNRxOkbAWIXobasrQkkT+DITAeYpM:pwFfxr8Ga1aHobrFO+cTAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637218376, "uuid": "e5081613-3154-4e21-ad30-00ad9e0eadf4", "value": 546822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637218376, "uuid": "df147586-173f-4be8-99b9-68343a30c68f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218376, "uuid": "4f25a547-3ce5-4df3-9a2e-ba5e4517245c", "value": "11032019.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d136ef61-4843-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637221665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221665, "uuid": "4001a000-9250-48be-8eea-ddf5c5a2ec58", "comment": "Malware payload", "value": "6c48fc2488152748ebacc884cfaa2c15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221665, "uuid": "dc35b336-faa1-46bf-ad8b-250c4ea63d3b", "comment": "Malware payload", "value": "430696fd270c7d26ae883c4f87680d4774bfffd1a965073c4c6dfee9a24dd38d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221665, "uuid": "3665a0cb-5db1-482c-9a1e-e15aa36893fa", "comment": "Malware payload", "value": "576a502728994050a65b626e136d99b6571d2d4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221665, "uuid": "9735fdf5-dd28-4217-83ca-4165f78405a6", "comment": "Malware payload", "value": "2a0d414be7df485cf7fdca382fbc988266cb5ec4e4a99d571e97eda4630cce9b8c1660a5c4ef26cb21507471c91e7380", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221665, "uuid": "eb524edc-6818-436e-9d96-0f25a7de7a28", "value": "T10116331054D112CAF6D4ED1E0BDC3725523FEECE28B8ADE3D69293F1040EE89DA72656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221665, "uuid": "35473c61-c65d-43b2-8806-efe79a0125e3", "value": "98304:G1wwAjzIQOMK2GNKslgus10Y1/UJ7BdlRbTBAlYVA:G1wwAYBr21uQsJ7vTBAlYVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637221665, "uuid": "96924f1c-ced6-457e-8a41-34ab4fe9529c", "value": 4136960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637221665, "uuid": "a8338c21-1a6e-4f3e-af6d-295fa580a269", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221665, "uuid": "2d9c4cc5-28fe-4263-8ef7-c9ec35340078", "value": "430696fd270c7d26ae883c4f87680d4774bfffd1a965073c4c6dfee9a24dd38d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890c06ba-4860-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637233999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233999, "uuid": "a7cee8f7-1649-4bce-8004-248edc70c328", "comment": "Malware payload (Heodo)", "value": "422f16027d9c96caf16bceb0a2fe4512", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233999, "uuid": "cda8d144-fd4f-4fe9-90fc-ad3ff5562b76", "comment": "Malware payload (Heodo)", "value": "439e287370b5033265cedd5ac7db241b392338863db741282609b62adc1abe2f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233999, "uuid": "09264225-568d-42ce-b1de-1f04b96bce83", "comment": "Malware payload (Heodo)", "value": "6d807efee0c89afcfe9644e8ca67d8c151f2d1bd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233999, "uuid": "07aa3b58-e212-4e19-b82e-a836e123c9c8", "comment": "Malware payload (Heodo)", "value": "c79e3272f804e5ab09f14cc4190dc9a2db4b50bc82e5a7f6325ab8c4e321fa9e044e31e4fc2b32bbffc700c66a43b36f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233999, "uuid": "644568ce-8ab6-40e9-9051-8c319810a089", "value": "T1BFD4D0112843606FEC9C153C049977BD8FED6B55C2F4E8A7CF80E9E4AAC58C185B6A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233999, "uuid": "a9d9e948-f1cb-46dd-9c43-360b36164906", "value": "9147e5ab6cd2dcc785393175990a85b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233999, "uuid": "0515535e-e427-43ef-a9aa-b23b106f744c", "value": "12288:uOyVoxITHISr3VYRJ0QvcaqNqMWMeWXm6QrXmZ5YTsp4:ZkVYPZ9169Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637233999, "uuid": "f1876d9e-7a52-4f0e-858c-fdfbb1687aa2", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637233999, "uuid": "ce0aeded-d284-4e68-9551-ce52242d71fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233999, "uuid": "42c07cbb-64ef-470f-b0cd-472c25fa5a54", "value": "emotet_exe_e5_439e287370b5033265cedd5ac7db241b392338863db741282609b62adc1abe2f_2021-11-18__111314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0165bb7-486d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637239702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239702, "uuid": "2495ef51-a9e7-442f-b39d-1131b3857325", "comment": "Malware payload", "value": "81f6b1829f1395836d4c2a7235493c7d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239702, "uuid": "1f3dde5e-ab00-4631-b331-007a600d1951", "comment": "Malware payload", "value": "43db993a3446790890c95aaf2ff85ed22c7aae1cc98ea4bbc5ee5f4efcb2eb87", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239702, "uuid": "ce7bc5da-40dd-4ddd-a559-4d0fa2004d7c", "comment": "Malware payload", "value": "753b70a7f2669f442a675335e69ad0bcae29efbe", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239702, "uuid": "704bce58-3ae7-4ee0-b16b-b1935b974965", "comment": "Malware payload", "value": "4e00663054a54fe191467cd16ed8fbec92bfee92ac1d28025a88dec942ef58e3eb4d34c8f2c213d68407d8fecfdde19b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239702, "uuid": "81d38159-7cd2-4aa1-9326-3878ea959645", "value": "T1E3F2E015E111EC08C7A7DDBDE2560AF2F94DD1167210949F68A1F38F8E32287837B748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239702, "uuid": "29ba2204-9412-4647-9892-6ca917abdc7f", "value": "384:xS3/P1g3tT8nNVvQavbQd0miavYzj0EEYpcVhE1ltmTV/YZO4NSCWl822TnUCSdK:sP1gRsVoakTi002VWnZdw9822zAzXIeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637239702, "uuid": "07da6fe7-9337-4c59-a79e-ab2fd72b1ac9", "value": 35274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637239702, "uuid": "157e7297-875c-4f17-b3b0-0cdf06994e31", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239702, "uuid": "e0b5602a-af67-46d4-8833-d4828c440741", "value": "figures 11.04.2021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d919332e-4843-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637221678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221678, "uuid": "73891b5a-3aa0-455c-8004-7989f110986b", "comment": "Malware payload", "value": "f53ae1475bcf1c045d982fcd49526629", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221678, "uuid": "afc1b20b-5841-430d-8622-5654ef3f4157", "comment": "Malware payload", "value": "442d3479547eefcaec66909f1df58a38c2c8f410c63df8bd20c26d8a151de408", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221678, "uuid": "01bbd6b6-43a2-4f8a-bed2-803579e242f4", "comment": "Malware payload", "value": "1f299aba91115ff9f6f4837b973d788185478698", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221678, "uuid": "326cd24c-9668-4d2b-bb5c-3ebf9efe6292", "comment": "Malware payload", "value": "7caf242f2fa90f98aad29b811b415a7eb212af98a06a03192b65f3823da261eb0ab97eb63a2b9dc5358bc1639994bafb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221678, "uuid": "d152dc39-84c1-4b19-a797-113c12cd9390", "value": "T17516331055D122CAF6D0DD1E5B9C3AB1413FEECE28B8EDE3D69283F5000FDC99662A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221678, "uuid": "f5ddb5a4-4f78-4da0-ad56-be7e89ed2817", "value": "98304:G1wwAjzIQOMK2GNKslgus10Y1/UJ7BdlRbTBAlYVc:G1wwAYBr21uQsJ7vTBAlYVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637221678, "uuid": "0bdc4bd2-e12f-49cc-a41f-7be57ad9a399", "value": 4317184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637221678, "uuid": "b84168aa-4919-475f-a79d-f88098a9f431", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221678, "uuid": "860ba1b8-45db-435a-acc3-083c73cf5e2b", "value": "442d3479547eefcaec66909f1df58a38c2c8f410c63df8bd20c26d8a151de408", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e21eb11-48ae-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637267508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267508, "uuid": "b736cf97-c388-4cb3-ad70-fda11fe906da", "comment": "Malware payload", "value": "ed9aac173d5318dc2bd61f515c80d58f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267508, "uuid": "a4fe5578-e8ff-413e-bfd8-0914ff673671", "comment": "Malware payload", "value": "44365c14a5bbca25b465be1a30951b9275f06806548e0476525e5a3f6c4f7782", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267508, "uuid": "5362095b-8457-4eb4-babf-8c76a2c13651", "comment": "Malware payload", "value": "908a85e993ef3f8d0414d3c2db03584fd82b7561", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267508, "uuid": "a05a734d-f6ef-4801-a95b-51887e73d6d5", "comment": "Malware payload", "value": "1a64c0ee40f0f3e4412abb82ae9a37f2972cd47eb5d9781a4999c68013c21ef15dd08077b56a64169d8dc5b5a5a5bd04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267508, "uuid": "926c2302-5dd9-431e-9c87-0d2cf1d8d2c8", "value": "T1A3D4D0E036B8D413F76085B6D9B0D3BA8AB0B15D1DD6C6027CDE2A9F76287747C58312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267508, "uuid": "c1a2441d-d80a-4b53-8e9e-fe7eee8f56ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267508, "uuid": "74d55a3e-b488-49f0-a7ff-33dbf446011f", "value": "12288:m8Vm31gW7SUe/8wdXW0v79yF4N6S6NydC/pvZyK9L:m8Vm3KWgldXW0TgJNydC/h9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637267508, "uuid": "4dfc6f21-2b0e-4ff7-80e2-b63bbffcfa6b", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637267508, "uuid": "1e0dc81f-941c-4c6e-83cc-b6e97af0bb8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267508, "uuid": "76d2e389-8c43-4508-b0f2-4899c6745f32", "value": "ed9aac173d5318dc2bd61f515c80d58f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9eb82f-488c-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1637253091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637253091, "uuid": "7c5c000a-f932-487c-83fb-c00174534700", "comment": "Malware payload (GuLoader)", "value": "0ac97064d95843d7aa01ee10334d4de1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637253091, "uuid": "28ec6a3c-8534-46b4-a754-8b10ddd3b75e", "comment": "Malware payload (GuLoader)", "value": "4447268da1ef83dfaa9b5e01af2d0e92db11e4b9553b0732a8c83d75f52533f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637253091, "uuid": "2fd8518a-edef-4a54-b883-4cf24988728c", "comment": "Malware payload (GuLoader)", "value": "eb9ec5a9acd436087e6c62da606699b77821b292", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637253091, "uuid": "9339bdba-ed52-45b2-8bb0-6fafb2884de4", "comment": "Malware payload (GuLoader)", "value": "2d7193f15116a3dcc3baee676be586c2a3c14b54a3ae40fcb867e53274390ecc16279ea297bc0c01d3dd31b0f0e1e498", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637253091, "uuid": "c53ceacb-b44a-48eb-859f-e5ab55ac9282", "value": "T16EE35DA7BCC4D8CFE2044A721462D67460616CC1DE7EBB377388FBAD6A7A38134456C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637253091, "uuid": "d9ad3db2-9e44-42e2-9786-098999b8e3ee", "value": "1664af5ac7fee4e909bf4c17d2553a4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637253091, "uuid": "5cfcdf74-9254-41a3-a3e5-924cabfeded8", "value": "1536:t/nLoT+zOOi0iJRdDP348+3AIe5+8GPcPiAbj/tNFmqThGm8ll+ZNKL6GRkfX7qm:t/5wJR6LTQTGPcaaDxd8uZUL6GIZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637253091, "uuid": "70cdeb14-4114-41e1-934b-42daa98c132a", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637253091, "uuid": "b7fdf476-3b39-4690-a656-e9a6aae63011", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637253091, "uuid": "ee824da9-a1ea-4a53-8b74-9465b84dcc93", "value": "Remittance Advice_111621.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa25e8c-4873-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1637242197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242197, "uuid": "f51755c8-ee44-48d2-b9bd-65ad494a997d", "comment": "Malware payload (Gozi)", "value": "f764000ebe40ba85bb855ac916781394", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242197, "uuid": "da908abd-cd1e-40af-99ac-d29589986cf8", "comment": "Malware payload (Gozi)", "value": "447bc529e6730e1d9b2b2bc09aa8a1c52dda910a9e5fb5698ecc2d34fbd4a718", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242197, "uuid": "a7a8fcaf-0c7c-4fa2-ab26-448668373ef9", "comment": "Malware payload (Gozi)", "value": "6347b7b01f9463820f901ee266d9282168d14a6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242197, "uuid": "ec0dafb9-9611-45a4-8527-15e723f3b5b6", "comment": "Malware payload (Gozi)", "value": "b92f0d01cbcf46a39341862409e657836ca97aa42024f26a283ccfabb9bb8ae09ea66d33d082c1adeb6c6e766c71ea13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242197, "uuid": "9f3ed981-8eaa-49f7-a29f-cd2e0648a941", "value": "T109246C6AA3E40599ED6BD5B9CD53D65BE7F270092B14D30F13B0CAA62F07722B21C352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242197, "uuid": "afb08f61-b3f2-4dae-8865-9d00ef8ea3b6", "value": "6144:BJW2HtbCVumt8ghreR/4ekzaiurrL2vhxQB5DYyvd:BM21CAmt8ghO/4ekCrv2ZxQIUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637242197, "uuid": "b6993836-5073-44b3-b4e9-56f9c0aae34a", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637242197, "uuid": "588dbfea-cdec-4569-87d4-ddcb1e827fef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242197, "uuid": "02964204-81dc-49a8-80eb-8c6b7a2946d0", "value": "21da6310000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5df4f0-487a-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637245356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "f812fb2e-08ee-4348-b540-6cf643c1d2bb", "comment": "Malware payload (Heodo)", "value": "cd099d719a7276a70c6eccf9819994e8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "1d466791-a8ad-466f-aff8-57946c664d04", "comment": "Malware payload (Heodo)", "value": "453e621f947716e900e38630eee0f46311a7122118b14fed012f5b68e5247bb2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "3e51558b-1bc0-47d3-b076-fdeaf51cd1dd", "comment": "Malware payload (Heodo)", "value": "e6cbcff524796617360d2de97bf3c205c399cb43", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "f183c486-0c04-45d1-869c-c2092109775b", "comment": "Malware payload (Heodo)", "value": "fe6884abfe48a0176ddca75837fabfc7716abd53984b5e512b8a7881796cb8e65039e4cdc751c70d1d3e1d1e01a55c1e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "aa39b94c-3a05-4718-902d-3763d72d6b5c", "value": "T11BA4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "298e17dd-f6aa-4aa3-9cec-a34204c0cc96", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "92715b04-8785-4d20-824e-fc6815eb15db", "value": "12288:bdv8jkvzqZvv2wLBImTi12yD88kYwZ1h1:b2Zvv2cDTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637245356, "uuid": "af21ac5b-ce3d-4064-bc40-1baf72fc729d", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637245356, "uuid": "14e9f0ac-58bd-43ed-81d5-83071fe898e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "9fa545dd-9886-4bf5-8207-805e80001374", "value": "emotet_exe_e5_453e621f947716e900e38630eee0f46311a7122118b14fed012f5b68e5247bb2_2021-11-18__142231.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ae55e1-4843-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637221691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221691, "uuid": "946e2644-2824-409a-ac10-7e95002b01f9", "comment": "Malware payload", "value": "8ff99178db0364d5c06f17053a70b265", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221691, "uuid": "2f23bec8-ab9b-4866-b59e-ed35339548c4", "comment": "Malware payload", "value": "455d8f082dd1b2b8b6a191a5959e32cff883b23b2d6ceadbc4bc76c9f6c69981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221691, "uuid": "02ba98ad-f6b0-4eb9-90ff-76cd9be64f29", "comment": "Malware payload", "value": "93a8d0b59369011e9873764229a16e9d417df07d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221691, "uuid": "863f3174-c431-40e8-a1cd-02df72f9bbd9", "comment": "Malware payload", "value": "34a5a4bb4627d5a391a47764d2a6b5fc6018af0ce3553580a856aeb71f83a1de07c91137207137e6eebe702ca43031a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221691, "uuid": "23ec4d71-e5a0-4596-8666-8945a0707d74", "value": "T1F746330446E035C6F1D4ED1E53DC77A85226EECE60A8E4D2D6D3D2F2410FD9AAB32786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221691, "uuid": "26f0c7c8-641b-43d4-befe-91422c4dc549", "value": "98304:G1wwAjzIQOMK2GNKslgus10Y1/UJ7BdlRbTBAlYVdoTGcBHdQXn:G1wwAYBr21uQsJ7vTBAlYV+TGcXQXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637221691, "uuid": "6792e5b9-9d5d-4992-a453-66e13f9e5ba5", "value": 5361664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637221691, "uuid": "6ece901c-a535-4918-abc7-216bee9aa1c0", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221691, "uuid": "236c4bea-5051-48bb-bb73-18aaa6ae7248", "value": "455d8f082dd1b2b8b6a191a5959e32cff883b23b2d6ceadbc4bc76c9f6c69981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4ce761-484e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637226141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226141, "uuid": "ea7c3b0c-eef2-4215-82c0-eb1eb34c335a", "comment": "Malware payload (Formbook)", "value": "f74634e048e07c5fdb0399af6bf4e5af", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226141, "uuid": "7810be65-efcd-40db-b645-353a98dbdec3", "comment": "Malware payload (Formbook)", "value": "45986d991634977704aeb3f95408be8c3391d2b3046c8fa91236e746c74c908c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226141, "uuid": "fae8dc33-8657-444a-ac63-79abdd3ff69e", "comment": "Malware payload (Formbook)", "value": "6e42ec4eefe58e58f6a8adb0da681688316e7a49", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226141, "uuid": "bc2810e8-c90d-42f2-aeaa-0db7b20e86ef", "comment": "Malware payload (Formbook)", "value": "c155821c3ad8d76ec6c3013518f0b98ba0e80843977324fafb15f9b4f70b0d39be8d50437ac30b07832c9f5153a5b389", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226141, "uuid": "55011dc3-d808-421b-932c-46e38361cd09", "value": "T16B34122FFD3BACD9D1BB3339A45901BA4250FFEC655107F2B1A272203935A9A7837452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226141, "uuid": "581c3e7f-5b1b-44e8-b9cd-5f9504b88ab0", "value": "6144:L2pRdfD4+lr5qiEj9t+Se2oLehVhhTVTX6z:Ye7e/LKVhhTVL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226141, "uuid": "8f121c30-7e33-4b20-94ca-86bf3d7a4dbd", "value": 234392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226141, "uuid": "1c8cd44d-2768-4733-8020-2e5cae224c2b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226141, "uuid": "2682999e-39e0-41bd-a281-c32165642379", "value": "pago 2378487431.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f898d9-487c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637246177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246177, "uuid": "d014a083-f219-4a16-ade7-f3bc8a30559f", "comment": "Malware payload (Formbook)", "value": "6c7b34d88d3bba58c6490c997bd1fb1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246177, "uuid": "97a04b64-002e-463c-8593-5d0b6bb8d67a", "comment": "Malware payload (Formbook)", "value": "4619bb3a67886541c23eea2bf4eda904ba034846c039aad7c2958a7b915d3db3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246177, "uuid": "17df752e-a584-4335-a17b-d00cb539baa0", "comment": "Malware payload (Formbook)", "value": "afc40c510db61d4bc695ff65b58453d43875cc1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246177, "uuid": "b3228129-8185-4488-ab83-67f5a691f980", "comment": "Malware payload (Formbook)", "value": "d1456fc6c0cc1d327e2ace284bd26abcf445d709f46832ea75c6dd40189ae7478a4f42c653b2e20ada5fb542c31b7dad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246177, "uuid": "24e8a5be-485c-4b55-a412-61373c84671e", "value": "T1BDE4ADC38AD015A5EE981F3500322C785367FF5ABDBCF9CC5E48B6021B376C39666926", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246177, "uuid": "3258fd87-6c77-4f01-a304-cf896b5a30dd", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246177, "uuid": "7c1bd64e-b683-439e-9663-c9d4a3726ec9", "value": "6144:uGi+johWkO9ZpiUXKiormHHwboqLenGz4YD6HR8LpyC:WTO8bjrmwboqMGzr6HR0pyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637246177, "uuid": "6d347919-8d96-4b8b-a569-baf9b18a8a23", "value": 668361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637246177, "uuid": "76f767ee-8b65-4f52-a01e-32773549a64d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246177, "uuid": "04b23dd2-7a31-49bf-af24-335f3ea4678d", "value": "Telex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87bd7029-4890-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637254613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637254613, "uuid": "a35f3f84-47dd-4866-b570-073bc2274888", "comment": "Malware payload (RedLineStealer)", "value": "b400cc5a20449c471160e979ed036cad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637254613, "uuid": "620700bf-c06b-4f96-b905-22fb20c95042", "comment": "Malware payload (RedLineStealer)", "value": "47da94da37e3d742e3cd85e9746aa07752e9003fb7d63bb7d8bb6e0a0276d46b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637254613, "uuid": "0ec21d67-fe81-4d67-882c-e4ad5723de7f", "comment": "Malware payload (RedLineStealer)", "value": "3d8e907aa51806684b6d7d95add70215ef7aed0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637254613, "uuid": "d4277ec4-0f5b-43c5-9f37-aac81ac48180", "comment": "Malware payload (RedLineStealer)", "value": "2aa8c5d9a19eab312b590124302d783030b57e05fc315c24343cef0a2a7ad59397b83bd4305e984a6ef39ac67804e4ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637254613, "uuid": "6604bfa8-3740-4942-babc-9b4eb2ae3f65", "value": "T1A9B40161B6E1C072E52314308DBCA771FEB4B9355670858BFB900A6DBB32EA1C726753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637254613, "uuid": "d100a381-e98c-47c5-ae67-1c65b47d2ce6", "value": "3eaa732d4dae53340f9646bdd85dac41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637254613, "uuid": "40c63a08-a179-4a22-a918-33dce810426e", "value": "6144:Aw393dtLEzq58BcFN6Q8AnVqbHctb1NZ1oLlcet51mMrvbMwhdAJni89dbYIMWG1:Aw35dS4X8AnVqNL513rvR8Jb+WG6wOu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637254613, "uuid": "81f0a18f-3250-4a11-bf6e-7bf22df19550", "value": 505045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637254613, "uuid": "d585c06c-f91d-4a61-bd0d-678496119862", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637254613, "uuid": "9d674e64-24dd-4dac-9ab3-1f6b9dac5085", "value": "PO specification dt.18-11-21.png.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a82f39-4853-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637228247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228247, "uuid": "be1c1b30-314a-48a1-8933-14f1d303ec1a", "comment": "Malware payload (Smoke Loader)", "value": "8696a4269e30ddb34a7e0e84629ede03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228247, "uuid": "27cd57a0-df33-463b-a81d-f05c5fc05870", "comment": "Malware payload (Smoke Loader)", "value": "47ec411eab0aa15619f24caa6256ed4ca5cfc695a26f5b71830b53b07c22b05b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228247, "uuid": "f0949d07-3439-439b-9f83-ca1b08078fd5", "comment": "Malware payload (Smoke Loader)", "value": "125198e1f636ef118e468145d02e801a3ffe2a97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228247, "uuid": "f6c1f979-501d-4f55-82fc-bd756fe19fc3", "comment": "Malware payload (Smoke Loader)", "value": "4a5a67d70437983897d86b6d24eb7714e5b9e9a17211c7bda4454aab2248e62829bdf166d5c685cd3c4a6f95a67156bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228247, "uuid": "42bd0d46-9fa0-4520-a16c-c5f1d9db7c27", "value": "T183548E10E7E0C035F4B712F859B993B8792F7AA1AB3591CF62D516EA5634AE0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228247, "uuid": "2c4a8b8e-0432-417e-a7de-f61b5430924e", "value": "ff6439958bc7d1b926a3ea41188420fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228247, "uuid": "13281fe6-4142-4740-b85e-255a6fdbb850", "value": "3072:80Zpf7ywrLoWHdAucQoHnSzG+dWpvgne52lPxsBvBPoeg8MRkY34R3R8UJPb9wy:RIUJcQk3+WvgnJla7oe0RdIdRzYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637228247, "uuid": "44a3ef8b-6cec-41cc-a9f2-fbb79683d088", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637228247, "uuid": "c1cf5f70-5aa2-41b4-a092-0eeae81a1cd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228247, "uuid": "40dc46d4-6fdd-4e7a-90dd-03699db25186", "value": "8696a4269e30ddb34a7e0e84629ede03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a3c0d5-48a4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637263041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263041, "uuid": "e2fdd73d-7b38-44ff-8e68-5e788f90d899", "comment": "Malware payload (AgentTesla)", "value": "cc77f2da18ceda45483eccfb03d4ea9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263041, "uuid": "0783b6fc-aa8f-44cf-ad98-6c7d1557d9c9", "comment": "Malware payload (AgentTesla)", "value": "48d1fd0635f36b5bcf1daab11cb8f6234e2b69bf42bff3d13f8d4ccde66580d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263041, "uuid": "80c827ce-223f-4067-b197-4a5219bde287", "comment": "Malware payload (AgentTesla)", "value": "76a6d92f4aad864df970dbe2163750380da8153c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263041, "uuid": "43a1ee69-8648-41b5-a381-04a4caced084", "comment": "Malware payload (AgentTesla)", "value": "d694b707c440e362e2d107333ce68a8915c710ee2df0824714d200a037878d2522262c1fe9ee9457fdd1a9e065245ec3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263041, "uuid": "0e633053-6b56-4558-ace2-21680c84b37b", "value": "T17F41D0242E5052D4437A5BA3443BB07CC194CCAEB4DAD98F6129E9803C462F9BAC9B36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263041, "uuid": "a0e7bfea-4092-44c6-8989-e1458f063f31", "value": "48:/LhiFeGtg/fsub4+bnqJF0muuaBTk2lFf4wdZBbgaGSFUSA7xIkgdsiNHn:tiX4fsu7G89GSFs9IkgdssHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637263041, "uuid": "268e52f9-6bc5-4615-8ee4-4707ada84892", "value": 1971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637263041, "uuid": "effbe46c-555e-4a59-bf98-df4a39bb110d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263041, "uuid": "0c807374-6382-482a-8eff-ace3c92f66f4", "value": "FACTURA COMERCIAL.PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d2d59a-48ad-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637267171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267171, "uuid": "98751670-73e9-4aca-ae4b-4cffc6a257a7", "comment": "Malware payload", "value": "7d88223c872b7a844e9ff4a2d51e5504", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267171, "uuid": "7e0113d5-80fe-47d1-8965-2b31c63a4496", "comment": "Malware payload", "value": "4997e928a4f04a01e0788b82f35ec3975fab7960e930f31e7238e555daf7d685", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267171, "uuid": "806de8b4-d56d-4117-854b-0d178ec18bce", "comment": "Malware payload", "value": "d1707e67cb3968bff9e6dfcc3e7d851573d60c3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267171, "uuid": "7b24b81d-f201-4557-8e91-7c5465ea4798", "comment": "Malware payload", "value": "6598a2041085eeff11725f88c6290e696402ff4eb8b6433bc90ed48cd4d08f2777aff5782e65f29bf4495d016210500d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267171, "uuid": "05a9fad9-de97-4723-9fdb-e7dbf5c85690", "value": "T11484221C7FB1E5D5C88B0E3366702A029620F8CF5E52BE9BB48C80BA5EC379D565F446", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267171, "uuid": "0a4bd743-5e7e-4ee5-b1a9-5376292cc361", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267171, "uuid": "b37ddf98-aaf3-4b1a-adcd-6b7992d2df92", "value": "6144:wa9y1bCzVSx8KpiIYXh5UmDgRdPUBAs+9YpwxlhulykQtjjX:m1bCBS4Is5hA4zIhAykQt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637267171, "uuid": "64414dbd-f022-4816-8af7-e8909b6b792d", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637267171, "uuid": "27cb65f2-778f-47dd-89fb-8dabfcf74103", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267171, "uuid": "e371c2f2-a34e-4b40-b981-60eff7dd19ce", "value": "7d88223c872b7a844e9ff4a2d51e5504", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f7346b-486a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637238416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637238416, "uuid": "c40c1ae5-a390-400d-b935-e9d08f5ea91b", "comment": "Malware payload (Formbook)", "value": "9885d0efc98ea0669215ea4a8ab98637", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637238416, "uuid": "d4f6b9a8-82fc-42b8-a6bc-030061c79e07", "comment": "Malware payload (Formbook)", "value": "4a2907475d0024c654da40187933dbb740f743d6adaeae9595c43502e2092772", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637238416, "uuid": "ccb8a652-789d-41b8-aa27-eec753a7f7cb", "comment": "Malware payload (Formbook)", "value": "34586aa00798440bb0795b3146ae2cb9fe0d7415", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637238416, "uuid": "c61ede06-5727-48dd-9aa8-50701f532d5b", "comment": "Malware payload (Formbook)", "value": "83b0f4c68bb87e3711f8d8444c5493b26b3a7cb2932b6409b90a825427eb8ea35a9cbf16d84d591efffaf17d0c19cce7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637238416, "uuid": "f796045f-93f7-4cba-ac0b-8ca813cadf09", "value": "T14E54231BB5DBAA7FE282053186B7F3BBEF380188871A1E6F779C1FBA1855D0120161C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637238416, "uuid": "fa669f54-fef1-4f5e-837c-09408da3b3eb", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637238416, "uuid": "feab408c-d072-48ef-b261-f8c6597a16fb", "value": "6144:rGiaUgCPGBMOIYBrwqVmiwOkpkrWl3uBHcooo+MT4X3J:OCWtBrrwOkDoBHcWcX3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637238416, "uuid": "f8e9614d-ad07-4d54-9151-bfbfe24a0fea", "value": 285260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637238416, "uuid": "1080e4cf-3d6f-46ef-9726-d09ee5e31aee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637238416, "uuid": "e283b7f5-48d7-453b-8e83-90e8fa4cdd87", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45c8e25-487b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637245749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245749, "uuid": "b0845523-7ab1-4f15-ae81-b558cf63adf2", "comment": "Malware payload (AgentTesla)", "value": "0fa269619f0ce9ad1eb596fd6b4bf8a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245749, "uuid": "88fcea02-9c5e-403d-8003-dd2d5f05e07e", "comment": "Malware payload (AgentTesla)", "value": "4b98dfaa625437b4297939c552ad848948f9b83b00dae429a1c1e897355776ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245749, "uuid": "0bc9f3eb-9d22-412d-b615-b8366c461e0d", "comment": "Malware payload (AgentTesla)", "value": "af091d63cd2ad8f07cc9d506761d5711e73cb2ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245749, "uuid": "6998fdf3-ba00-4bfd-943b-1f4641dcb48e", "comment": "Malware payload (AgentTesla)", "value": "663f54b88e11ee263cde016efba4f135e52cc13144dcc9c5723aa73319613dcac705c2746c2f6a95096ee8e6732c89ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245749, "uuid": "1c77e69d-13cf-4f5c-8406-55950715d3c5", "value": "T1D5F4E09036B8C41BE37081BAC1A1D6BA4B70F85C1EE2D6567DDD2ADF7A19760BC24313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245749, "uuid": "6143c7b0-75f4-4947-8a4e-a55883a8d3d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245749, "uuid": "48c2df6b-f45a-4df7-bd53-4597ea301e15", "value": "12288:pLum31gW7ONUs2eCh+q4vd6gW9OfbHkVT0cwzmeSqsFz2qb:wm3KWKNUsdNHcTEzmeS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637245749, "uuid": "8bb298d0-fad2-481e-9497-a66f74fa1cca", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637245749, "uuid": "e0b04bbc-1f74-4e1d-b86b-95787c210495", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245749, "uuid": "c4dd8a8e-ba03-4c49-b314-48028179ac57", "value": "PO_SBK4128332S.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e79dc146-4843-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637221702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221702, "uuid": "0c5105ba-3774-4a44-a993-61fe3c9c13c9", "comment": "Malware payload", "value": "dc7da0eb362c320c86593a08fd301420", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221702, "uuid": "de1cadeb-e418-4f2d-a546-6b4ab503688f", "comment": "Malware payload", "value": "4b9ae3325f30f1bbbbf350a58e460a77cd4bfa749b902ae77134f1ce706a2a65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221702, "uuid": "6435be57-9a61-42f6-bb48-7e01d866c5e4", "comment": "Malware payload", "value": "0f27f9b20d7ad66d078c1699037b0ab06975cd2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221702, "uuid": "8edfa65e-031d-4078-87df-a0ef5c472726", "comment": "Malware payload", "value": "0f02346537e8509d45168fdb8a87ad553b79ff1d178cc98c515203097da29c33a6f9310503468b80efbcffee47789df8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221702, "uuid": "97e3d476-b31d-49c0-ba35-5555a23bb615", "value": "T1E816331045D112CAF6D4ED0E5BDC2AB5413FEECF28BCADE3DA9383F5000EE899662556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221702, "uuid": "5dcec7a3-b860-4ff6-a1ec-873a1b9dd32d", "value": "98304:G1wwAjzIQOMK2GNKslgus10Y1/UJ7BdlRbTBAlYVZ:G1wwAYBr21uQsJ7vTBAlYVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637221702, "uuid": "bc4df023-2fdb-46ae-ab7e-a5d433b3df45", "value": 4169728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637221702, "uuid": "e3f1a58e-64bb-477f-8bfd-89b1d1ef5ab1", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221702, "uuid": "0f0bdef6-7f1b-405f-a066-cddb0e7d556b", "value": "4b9ae3325f30f1bbbbf350a58e460a77cd4bfa749b902ae77134f1ce706a2a65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7dfec3b-48c1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637275792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275792, "uuid": "abaa023f-8e9a-4f9e-8692-dfab83508f5e", "comment": "Malware payload", "value": "282b7cc7884a7592709d88415ee4b9ae", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275792, "uuid": "0e479c69-ebb7-437a-8bc5-813749f101ad", "comment": "Malware payload", "value": "4c67717fdf1ba588c8be62b6137c92d344a7d4f46b24fa525e5eaa3de330b16c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275792, "uuid": "6aefea55-8ac4-47c9-b0a3-817f48cd1121", "comment": "Malware payload", "value": "b6a11933b95ad1f8c2ad97afedd49a188e0587d2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275792, "uuid": "65022c15-9cc8-46f8-8766-8991511f41a3", "comment": "Malware payload", "value": "f7079021ae35ebcc25047b7cc434a494426853f9739961332200f5fc4025d068268b6cd9179ef2db804545a149ef8837", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275792, "uuid": "2aa28ed7-792b-4c23-93af-85c0ce05e69d", "value": "T13F63F643BB548457C98F0139C52E8729F029F73CCE42F3976AE8DAA84FA0A535E56707", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275792, "uuid": "26d911e7-9637-4eba-90c6-8f5409d600a0", "value": "768:nEV6b4xrVmrUQBNk7rfLh1ISI5IAIDqy4pYTTEf:EV6MRVmrUQjmfLh0yEYUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637275792, "uuid": "ef80ef69-5ecd-47f4-836f-a24983c07e39", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637275792, "uuid": "eed6d1e0-2978-4605-8cc2-14e4d30fc9ed", "value": "application/x-mach-binary", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275792, "uuid": "e0da05e6-7915-42a4-8712-62b2ae69a2f5", "value": "4c67717fdf1ba588c8be62b6137c92d344a7d4f46b24fa525e5eaa3de330b16c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899b45ae-4860-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637234000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234000, "uuid": "04c49f4a-4660-4487-b44b-9708f8f1c0e9", "comment": "Malware payload (Heodo)", "value": "28f4832867c3d3435e36ca4cb2c08069", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234000, "uuid": "e0c2592d-38ad-43ff-a0f9-e715afff2760", "comment": "Malware payload (Heodo)", "value": "4ca7f800e9cb0ea01f9bfccbfa5a122e8c7a0d1a03b7536d82e0c38c80fa52bc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234000, "uuid": "ef3891d8-c9bd-4d6e-a678-e1e2a88951d2", "comment": "Malware payload (Heodo)", "value": "906bab1316f64733d571effe5962434476819230", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234000, "uuid": "81762cf3-389d-4ab5-8225-f0cd4732dc54", "comment": "Malware payload (Heodo)", "value": "ea0f042c5fc6cb4d781fcb486940c8f4c89748c4c659aa187b19b44fe5252837c7b1cdf4bdb881b8aec86712377279aa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234000, "uuid": "3b51e062-38ef-464f-b2bb-6d749f0805ca", "value": "T1C4D4D0112843606FEC9C153C049977BD8FED6B55C2F4E8A7CF80E9E4AAC58C185B6A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234000, "uuid": "9cd76c9c-df9c-4c9d-a3df-d48b7186cd51", "value": "9147e5ab6cd2dcc785393175990a85b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234000, "uuid": "bcbe4d01-ace8-4693-9b55-9b3d0d2ee0c6", "value": "12288:uOyVoxITHISr3VYRJ0QvcaqNqMWMeWXm6QrXmZ5Yfsp4:ZkVYPZ9169Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637234000, "uuid": "d628d0ed-787d-415e-a430-c54610827676", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637234000, "uuid": "157ff9c2-8257-48af-a4d3-01857b20f98c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234000, "uuid": "68adee6a-b81a-4c72-807a-76cd78bbe29d", "value": "emotet_exe_e5_4ca7f800e9cb0ea01f9bfccbfa5a122e8c7a0d1a03b7536d82e0c38c80fa52bc_2021-11-18__111315.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6ec6a7-484f-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1637226626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226626, "uuid": "4bf69265-2100-45a9-9acb-ecf7b57c625c", "comment": "Malware payload (AsyncRAT)", "value": "e9c84a4c2d27d8e8aaad203c98d59acc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226626, "uuid": "8805a44a-5ea8-4030-8a13-256213c01f79", "comment": "Malware payload (AsyncRAT)", "value": "4d3d9144790410adbceb9ea6e1c52f5be8cc03c9954b114253988f33dbbe8d9b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226626, "uuid": "614c33d4-95da-461a-9b84-508fe19d929c", "comment": "Malware payload (AsyncRAT)", "value": "4d3d2087276c448ebca386a752689cbbdcb7015a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226626, "uuid": "a447da3f-0547-498d-b55d-93ab66a6812a", "comment": "Malware payload (AsyncRAT)", "value": "d56289f3a5e310e9d75c5538d9fde39759f0c26f1ae09e119f852cfec17afc14f6ada4a6d447a3e9301d4fa1db45418e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226626, "uuid": "983c1842-2cb0-4b61-9e96-4c7d6c6fd6bb", "value": "T1BEB4F1403BB95B06D7294F76C9637010C772B97EAA20D2CB5ED219DE207EF8406A1F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226626, "uuid": "a5e08e8f-f411-4d73-a127-d22bf2286f05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226626, "uuid": "0d93cb41-9b6e-4c3d-bb39-4e52eaaf8f06", "value": "12288:+12suVjdffy0IvFFqa5CSiyRhPpO+COTbvTuutD00g0:6ojBfMq8CdyPPjJOuC0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226626, "uuid": "4f73a6d9-51b2-4d63-99b2-98c09bfef4b5", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226626, "uuid": "03d6aa1e-2e06-495d-970c-38ac5316d64a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226626, "uuid": "4d6464ea-f98b-4486-8330-2f2b71052c0a", "value": "Halkbank,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c444c2b-48a4-11ec-843c-42010a9c0014", "comment": "Malware payload (QuasarRAT)", "timestamp": 1637263022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263022, "uuid": "f74c8a91-f994-4cc4-8fe0-c6425551eaa3", "comment": "Malware payload (QuasarRAT)", "value": "b7feb4affeec1872eeb8b72eac2e0be0", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263022, "uuid": "ad714361-9158-4588-885c-f5d680613075", "comment": "Malware payload (QuasarRAT)", "value": "4d9f9ebfea637dfcd6415af650b54f8930d38c3b93192164cddd59e64ce86e74", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263022, "uuid": "f4406d3d-4233-4ff3-a980-0a3fbd844d08", "comment": "Malware payload (QuasarRAT)", "value": "97cc3b07871bdf8e720787a87d3fbf14a92908a3", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263022, "uuid": "66dc7d71-61a5-4a55-806f-f25c2c481791", "comment": "Malware payload (QuasarRAT)", "value": "3d5655541db437f10d27cc9c4b4f242588c1b7d43d8ff04960da6d85ebf876b08ebc818098b48b691072a98ec4a51fe3", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263022, "uuid": "b23496a6-2d65-42cb-9719-10f4425a9d14", "value": "T1BD21E06C4D48CCF80A4E479B4C77D94E4FE21B91B9A3DE85AA84DD44223432D2E018DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263022, "uuid": "205fcc13-b5ff-47e0-8526-5a09ce6b3197", "value": "24:39WYsnsS+I5nw91i2xfry8sksYrIsmAU8s8s8s8s8s8sqA9GYsix85F3s8s8sEqm:EpPSF1y7AUiA9GqMFXqBuuVQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637263022, "uuid": "35c0b377-0b45-4b5f-ac20-b689d185e116", "value": 1285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637263022, "uuid": "433aa789-47a3-4d9d-97e2-498b41379dcf", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263022, "uuid": "f4dad74c-0506-4be4-8a1d-68746aec9feb", "value": "4528854525.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca828d43-4844-11ec-843c-42010a9c0014", "comment": "Malware payload (SharkBot)", "timestamp": 1637222083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637222083, "uuid": "5cf3cece-8325-4ceb-b2b2-f0f1836b5e6e", "comment": "Malware payload (SharkBot)", "value": "beae001d3bbdcf7a05c053e6773f9796", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "sharkbot", "colour": "#66EF96", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637222083, "uuid": "0dce4eae-e136-44e5-9789-0da43ae827ea", "comment": "Malware payload (SharkBot)", "value": "4f1822817690d89943e7e57468ab4366e360772c0adce67bf74a7224b3732dee", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "sharkbot", "colour": "#66EF96", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637222083, "uuid": "c50bffb9-ffde-4e33-955c-36718bfd338d", "comment": "Malware payload (SharkBot)", "value": "126733f5903afb06a47a59600366fec2dcca45db", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "sharkbot", "colour": "#66EF96", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637222083, "uuid": "aefa8b55-46a2-4f22-bd86-543b82a11487", "comment": "Malware payload (SharkBot)", "value": "e79bf67fc92dcb5ead897a580326caf27abbf31e39c2a12c5fc6d5aff11fb9f6bfa2cdef0f4ce0a01f21be463c0d7bd0", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "sharkbot", "colour": "#66EF96", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637222083, "uuid": "def636c8-901d-4cc8-b984-e829c8c2f663", "value": "T1CB160182B7586A3FC877003349AA5736267BCD568B839747385C362C68776EC0F59BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637222083, "uuid": "3928755e-4d9f-4774-9b1b-da2f1f6b63cc", "value": "98304:RwYcdN9tr46+WcK3Ts22fm95RmOnn6iFPC/yNhzfrPEt:SYeN9tr4Xl+Ts2B58Onn6i46Nw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637222083, "uuid": "ed2f4b1e-3d4d-40ca-8b0d-1d82b7119ba8", "value": 4353808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637222083, "uuid": "a5f2e248-6731-4e4d-87b3-c12206674d3c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637222083, "uuid": "0dc85da9-a305-4a69-97b6-08271a664842", "value": "4F1822817690D89943E7E57468AB4366E360772C0ADCE67BF74A7224B3732DEE.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b84c213-48a5-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1637263477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263477, "uuid": "7d27d6ad-6c4e-455c-9010-51cf97a64573", "comment": "Malware payload (Metamorfo)", "value": "790fa5143b6802ec9e5b1f107b01e2a1", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263477, "uuid": "304a11fc-7807-4dd0-b209-402069b2432f", "comment": "Malware payload (Metamorfo)", "value": "4f1f3897d8e05f1dd6d3bdc1ce340e964d89d27921aa88008a8213e66e024642", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263477, "uuid": "5814d9fe-87f2-4682-b1e2-39e90c0e0dfd", "comment": "Malware payload (Metamorfo)", "value": "4a247fdaf8ba68231e36b37b1edd3f2e1e915f94", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263477, "uuid": "b03ef62f-bece-45e4-a56f-5b7a10692a77", "comment": "Malware payload (Metamorfo)", "value": "908604d09b4abcc30b24c1e65936e0ba8f795236b1a388969bfacc0fe950772f161a1cf86b62df7242bc17e9c38c3461", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263477, "uuid": "42b500f7-28a9-44d6-ae73-363ae4b05ba3", "value": "T1AB41F2151DFA035AC6B3CF3624F6B286CEBBBD115D534B5E8440439B1861690EC36D6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263477, "uuid": "631a73c1-0532-4985-bd9c-0244dd5b3b8f", "value": "48:8+uH+M+L1WoI1RpOvVlfEt0i1cIXv3KaIqiHkb6NS6:8+ueFL1aVOHfe0i1cGvKdEbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637263477, "uuid": "2762c45f-fe75-4ef7-a943-f1fba8995624", "value": 2006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637263477, "uuid": "513c8286-9522-40d4-88cf-44c69255e0c3", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263477, "uuid": "0929d1db-7840-4c89-84c8-b3a7a96c936a", "value": "18 de Novembro.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061b5a09-486f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637240222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240222, "uuid": "562e8d70-6001-4936-a36b-fc93cade117e", "comment": "Malware payload (Formbook)", "value": "97994e250df1a07b774985dd4b1a9c1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240222, "uuid": "69268636-86c6-4f4f-8da6-bde3785c26d2", "comment": "Malware payload (Formbook)", "value": "4f2852e38ccd6fa9cce1580220421fc57c80c4978ab11f54f94927974e5ae2a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240222, "uuid": "d7eef0dd-f403-4b6e-a961-4931e99f202d", "comment": "Malware payload (Formbook)", "value": "42cfe966d3798b377e7018ae1a5e84c6ea33a7e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240222, "uuid": "38542a28-572b-4953-9c4f-4f49c014cf9e", "comment": "Malware payload (Formbook)", "value": "15ca440f62c6fa7c64e20cab4f3c5c38c80be33ed8f0b246f50a7de0c9776f8fa337a2e17298537173a220e4ebc564dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240222, "uuid": "576bdbcb-bf68-430a-a488-588c945c732e", "value": "T13105011532B95F03C5FE87F49226914007F2765A62ABDB0F6CC3B1DB7E62B518B46A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240222, "uuid": "c170d9b2-7d36-4e15-bf53-001ca89c7031", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240222, "uuid": "dab06a57-dcf7-4817-97d7-fd348004aaa7", "value": "12288:fXvf2E9AXnYuYU6V4YqRYEPOza041XwlAqiRAWLcffhCcfZ/2Yp44S2zG9+aw9cp:uE9AX1YJfgPFhRbIkk/2Yp44jZqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637240222, "uuid": "cbde7d4f-e14d-41d2-81bc-4c06fce65ecd", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637240222, "uuid": "8311d2d0-92ba-44df-9bc0-8be88c389452", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240222, "uuid": "edc69354-16f8-447a-9ab9-1499a273816a", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c520eb48-480b-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637197593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197593, "uuid": "b24d20be-eb07-48e2-ba7c-0a7159ac5d1b", "comment": "Malware payload (Heodo)", "value": "0374e395bf03aeb8fc0ba0306c9b756d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197593, "uuid": "0397eebb-b957-4fda-8ece-f93295389a67", "comment": "Malware payload (Heodo)", "value": "4fccfc09206539bef3ea271f215e4a5a88e1f0eb9e560b7e81658ddba84b336a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197593, "uuid": "d3ecdd5f-64de-476d-bbea-a3896b16052d", "comment": "Malware payload (Heodo)", "value": "f6aa4f2640646ba51f495a3395860aaa5b84f0e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197593, "uuid": "77ea1d2d-74c9-4d9f-a636-391e5c852b26", "comment": "Malware payload (Heodo)", "value": "15d0477eeb036941bb6716c3780ec1fa2b52b234504fba0c69c8f02c42609776323b31d34c3dbbf93850a0ab8b9d3ab5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197593, "uuid": "efd6fb16-33e9-48f4-833f-da16383f3fde", "value": "T1E444BF10B1809032E8BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197593, "uuid": "5582a512-fb6b-48fa-8241-9e0237d8c4a3", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197593, "uuid": "7b6ed5ac-1aec-42cf-99ad-709497d77720", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBW6asb:prf+WPVXNcwUKaWT3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637197593, "uuid": "ee51aee8-b8f0-412b-a575-415ab24fe1bf", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637197593, "uuid": "f5a5db91-d512-4d73-8a20-8bf6315a2b52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197593, "uuid": "13bc11f2-7bd0-4740-9b8a-66ed65de8305", "value": "0374e395bf03aeb8fc0ba0306c9b756d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98ae1c1-4850-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637227316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227316, "uuid": "f285a7d2-efc0-4f34-8afa-65a08153eb94", "comment": "Malware payload (SnakeKeylogger)", "value": "785f58ef9aaccd15286a112974cbacfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227316, "uuid": "3f628de9-3463-495c-a7ea-49b3dd67f7b4", "comment": "Malware payload (SnakeKeylogger)", "value": "500241e1d85aa91a80977c632488a2713e0e6eba77525e3373f267c3e0e5e5dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227316, "uuid": "0badf948-8dd6-4040-a1b7-39308bc56779", "comment": "Malware payload (SnakeKeylogger)", "value": "204a46cd4364ddb0821566024b9de963d306a243", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227316, "uuid": "b7f2d50a-c36b-4f51-be9e-add814f774da", "comment": "Malware payload (SnakeKeylogger)", "value": "205cc866afdfd930a11be9faa92ecc1bf83e894a84b8076ebbd22361c0e7737997b27e798e83efb4b014cc5446434d25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227316, "uuid": "caa2a742-3538-4cb3-9dac-a44c647fa1c6", "value": "T1D7C4CFA03AB8C813E33089BAD5B0D3BA8FB0B15C1DD5C6027DDE2A9F76597657C58312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227316, "uuid": "9b7c40ab-3685-4296-a116-45427adc2663", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227316, "uuid": "e138b001-e769-4d55-b241-f531560240de", "value": "6144:z8DzOUa3HXkh22hlECn/KqS15VIFI7M5IBOyVZsPl+3IZk9bJdPmgu21uvbwf+VE:zczRm31gW7ThuSMXa+myyCfZdKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637227316, "uuid": "2801ade4-5b6d-4728-b643-04549fed5230", "value": 560128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637227316, "uuid": "6d394790-c460-402d-a68e-7d9bc43bf0f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227316, "uuid": "c326b5cc-3faa-4fb6-911a-29c6e342021c", "value": "SecuriteInfo.com.Variant.Bulz.885187.6822.11080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82bdd5a0-483d-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1637218956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218956, "uuid": "08630cb3-ef60-45b7-b2e6-fef85f01fb46", "comment": "Malware payload (AsyncRAT)", "value": "ab7113a96322f1e0efabd4e00f0fc219", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218956, "uuid": "271b6c82-a147-4bdb-916d-71e36c2638d3", "comment": "Malware payload (AsyncRAT)", "value": "509f02b2a6543aab550e12f195272e0189d174ff931f72177126e295d2a96a7c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218956, "uuid": "45351e8d-076b-4ee3-b252-6f55d8b96cc0", "comment": "Malware payload (AsyncRAT)", "value": "8b97410ac4448e5fd4c6c9162441d4838fc6b0a4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218956, "uuid": "e61f6e2c-4ad4-463a-9f81-fbee5bb9c46a", "comment": "Malware payload (AsyncRAT)", "value": "2c8f4738b83f2f035da8e24327e42cda19ced349b5c33ff6468c5e27f2f1088fe652dd2dd69f83eb736aca9afaa6e5a2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218956, "uuid": "be0c1afc-f8ba-4d4b-b4d9-ddd5292adc87", "value": "T16094ADA03AB8C427E77081B9C5B0D3BA4FB0B16D1DD5C6427CEE6A9F76587607C68312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218956, "uuid": "8273d3fe-015f-4aa9-aa5d-e9ca853f48a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218956, "uuid": "c7724088-9ff9-4fa7-8381-6dbd667fe205", "value": "6144:19YIUa3HXkh22hlECn/KqS15VIFI7M5IBOyVZsPl+3e4j51/ggowO+kZsHF1aDkV:1Gm31gW7B1oIHLWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637218956, "uuid": "4f07b7b4-a9d0-4334-8529-0e2389cb911d", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637218956, "uuid": "aad8f4c8-b82e-45cf-9807-8eab1b40a430", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218956, "uuid": "5d27fc28-998a-4bb8-b51a-4f8b592e3e0d", "value": "Halkbank,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473dfbac-487e-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637246773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246773, "uuid": "b19a1ef4-8b09-463b-90dd-c94bf8b5a169", "comment": "Malware payload (RedLineStealer)", "value": "2579ccc9a8421656062ba62c26a7d241", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246773, "uuid": "076a09d2-3f75-4ee5-8a8f-3697aa11e159", "comment": "Malware payload (RedLineStealer)", "value": "50d77a8a5e5ced0e79891d026a9329744a23b75e80359e4a2b23bab1eaa95188", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246773, "uuid": "1a6efb9f-bee1-4ae6-940e-0b7d62fff156", "comment": "Malware payload (RedLineStealer)", "value": "beeade4e1f5cb9c2608cb0b99781f2cf57f2bd04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246773, "uuid": "30545b8b-ebb4-4ce1-ab1c-90290d93a64a", "comment": "Malware payload (RedLineStealer)", "value": "63b9941af26c116b23f43017d4ab254ad0e2fc2add4af2fa2d3343f7078f07fc18bc8822f0d04bb44809246fb175ca4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246773, "uuid": "2fb42d4a-d2d0-4b9d-8407-469d3f05dc05", "value": "T1035533DD63CE9802C087127B8FA3359798EC20F84F7D952F52175951AC68AEC938F993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246773, "uuid": "33496b23-e880-4867-97e8-e2454735cb8c", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246773, "uuid": "fd3f46b6-516a-4703-8f46-0584ab245a02", "value": "24576:KwSa/Qt7oHM4SqGUIWNCICHelOVALYbYlTHtR8yYi1t9zc/wq6ITPakEaHNYK3JV:KXxRMGQF0IOonTNR881tNc/hhaNaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637246773, "uuid": "6637cd1d-6311-42d8-80b8-c728ff5c363c", "value": 1361408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637246773, "uuid": "fb67465f-ff4e-42ef-bf34-0d47d6e7306a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246773, "uuid": "d005975d-6a53-4b45-9455-d4b2083ecff6", "value": "FortniteCheat v2.3.1.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b4baa6-488b-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637252648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637252648, "uuid": "2bc26f6e-075f-4f7b-8465-dd3a8869291a", "comment": "Malware payload (Formbook)", "value": "6658614396afddd808da0a71e175b39c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637252648, "uuid": "c537dc00-ab53-4333-90b4-cf004f4015e3", "comment": "Malware payload (Formbook)", "value": "518853f82aac567a9f859d8207cc9623daef0b7bdf20885398a078e792f9ae77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637252648, "uuid": "da73cf2a-f43e-4ff0-b03a-fb57f2e0fdf9", "comment": "Malware payload (Formbook)", "value": "8315d43864cef2a2b7b386ac9154881b63c63c53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637252648, "uuid": "26d33f27-7487-442c-8e7f-cc117f050737", "comment": "Malware payload (Formbook)", "value": "e05d5a54f890acb7857f28bc1cc3e5fc2e07502bcb225aa0776d2c33c28ebb4eff8d11fad4accf3d7acafe4ab8cf09e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637252648, "uuid": "4470546c-5160-4ebe-8f39-72365439933d", "value": "T15DA402666368876BD27807F951B5FB380B769EE07865D709AEC078DB3E32B4108257C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637252648, "uuid": "51ebc3f1-8859-4807-8c82-4e6bbd405798", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637252648, "uuid": "5cd3cb92-69f9-45ea-bb1f-6f0b8b9a9351", "value": "12288:kK9Z1WffdImqwmctCN6L/F9ODs2Lh5UKLr1zrD:99ZkfamLFtCN6jFKs2e6r1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637252648, "uuid": "6cc65ef1-6a26-47c5-af9a-72fc9eda241a", "value": 461824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637252648, "uuid": "a16ff9ba-7919-42ff-96b4-86a1f50a4871", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637252648, "uuid": "980d8614-f94a-442d-a0d1-8c152213ad43", "value": "PO 18112021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee2d432-4859-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1637231083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231083, "uuid": "c7d9dc6c-2537-408f-9c78-fee057214f5c", "comment": "Malware payload (BitRAT)", "value": "b5637df0b23ce375dd252fa78e186f6f", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231083, "uuid": "6d2b4540-7343-47a7-a1e4-f9f9d9a3e3db", "comment": "Malware payload (BitRAT)", "value": "51cf8bad7a9dfffdab43a17761c29b9d1bd1004675a4e9fa6965e5430a6e371b", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231083, "uuid": "ed34e396-0c9c-4039-9c5f-89009da42cd7", "comment": "Malware payload (BitRAT)", "value": "f1d8a941a47c6d1ba18d4a2499e0c43240f57e76", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231083, "uuid": "f6a44737-f7ae-4f71-9d9c-b6c228c67ca0", "comment": "Malware payload (BitRAT)", "value": "21eb3491a441d3c712f286b61366c3a9fdc9ec4ea84926e9885825ef65a50172925d68dbaf60d3697e9eb9872ab218e3", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231083, "uuid": "42425c69-6824-4f8e-97a8-90f3ab04d13d", "value": "T19935AF66B6C06536D1720E78FE2BD2B16C6BED602E78180377F43D8D57BD9802A39247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231083, "uuid": "30b53e79-1d27-46be-ba6b-785d4e8e8c14", "value": "9932ed6ef0f007ba412ff7a0ba590c83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231083, "uuid": "0f524ff6-d57a-4a2c-b1a1-032f7393ec55", "value": "24576:IAysw0SxuOso3abg4gGJaysrP/mJXgESvLqm:IAySo3vGJaysrP/mJXg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637231083, "uuid": "aa710f20-1d25-4519-9cc6-e2e19549d94f", "value": 1112576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637231083, "uuid": "91f1cdae-f25c-4a38-90a4-2e131a90c109", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231083, "uuid": "dc1d208b-39da-4884-b34f-8cfdebf65397", "value": "Bivwdtdffgrhpbmfjjpxtuhueddlgihjyj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fbf0744-4856-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1637229662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637229662, "uuid": "561c53f0-3559-44a0-96a4-26b90c40e098", "comment": "Malware payload (njrat)", "value": "cd1ba87e58f7a1c7dbd1dfc3c9b027a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637229662, "uuid": "b705f6bf-57ab-47e5-b0fd-34878ef71049", "comment": "Malware payload (njrat)", "value": "5320400539e21be4eee7c8adc75f045b957d5696007adb23c0f390bcfdfea9cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637229662, "uuid": "77e756ac-5151-4b36-809e-961c8a26e5f0", "comment": "Malware payload (njrat)", "value": "c05f65395e32da15608b008ea9d6f1feff90d3e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637229662, "uuid": "10bb8aeb-704e-49dd-95f8-ac4102566ade", "comment": "Malware payload (njrat)", "value": "a66bfbdfc4858871d708329897e9c50d89d1bf36e11e64419f1238868522e0144496b9f8ffbbb4a744fc469ba6ca6822", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637229662, "uuid": "2d8d334c-e0fd-4af8-8e4f-c0d926afd414", "value": "T17E032A4D7FE18568D4FD0A7B05B2D41207BBE04B6E23D90E8EE5649A37636C18F50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637229662, "uuid": "283c4b25-50ab-4a13-9510-ae8cf8447613", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637229662, "uuid": "42beee4e-b3e1-4bd9-8d40-2498c3eb946f", "value": "384:Rejaio1D7S5pbpQyEfNqjk/rcYaYtVrAF+rMRTyN/0L+EcoinblneHQM3epzX8NC:E/3pLEf0jk4lYTrM+rMRa8NueQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637229662, "uuid": "4e6da181-f5fe-4c29-8981-4241fe606ace", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637229662, "uuid": "7a907626-9364-4eac-b344-721ece044c93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637229662, "uuid": "d43c2f35-7450-4778-a3f8-f0cec9f7c587", "value": "5320400539E21BE4EEE7C8ADC75F045B957D5696007AD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd22cfe-4878-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637244392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637244392, "uuid": "7c3fce1c-4b6a-4241-ac45-9142f790b119", "comment": "Malware payload (Loki)", "value": "f1a3cfd28e1bf8b6561c612d3e56f904", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637244392, "uuid": "f2aadca3-8e30-4841-b1af-792be0335788", "comment": "Malware payload (Loki)", "value": "562106c81a2f699a8750c88a26e9b4fb7239e8accad50edddd350ee5e83b511b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637244392, "uuid": "ca7344d0-629a-4aaf-a322-15273c2877be", "comment": "Malware payload (Loki)", "value": "bacd8457bd0d49c28fb1f1437d0763c850289f25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637244392, "uuid": "ab31eb2a-5f68-4aa5-b1eb-1e4e86e915b7", "comment": "Malware payload (Loki)", "value": "400b45e8d1a57f680b81ccc8263e231c9624353fdefe119324a1868040986bfc6bf72ff934023666d2d03c37990f5f84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637244392, "uuid": "b54753ed-caa1-49ab-a730-6df6c1d2a744", "value": "T118B4CFE036B8C913E3708576D6B0D6BA8A70B56C1DD6C6427CEE2ADF762C7607C58312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637244392, "uuid": "14d21898-20d9-4abb-a8e4-bd4d5250407c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637244392, "uuid": "8d9d5d13-a2a3-43e0-bd2f-9be9f4801201", "value": "6144:K3qtxjUa3HXkh22hlECn/KqS15VIFI7M5IBOyVZsPl+3i4i+/1Fy9TrD3NaN9jR5:PxAm31gW77/1kTrDUWsMzWHK+de", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637244392, "uuid": "7e5b436e-5104-441e-ad6d-ce16d95150db", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637244392, "uuid": "a347d46d-e1ce-4b2c-a0f8-afab592a0f02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637244392, "uuid": "b84095f6-cf4c-4a74-a56e-62a5276b1929", "value": "BWT2900456.COM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857f995b-4890-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637254609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637254609, "uuid": "410f974e-83ba-4b6a-b3d7-fe64aae9c9da", "comment": "Malware payload (RedLineStealer)", "value": "1f785fc6c97f1b8c70465741b1f28045", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637254609, "uuid": "a7e3513f-f945-4d06-84bc-ed1859780ee8", "comment": "Malware payload (RedLineStealer)", "value": "56b5c8eac3ee5f3d8da478b56ef2262f37f877d6a626596dbb6e1a9aec217cc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637254609, "uuid": "a5ca4fae-18bf-488b-9ec0-e63c66d5a7c2", "comment": "Malware payload (RedLineStealer)", "value": "9f5e587b1c93ba86273b526d2006cf9b92a7e533", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637254609, "uuid": "640b86cb-a6a5-4808-9afc-23b5412df582", "comment": "Malware payload (RedLineStealer)", "value": "65bf26f4c977f001c89715b3744a981ed25413502aa8f8487f3bc7bff615f96b49033b68825379e34e7d4c17f0895285", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637254609, "uuid": "68fa5b48-6914-41f1-8bd3-f7e793dd5ab1", "value": "T108448E10ABA0C035F1B716F849B99378B93F7AB16B7494CF62D516EA4634AE0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637254609, "uuid": "2c22cd99-fd0b-46a7-9ddb-641ba066eb46", "value": "5ec00bbaa469943db4b6795b01cc4091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637254609, "uuid": "8aa7bd3d-c6ae-43e6-8e1c-1be25c4803e6", "value": "6144:UkJWhrYCyFGqZkcQJFS5OQ9uwGfH9pQm+m:BWh8FJKcQJ05O8oH9Wm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637254609, "uuid": "5f8bbadf-8e74-45f8-9713-d021099646ba", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637254609, "uuid": "e6797647-ee6d-44b7-96f5-81f3a727e030", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637254609, "uuid": "fb491730-2bb8-4ec7-8456-233bfc6fe81e", "value": "1f785fc6c97f1b8c70465741b1f28045.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0039a3-4870-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637240717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240717, "uuid": "a018fa16-fe2d-4962-8234-2e3cb5ccf3d7", "comment": "Malware payload (RedLineStealer)", "value": "5d6d6f035b44c493d2e00ffc221b2e92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240717, "uuid": "8c30f7be-9b81-4f50-9835-0209edcfc865", "comment": "Malware payload (RedLineStealer)", "value": "577f4d7bd1e5f9ecd4cd989d058ff04f645431f5b1510e8fce815004b39eb6ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240717, "uuid": "f3a8408d-801b-404e-80ad-0c03d11cb2a6", "comment": "Malware payload (RedLineStealer)", "value": "8ba8c3bfbe6c18c08de9c40d7f1dc749cee2293a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240717, "uuid": "5031b261-7762-40c1-a372-0c8b79fb4acb", "comment": "Malware payload (RedLineStealer)", "value": "a284991fc27fc44c591d46cb63afa41c6d88c3aff6df8283d0a98c4c7a572921b3f6e52bc688baf119be5f9571865a9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240717, "uuid": "fee48ad3-6145-4e5e-8264-8d72eec3823e", "value": "T15D84CF00B7E0C038F1B756F84A7982B9A93F79A1A77495CF62D516EE4635AE0EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240717, "uuid": "dc9b2531-b5ff-4c80-b847-fa2efb202a13", "value": "323504891562b22c6999415c44b3f208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240717, "uuid": "eac2fc58-dbaa-4b29-aa78-0c3cfd15fcbb", "value": "6144:zedWd9xzOydXiMpqUTJ05O+k4Hl+eziystoPxc9:iW5z5XiM7TJ0g+k4Hl+ezqoP29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637240717, "uuid": "c7c6368e-e1d3-4790-b792-51ce652715eb", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637240717, "uuid": "46f5b64e-8982-49d1-9d4e-389c6b0802db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240717, "uuid": "d6b13fd6-3cb0-4de4-952a-7d7a1ad67e73", "value": "SecuriteInfo.com.Variant.Babar.29261.27982.7879", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d70bd74-48a8-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637264742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264742, "uuid": "8d0877c8-9851-4068-abe6-9314073e0e8a", "comment": "Malware payload (Formbook)", "value": "db4b2c360a1722043710d3a0ba93eac7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264742, "uuid": "238a5017-0fd1-4ac8-b8a7-21cf52e0cb70", "comment": "Malware payload (Formbook)", "value": "578a65819b95b3c817cd4d6dfe3ef9855ffb7309ef3ae8ce904fb558e262a86d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264742, "uuid": "55c2de0a-8f8f-4473-a5d7-f8c35c031eb7", "comment": "Malware payload (Formbook)", "value": "6004d4fce6f10a529dc5d13f17393cf908221438", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264742, "uuid": "815bda55-abbb-449b-b814-e27dd776eaa9", "comment": "Malware payload (Formbook)", "value": "5c6f4f7e488989e38b62a3b87e771460cdec60e54e320456482e6be172abb0c240f63de658c56839ce30fd86868e17de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264742, "uuid": "c245b1f0-56dd-4531-b79e-91f1ffd0a3c7", "value": "T18D74234A91D0D3A7E6D5043220F6EB76D236CA8905C75F5ACF700FFE5F60AAB49460E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264742, "uuid": "71458a0f-4e09-484c-a2a1-66f2e89671bd", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264742, "uuid": "b50ccda3-3b62-4625-916f-75e8b2458d99", "value": "6144:rGiR0rBkab2rOlB29PoU4n19UvH3PYkhLonvrKDw5TyQ1mALw3psKygX2:CrBkabflBCAt4vH3dhLonvruw551mAG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637264742, "uuid": "3a64d4cc-cc46-40ea-89f7-652641cf2a7a", "value": 343617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637264742, "uuid": "c40f03fe-44cf-4182-aa27-6fe1e2c4adfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264742, "uuid": "26819fad-56cf-45b0-b494-01a9a7ff4930", "value": "db4b2c360a1722043710d3a0ba93eac7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ac47a8-4810-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637199506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637199506, "uuid": "2c334c50-0503-4750-91ec-3349e16e122c", "comment": "Malware payload (Heodo)", "value": "36993cacc1e1c5836b93a013022c395b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637199506, "uuid": "c87457da-480c-45db-9ca8-684845268d9b", "comment": "Malware payload (Heodo)", "value": "57977f12384cfd76d5e331b52bf584eb837ab94697aa75f1fa6c64bd611d958b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637199506, "uuid": "cf6b9a49-9944-45ec-bd5d-f10c6e3ff163", "comment": "Malware payload (Heodo)", "value": "e64f8beb6d88697db6deaf6627eba8e39c0d2a41", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637199506, "uuid": "d55dc9d5-d442-43c4-bb47-b96b392c6a1a", "comment": "Malware payload (Heodo)", "value": "15ba1e07290880a4781206bf1739fdf301a5a2cc9a895c7b2dd56f81ae258ae2cb010bcfdba842f6bf87ffaaf656ccc4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637199506, "uuid": "4d8aaa76-cd4d-4d26-85d1-935ba271af5d", "value": "T13544CF01B280A072D9FF193A85F5C66A4A6C7A500F90D9CF53D80DBE5B765C2B6309EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637199506, "uuid": "c945f934-229f-4011-8b02-d62f48d3e84d", "value": "822ae775303d14fd9c529b33f0deaf77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637199506, "uuid": "6bcafc5d-4aad-4e0f-b9b2-52fa26a38e52", "value": "6144:ndH09uYgR7OJSuwuZc2HEaYTy7beWTBd4m:dHJtlec2HEaYTXWT/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637199506, "uuid": "f214cc98-a9d4-48b8-a1f9-d7dc7edced15", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637199506, "uuid": "058dad3f-f66a-406b-a7e7-ff9689b5b771", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637199506, "uuid": "966ee09e-7f0d-49d3-9e70-b6c589fe8c79", "value": "Yn.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c575378b-483f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637219927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637219927, "uuid": "48097b48-b2fe-4d71-a858-ddfa05e24759", "comment": "Malware payload (AgentTesla)", "value": "cf78d90b27d545d751f47f429c0889d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637219927, "uuid": "de9533fc-3774-4d59-a1b3-156d6336a69c", "comment": "Malware payload (AgentTesla)", "value": "57a87eecac1ab730c09671f602a1a66c76834e1a38bb213f565b9258ab3a42c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637219927, "uuid": "741fb572-3501-4fb7-b09c-1cea13143b00", "comment": "Malware payload (AgentTesla)", "value": "1e0d7532071997fc77ccb1e1eed0048d845add33", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637219927, "uuid": "9ee6c406-d25d-4092-a5be-34e7ac914f88", "comment": "Malware payload (AgentTesla)", "value": "918c224bbd0413358229b5e8f806476c646f303ee1ecca98d5b4c0a055691581e7ace9c1d384a034b6f7f575936f704f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637219927, "uuid": "2aedb815-4b51-48d4-a0dc-e904efc42d49", "value": "T17BF4D02372A062DAC27DB6749D13E57C47A32E94E140F52FFED4BCCB35B93220666582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637219927, "uuid": "a067f3c5-a7e9-4e57-bacb-725c3caac022", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637219927, "uuid": "cb5578e3-2a82-4039-a7bc-b706d7daa633", "value": "12288:t5epN7wzw5VH6O/keqOlF6RNcZ7D8uAvUOL+nzg++++4+++++++0+++++++5:DepiU5V6OsFOlF4qZv4jA8++++4+++++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637219927, "uuid": "abaeb175-99f5-4503-9cd3-b3331a95c018", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637219927, "uuid": "fa9291a8-1128-42e5-ab02-ea43325f53dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637219927, "uuid": "32b4442c-1977-478d-9370-f2b8fc3672bb", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a958c545-48bd-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637273996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637273996, "uuid": "d626629e-cef5-4426-a98a-762cbdbfdc75", "comment": "Malware payload", "value": "ba3474d3b85c6a089bbb3e306bb156ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637273996, "uuid": "9a56defb-e927-486e-b98f-eadbdc2937de", "comment": "Malware payload", "value": "58fc1b89196ad1b901bc3d91e443cc6c73515f56c7d8cd42a03d26395dff957c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637273996, "uuid": "147a0f56-4fcd-42a5-b243-e49d5426bea1", "comment": "Malware payload", "value": "7fe36a9552787c5486a97bea4a2b9e6a91086dd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637273996, "uuid": "f1172c4f-6bc7-43cd-bed2-6ee746afc6fc", "comment": "Malware payload", "value": "389bdd00842579f8b11744940fcb017432678abcce5d8a538f27a1f5ebf242f9c322e27e3d20a664fce3f1e2785c73c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637273996, "uuid": "7c7ce74e-a282-460d-93f9-62a005a6b44c", "value": "T158A4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637273996, "uuid": "52936ac3-3c93-45b4-a77f-cdb3007ce3d8", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637273996, "uuid": "24d6b556-e2d8-4544-ad6c-cc58b5cc7756", "value": "12288:bdv8jkvzqZvv2wLBImTi12yD88kYwZ1h1:b2Zvv2cDTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637273996, "uuid": "9afde99d-f60d-491e-af4f-25a5b73c56ed", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637273996, "uuid": "d06a1253-a605-42b0-aed1-5029e6e5261d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637273996, "uuid": "234f976a-f59c-4684-b04a-f6aa0617a45e", "value": "ba3474d3b85c6a089bbb3e306bb156ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5f9e34-488d-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637253282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637253282, "uuid": "79df88b8-0b9a-4028-8379-ae22f796ab2a", "comment": "Malware payload (Heodo)", "value": "92dea705d8a8db3d9e45742630a6607d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637253282, "uuid": "2cb4910e-5bef-45e7-9bf0-6932b2e8abe0", "comment": "Malware payload (Heodo)", "value": "59200ce63359bee57c622393af80376330874b21505a0bb77e58efe38305001d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637253282, "uuid": "7c9b5869-cbbb-47a6-8aa4-dfb53ef6009b", "comment": "Malware payload (Heodo)", "value": "bbc801a0a4be442677e55cdbb8e95e8d19828431", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637253282, "uuid": "ccdaabc3-d78d-4f5f-8d17-c41ae5e7e008", "comment": "Malware payload (Heodo)", "value": "0270858882c8bf4354df0e69faaec756c6efb964fb98c3d6c67c6bb132435da9e81bac03e2ce7ded035dc2e76fe2c1ef", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637253282, "uuid": "0931684f-2c94-478c-afd3-cdb37e4fbbae", "value": "T1B1A4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637253282, "uuid": "cf1ed673-c574-410b-9d67-a4e102dbaf7c", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637253282, "uuid": "261c9f16-982c-4e9b-92d8-61d4602f053c", "value": "12288:bdv8jkvzqZvv2wLBqmTi12yD88kYwZ1h1:b2Zvv2cdTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637253282, "uuid": "d04fc57e-2f0d-49da-8110-b36e334603a0", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637253282, "uuid": "8ad6a8b5-f87e-448f-a319-affbcb4f9876", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637253282, "uuid": "f67dccd5-400b-4f07-a05a-3de94b13bacd", "value": "1w9i8K6AzWV5RmHTSn8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b884c483-4866-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637236656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637236656, "uuid": "13fc864c-049b-4299-9966-14519bbd9d99", "comment": "Malware payload", "value": "db8f42a798dd65d9bd8398c3e2564f06", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637236656, "uuid": "13885957-d73f-4e3a-9854-ea020790ba8f", "comment": "Malware payload", "value": "59b77f3b8d2e7d72c61d522a2bcabbe0b47be3b73e1a4001cb763589a656134c", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637236656, "uuid": "74a6bf72-125d-4c8e-9a5f-bb8dc7a6d78c", "comment": "Malware payload", "value": "7df618ca8e5e21faf19ece8c2470f62af8e4ea15", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637236656, "uuid": "803fa77d-9c2b-49a5-9e8b-f48714056b88", "comment": "Malware payload", "value": "4f3f0609e97400bbd26d02645a95bd7899601e5386f6cce9614068a4a6bbd0cdbfdb28a9e00d97440da9d48109d7fbd9", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637236656, "uuid": "5e0f2cdf-8a06-4af1-a7f3-23b548e59bbf", "value": "T1102121014BE80716E2758E766C3BB300C731B9666D57DB3D4980D6D82CF0A08F97EA7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637236656, "uuid": "8230f549-aaa9-4b41-9dbc-a0d3453b36de", "value": "24:8gy2WCBYm1LjCylTyAKOex+/Clso0aPilpiAWBpAXD/lusmv:8IxLeyltKnLlsotBqXjlus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637236656, "uuid": "ffe41b99-9888-4c2e-863b-53904287d8d1", "value": 1183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637236656, "uuid": "c1e19484-2c4c-4d99-bb1b-7f62842cc82d", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637236656, "uuid": "834638c0-8893-4a9e-9b60-fd9b92331de4", "value": "Documents.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd3da5b5-48c1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637275801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275801, "uuid": "44d627f8-f6cd-4b6c-9dc5-a1fb641b00fb", "comment": "Malware payload", "value": "6b5cf5bf5cbf2f611f717790a3bb252e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275801, "uuid": "73a2afb0-a611-4087-a588-ba5a53c14417", "comment": "Malware payload", "value": "5d2a59720f23838eb72a6fb2003edea71551e5b02eac8b68be7bc02b67a5c5e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275801, "uuid": "9b35fc77-6009-4801-b4df-54f5a7aefb5a", "comment": "Malware payload", "value": "734070ae052939c946d096a13bc4a78d0265a3a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275801, "uuid": "06463293-2f7e-44c2-8f3c-a016c16b4adb", "comment": "Malware payload", "value": "50eadc5139db614e4d77478d2f80ab45e4bdf8431ac7232daea3ff8d325da68f78dc7bad0733cf939fcfd64f8dc509e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275801, "uuid": "41220d80-1c13-4e64-ae29-ea8b60f13a17", "value": "T174E5CF07FE86DEB2CAC12F79745741B8E6305C5072246126A64DDE3CE7CB9AE8B05BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275801, "uuid": "de77f8f6-c0b0-43fb-ad80-cd27da937868", "value": "49152:PaXpNokiXm7lVAdM/lTCWXE3ZDDiZYH6veT/Ga5QSsLLksi+9N/LN9J1pRbnQ/GZ:PCpLosi+96TiMu9h0LiUM1kKJ7JVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637275801, "uuid": "a2e74554-12e8-41f5-8a22-8737c74eea9d", "value": 3073176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637275801, "uuid": "9bd11c84-f21c-4632-9291-cb2d83bab9a7", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275801, "uuid": "547a125a-1c61-4fc1-9ae4-39cf1458f925", "value": "5d2a59720f23838eb72a6fb2003edea71551e5b02eac8b68be7bc02b67a5c5e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75adb5c4-487a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637245133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245133, "uuid": "7d811304-d8c5-4395-a4b0-0e725af8ba82", "comment": "Malware payload (Formbook)", "value": "bc18a6a568b4055d62b94f34cccdfdfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245133, "uuid": "fd970e34-c0ff-440f-b9c6-480897f3c5a1", "comment": "Malware payload (Formbook)", "value": "5dad6b254fb40bb4c090f5048e07da656821a4b6b163c6548287c3d91dcfda45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245133, "uuid": "26ebe30d-8488-4ea2-b770-929fe647e9ee", "comment": "Malware payload (Formbook)", "value": "a5c11ea0876119ba95d2c63c725d4fdc4f864b71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245133, "uuid": "8684b2ea-82ec-42e5-ad42-7b759cdb2025", "comment": "Malware payload (Formbook)", "value": "390c36192b84f39fe26c9103bf3864889609581536998b947743fc71394ae8b26726d61bd914e0ce8ee22786eb3955d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245133, "uuid": "071d5422-11a6-484c-9763-ce8c9e1b32c5", "value": "T1BBD4226669F70DD9D1160836C2B2412CFFBBE48E4A560D8FDF243D748DBA1C25E87898", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245133, "uuid": "925538ab-677d-4c81-b0a2-995a34c273b1", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245133, "uuid": "e385da36-2e14-4fc8-84c1-26d0f90a4a2d", "value": "12288:7VwFfxeUFaGaNRxOkbAWIBFbouRzxw70E14cepiTmgunGb6D3eu:pwFfxr8Ga1aPbB+0EScepiTmgAGbS3eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637245133, "uuid": "fede9de5-4078-4c46-b26d-f5fd96148bc4", "value": 601286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637245133, "uuid": "9bc9f533-0a72-4a27-81a2-1cb8c9c61d17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245133, "uuid": "eda1a908-50db-43db-a2b0-0fd056752998", "value": "Scan Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ebfee8-4805-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637194958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194958, "uuid": "2996155b-65b9-4c3d-ab64-ccf0b8ff96d5", "comment": "Malware payload (Formbook)", "value": "8a54e567095076c5b2a78d089b7873dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194958, "uuid": "71a9ed7a-1409-4f30-8020-d8a34a72c74c", "comment": "Malware payload (Formbook)", "value": "5e70e5879b9a259a7582be1a72451424bd1ffdabccd7ed8c5455fceec208bee8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194958, "uuid": "806c280d-d9b2-4e07-b2a5-b6d282e6ff5c", "comment": "Malware payload (Formbook)", "value": "713ba0cd791fc951fdf896985eeb46912bce77c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194958, "uuid": "83981921-2392-447d-8e0f-02179c811841", "comment": "Malware payload (Formbook)", "value": "d2b407c9ae13030e427a49e264fa7b5f212420321198f019a3b4e7ee6f84c41b8dc0e10e9d8fd7715e2ddfdcb4356926", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194958, "uuid": "2a44c8a8-350d-4c9d-9f53-944458ad380b", "value": "T17A54228FB7D1D973E064253226F3C79CE7FE51E421E8094B8BC96E99090526E0D397A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194958, "uuid": "b60fddd5-c444-4ddb-8a38-304c345ace87", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194958, "uuid": "c29fc160-d81a-428c-a52b-e4a68d9a556e", "value": "6144:rGi7oL+a0J0vN+6xLyIXYIBXj0g02bCkm8RrIONQQu/Wh8rUCDW73t4L:fC0bcLzXrZ/QQu/W9Ftg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637194958, "uuid": "5ece06cf-d5b7-4289-85fe-1bc36276bc12", "value": 297174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637194958, "uuid": "cede8b0f-f8d3-4b7d-81d2-6f12baf1f3b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194958, "uuid": "60f9ff16-fdbc-4032-aa0d-5e70041d2160", "value": "Factura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13821d3d-484e-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637226071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226071, "uuid": "7a775571-2c5f-4704-8041-80c87ce899a3", "comment": "Malware payload (Loki)", "value": "d217fe27a84b00ccd9cc9da4ef685f24", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226071, "uuid": "dba2eaac-6f56-4035-924b-b018545fb1e4", "comment": "Malware payload (Loki)", "value": "5fba448b5311f57b72305e3cf35200a3287ef967b3c6e687df63d042ded3a407", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226071, "uuid": "162d1040-0de3-45d3-95c9-ff8010dd69b2", "comment": "Malware payload (Loki)", "value": "5cab72d512eb24304845365708561bf073078678", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226071, "uuid": "2f6d9e58-1e52-401b-9b42-2ecc9a9d1164", "comment": "Malware payload (Loki)", "value": "f88aec66cf268a50fd77e52af864d0ac24991c9bc044fa22d25f5a3577d757cc487863155176f9ce01c5510a5a9d08f1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226071, "uuid": "10bd4d6c-ae07-45b1-937f-88e965690fd4", "value": "T10582D6ACC46706A88F859BF82B1B6F81118C7A6DF785D933763463751BE2E7A001393D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226071, "uuid": "51838ca4-48a9-4cea-a40d-b81e86cc5ba9", "value": "384:yi0Cv9xZUVGRlKLxEjiTXrNXTgCEghn6MN1e:yiPv9xZnRGqm7CBMNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226071, "uuid": "d9821dc0-8a0e-4dcc-a8ec-c161eb54580c", "value": 18793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226071, "uuid": "e4e15ccc-e415-4db1-a432-c604525c3398", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226071, "uuid": "3539a447-4a31-4316-af7a-275852cef614", "value": "items.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70773f0-48c1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637275791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275791, "uuid": "1caac0a6-a09a-4608-bf56-69573b10efc4", "comment": "Malware payload", "value": "2833b7480f3920ecf840c802d239b05c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275791, "uuid": "55d3f68b-0c55-41d9-a723-c3a8ce388269", "comment": "Malware payload", "value": "5fff034e2a96d6b868957a1b43042d62107b253d64ac8daca8c1530e59e3df97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275791, "uuid": "be5296aa-540c-4ffb-a21b-da6712e0614c", "comment": "Malware payload", "value": "0e7b90ec564cb3b6ea080be2829b1a593fff009f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275791, "uuid": "7d1c8c43-331c-4bfe-a411-a01938379ae4", "comment": "Malware payload", "value": "4a18e640a4e5145527bd4a3b9ecfeec5fb92869367276d0a7aeded7d6c87802340b675cd9ec5e00c67f083d897a94523", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275791, "uuid": "831cc40d-43ad-4555-a446-d0afc47b97bc", "value": "T1D5E5CF07FE86DEB2CAC12F79745741B8E6305C4072146126A64DDE3CE7CB9AE8B46BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275791, "uuid": "dee40c2b-4628-463a-bca3-eeb08cb8f019", "value": "49152:PgXpNokiXm7lVAdM/lTCWXE3ZDDiZYH6veT/Ga5QSsLLGz/b/LN9J1pR9CZykTav:PQpLLWgJiMu9h0LiUM1kKJ7JVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637275791, "uuid": "c1f74e57-0103-4880-82f2-fc7894c77705", "value": 3073176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637275791, "uuid": "01973e96-89e6-4901-8e18-0d519c2679f3", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275791, "uuid": "79e20979-ac95-4815-8da6-49324de700ce", "value": "5fff034e2a96d6b868957a1b43042d62107b253d64ac8daca8c1530e59e3df97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926a72a4-485e-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637233156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233156, "uuid": "88924658-ec7f-4101-85d7-30af0cf3a88c", "comment": "Malware payload (Heodo)", "value": "2c63373af8e8bdd29dcea781033d0b3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233156, "uuid": "d1592f06-74b5-4507-b5ed-3d593a77ee39", "comment": "Malware payload (Heodo)", "value": "601e49a302205883e903ee7bea4c1ac0bd787ded5118b3127c44c8635f9d6a39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233156, "uuid": "a31589f1-c4a8-429c-a95d-7f48df436608", "comment": "Malware payload (Heodo)", "value": "4c0e73e21a894c5af92dcbefd8f13e8d3195be2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233156, "uuid": "6a1084ae-bb32-4ef8-a88b-c11d57a4133e", "comment": "Malware payload (Heodo)", "value": "a342aa62569b273f15f7120f535176a1cc17542333953f54f179224a934920f12597b2f642d10afe19aa8efb49a60205", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233156, "uuid": "af36c5cb-a01e-4290-91f3-c18c68946510", "value": "T19644BF10B1809032E9BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233156, "uuid": "6d7f8f81-b2e7-4466-a04f-a2830c6b9511", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233156, "uuid": "f6acab8d-b619-4c41-bdb2-88a63605097b", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBB6asb:prf+WPVXNcwUKaWTYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637233156, "uuid": "0dcd1ac6-1cf6-4377-80c5-c6785fd88cb3", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637233156, "uuid": "4adf8a9a-5f6e-444f-8133-8486efc424f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233156, "uuid": "5c997f2b-507e-4ce9-af00-f6be231f6329", "value": "2c63373af8e8bdd29dcea781033d0b3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70bd986f-48a3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637262734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262734, "uuid": "739101fd-4e00-43cb-bf58-58f27d1a6e93", "comment": "Malware payload (AgentTesla)", "value": "2891ce73651d4fb66fe7a0fe9675ab89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262734, "uuid": "7cff82e7-c074-408a-b81f-933c5cda531c", "comment": "Malware payload (AgentTesla)", "value": "60994099031735015b2fc52e6aa68aa83662658569f349ee27428b86c20827c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262734, "uuid": "79e8c84c-1df8-4464-b89e-5a565bfa29f1", "comment": "Malware payload (AgentTesla)", "value": "95c866f7a8f2cf55157e768f9fa9e15021e8294c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262734, "uuid": "01e4311c-3aae-4d59-9266-49e5134fb913", "comment": "Malware payload (AgentTesla)", "value": "480358d8def5cefaf9b1c5c77816ade1de8281437d3572a80a16400ba1359c5c985c1a1ba21c810b3e8bae18f76f7eb6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262734, "uuid": "eeb77c81-4cc7-4081-b2ac-e7ad4c9ed9c2", "value": "T102B4017612588A6BD2F817F89568FB3907729EF1BC65CB186EC178CB3E713400929793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262734, "uuid": "715dcfe9-36f0-4334-9eec-201cd7f02ab5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262734, "uuid": "fa1a6b2b-c962-4f59-8d69-9b3ab8209683", "value": "12288:Ao9ZnWLBsqpUT7cX5K9HpJYLwUpJeHxrzQNlFztQCQGHl9:H9Z4Bs6U/kK9JJwwGAHBUNTzrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637262734, "uuid": "85a5f7f4-3c3e-4fd5-b5ad-db5a626a03a8", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637262734, "uuid": "a378c40d-a17c-48c6-90b6-526f96debbba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262734, "uuid": "6fa88bfd-471a-4072-95c1-4da877caddcd", "value": "DHL Shipment WaybillDoc_TransportLabel_3990350980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2350af-48a2-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637262140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262140, "uuid": "b08468ee-5b44-4fa5-8050-d9f983c516fe", "comment": "Malware payload (RedLineStealer)", "value": "f5af70bd3c8acfd4d38ec166effe649c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262140, "uuid": "c2ede39c-334c-4bb9-8063-109fbac46e87", "comment": "Malware payload (RedLineStealer)", "value": "60daa3e62cd9bf9377fd9a69ca78dfac4a84b0026e38912b690891be85d90edc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262140, "uuid": "f64d9c7e-e7fd-412b-92c6-04ca2d1f8cac", "comment": "Malware payload (RedLineStealer)", "value": "e9b98ab8aa4b592c3381cf665e5837fcbbea106e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262140, "uuid": "c0a54178-f6b1-44cd-9474-84ea9914f785", "comment": "Malware payload (RedLineStealer)", "value": "82ae271a2573c66a5c84925f2e3821d42512973b61dcaa9fba110acb0c41c4cb468a778beaf11bfa7e9ab664861e0ac5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262140, "uuid": "5a7e2053-21ac-4001-b6e7-4120d9c98a17", "value": "T1B9B3196437CC9A14EEFF0F7068B0111443F0E5636492E75F4EC554EA2E62B81BA66AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262140, "uuid": "ef0b2f92-2dcf-41bd-aed8-f259239a2d6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262140, "uuid": "4863a26c-0f00-41be-932c-2fc154888a7a", "value": "3072:rDG7D4w3cXernQM5yJiUgC04Zf3tpI9vTF:U4scXernQmXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637262140, "uuid": "e3a27063-0257-454c-8e57-4b7dfa1a4631", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637262140, "uuid": "2e8a3de8-1d32-453b-ba49-33f34862ff5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262140, "uuid": "d25ffa4c-38e4-4a52-8dfd-2c014bdd1a2e", "value": "f5af70bd3c8acfd4d38ec166effe649c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf140de-483d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637218758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218758, "uuid": "ca7e229d-76a7-4d98-b16e-b0d9602d944b", "comment": "Malware payload (AgentTesla)", "value": "7fee47abaeb8d422b9efa6db5f393a64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218758, "uuid": "e17c838a-de35-4c9f-bd91-75588a931a8e", "comment": "Malware payload (AgentTesla)", "value": "60e1143ac9db8d16630792c7010583fc54f6d61d959ae5cc6ab59bfca6e70d5b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218758, "uuid": "01cf3d72-c2b4-4580-aeda-16ed74ef0f20", "comment": "Malware payload (AgentTesla)", "value": "9694d72c643dd25a1a490fba9438d0d2b8aa132b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218758, "uuid": "5bad1058-dec4-4e46-b0db-43e7e3d9447c", "comment": "Malware payload (AgentTesla)", "value": "452f6a731fc2d8c72d87f5ccae070efe0b8a382ceaeba71852fa7299da535c0cf38b00918bf3ff903ccea6fa00cec6ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218758, "uuid": "8ace6bb8-0287-4d10-bfc7-45c361001d7a", "value": "T111059C85E5609823F63246B86030DABA37B27DD91DF09E8938D43E6736F6293783550F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218758, "uuid": "eab4eef6-9d87-4cc3-b21b-6be190542910", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218758, "uuid": "6d615f64-059e-432b-b3ec-2b02d40dee9a", "value": "12288:VHm31gW77D9Wh5ftVLNLMgIz/hducT/yIg2X6Hdkvt9VjW:dm3KWfBW3pIgIn/i83VjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637218758, "uuid": "9b8be8c0-44f5-4e81-bb5e-274951c30261", "value": 858112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637218758, "uuid": "3bb16ac7-827d-40d3-af6f-400a50dbdf8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218758, "uuid": "ec253d2f-fdf0-4165-baf5-17cf25ac2219", "value": "SecuriteInfo.com.Malware.AI.3244586249.27133.26379", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb50b47-485b-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637231861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231861, "uuid": "08519083-7de5-43f5-88ee-544091d45744", "comment": "Malware payload (Formbook)", "value": "c89fd344d9384b955cc20fef4958e0bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231861, "uuid": "9e3b1213-6b3c-4eb4-867b-174db0dc7ca4", "comment": "Malware payload (Formbook)", "value": "60ff626adc6a02e50f060f456b0b7f8a11577e923624b3fa8c009d758892439b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231861, "uuid": "f0cfb62e-6898-41cc-a79c-f6e0d3006ad6", "comment": "Malware payload (Formbook)", "value": "e7c13eb4c30a69d907957d8d2d1513dc64d0090d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231861, "uuid": "95d1bdc9-282a-4e2b-ba07-faae700f539e", "comment": "Malware payload (Formbook)", "value": "ed4063925d79b16c52fe84f15fca31c2ffd123b12cc3061a5d8a4abaa046eaae91a52ba5b0cc0924582ad504f613cc90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231861, "uuid": "ea74a977-c32d-4239-bb76-8066910e31f3", "value": "T125D4D09039B8C817E77084BAD6B0C3BA8A70B56C1DE6C6427CDE2ACF76587747C59312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231861, "uuid": "7f65aded-1217-42fc-86b7-f50478071f8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231861, "uuid": "063d091e-6a6f-442a-a59b-8d93854a9f04", "value": "12288:2gMldm31gW7SDDMdDV+Bep8/qwfnQWdKDW8r1amdi9cCzuZSq:FMXm3KWG/7BepqQWma9CCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637231861, "uuid": "dcc601c6-56a3-4177-b0ab-b741ed5306bc", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637231861, "uuid": "ef9e4cb0-bf06-4d81-9a3d-eb152fdc7090", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231861, "uuid": "3ed0b919-34c0-4b5c-bc08-c7ad83a1e5c4", "value": "c89fd344d9384b955cc20fef4958e0bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2fbf0f2-48ca-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637279569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279569, "uuid": "f7c4537f-9e50-46f7-a9b2-212b09b06ee3", "comment": "Malware payload", "value": "ae5017480fc46fea5f5b35e684be8639", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279569, "uuid": "b9fc8265-6eba-403a-aea1-4872e2e682f7", "comment": "Malware payload", "value": "610f8e0834645e2bf2a47c9d7f8cff5e902bef45750f3c2d1ad84bea66b681ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279569, "uuid": "1d600b7f-e83c-4470-81cd-f1db1d855ebb", "comment": "Malware payload", "value": "b5f7941d2b2be6fc1ee9a95a214a39404661b2bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279569, "uuid": "07393718-3c11-47f9-8301-3e1d5cb60bf1", "comment": "Malware payload", "value": "7eeaefa315018dc0ce2c2bd4b489be85398053e3d2cc02e31afb3d9ff60cc6d0532bf4ee6b08aa92a9d0bbd76e8511e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279569, "uuid": "84d804d6-6a7d-40a5-9e91-220b8190f05e", "value": "T10AA4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279569, "uuid": "5ad32b90-974a-4cb7-9dfb-43971ef7d8d3", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279569, "uuid": "c7b4387a-d741-4fa8-8604-40fdedc6c877", "value": "12288:bdv8jkvzqZvv2wLBSmTi12yD88kYwZ1h1:b2Zvv2cVTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637279569, "uuid": "da6b535b-1208-42c4-bd02-089f8afb0396", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637279569, "uuid": "bf4a2f54-6f35-432b-84c4-f2719234722b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279569, "uuid": "9a0f7fd4-4d5e-455d-aef9-40463e6f7008", "value": "ae5017480fc46fea5f5b35e684be8639", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05994f87-484f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637226477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226477, "uuid": "678b5e91-e0a9-4ea7-bbdb-22bf0a6b38a5", "comment": "Malware payload (Formbook)", "value": "7538ed7c2b55153aed824acb03808684", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226477, "uuid": "34547627-f6cf-4787-a5d1-d225f6f14d50", "comment": "Malware payload (Formbook)", "value": "61c371fb64642ab532475b9ce0510223995d943188470bd0dfd8ae4cee635744", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226477, "uuid": "e20121eb-0907-4bb1-8f67-f54600bb9c47", "comment": "Malware payload (Formbook)", "value": "ac25de0388d40fae8583e8fac9607803f98c2d1a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226477, "uuid": "7e428ff6-325b-4eff-8c55-0ca30e516aad", "comment": "Malware payload (Formbook)", "value": "2395da8209b5da8364e45b08f66847c49a351ce19e3f9cec0df388ecb53a6476acf101b11f1e9f03e21de69b3f5d7d62", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226477, "uuid": "d3b0a506-4626-41d7-b9f9-042e5f5eae0b", "value": "T16C411EE729846180A7426F777C1F7892C09A98792C4DC683E01DF0C43E34B1D9EE6AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226477, "uuid": "699e7123-1c68-429a-a651-33f15889d3cf", "value": "48:1bXMOSYAAGuxfxNp/yO5A603GzCus7eY7:Onsp/yqA603GzCus7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226477, "uuid": "eb024115-ddcb-4ef5-a791-63e151e06be4", "value": 1933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226477, "uuid": "b483ef6c-a99b-4411-8926-643740e72b38", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226477, "uuid": "72572e1b-103e-423e-a699-cd9590edbcac", "value": "Quotation-D048-211106004.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f2b21a-4804-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637194638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194638, "uuid": "b06a43a0-595e-4817-820d-f24b9ac6b989", "comment": "Malware payload", "value": "1978f242101424ad0307c3f088da9113", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194638, "uuid": "a8640ed2-af57-49ea-b6b1-5d024b232582", "comment": "Malware payload", "value": "61e00423cf49a6bc2c39bede7adb6f1e710f38f31e2f47de1d1d8cfa7d40ce02", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194638, "uuid": "461220da-4e92-4f30-9c1c-b2959afe86b0", "comment": "Malware payload", "value": "cb0abc0e80fab5627ebe287f02a2c06886765242", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194638, "uuid": "a3591785-27f0-4b9c-8018-170af2470c40", "comment": "Malware payload", "value": "ed07554f3a528b45a635739d5ff6ff5461624b0147ffc932055964f7dd701321e0e386f6e1b5f30f4cbc665a2a231746", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194638, "uuid": "e04de5e0-a85c-4ccc-8a11-569e479a96e6", "value": "T1AFF312A3A7918F6ECCCF027786077853792BBDA431C6678A91323362E7352D4E1875D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194638, "uuid": "9c95fdc4-43b2-4cba-98e3-201d33ae970f", "value": "3072:Jci+o9rhcU08m8/7wqhaUNVOeRwXgHUj3rC0Pn8NXoeGznlNlHNxmdBqpBs:H+o0UTBMqhRNPwQq3xPCGzlNh6qXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637194638, "uuid": "e88357ee-7025-4ff3-b10b-e333f6d89de7", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637194638, "uuid": "5d42161a-18ed-4265-8d5f-4700fd1cce96", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194638, "uuid": "c17480dc-14a6-48aa-8f10-345563185f67", "value": "61e00423cf49a6bc2c39bede7adb6f1e710f38f31e2f47de1d1d8cfa7d40ce02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf037fe4-48ad-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637267161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267161, "uuid": "d5d1d1fc-3e20-4dd2-8b92-fd265cf97e5b", "comment": "Malware payload (Mirai)", "value": "a8f9fdbf00d5b4ca08dffdfa64d614fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267161, "uuid": "139e27b0-34e0-44cc-b702-e5b63ae0aa3d", "comment": "Malware payload (Mirai)", "value": "61e7c86678b0ba59e14fb060a9f320dd3e7404227fe2d2a52c42f5a501fbb3f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267161, "uuid": "84f60997-6837-40e7-879d-daeadf17d508", "comment": "Malware payload (Mirai)", "value": "3e796ecf32d1ca0a1a9fd1f577d68a790d1b8023", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267161, "uuid": "2a4ea1bc-c555-4ec4-8890-360d23d6ef0b", "comment": "Malware payload (Mirai)", "value": "09721cbd911bd0378df91697573b857e74b253189af11f3671a73a52f9c5dea7562dfaba54eda2a6fdadb7a05b9d2849", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267161, "uuid": "d355f107-f559-4490-b132-a556569c83ea", "value": "T1BE63960A3E218FBEFBAC863847B74A219658339626F1C5C5E15CEE015E7034E745FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267161, "uuid": "d9918b6c-2ecc-43d8-8362-eb065a64afda", "value": "1536:j9NLNxDu9H/hpVBi6yO4W0vK0pErAnGzUNPKkifV:xNL/Dw7jv4W0CEELINPKkCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637267161, "uuid": "90676f47-0345-4bd1-b381-38600ad10cc8", "value": 69416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637267161, "uuid": "6540d8a8-ccff-4838-a6d2-5b7e6d5a1645", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267161, "uuid": "0b612c1e-5096-405f-b374-3b459645cad9", "value": "a8f9fdbf00d5b4ca08dffdfa64d614fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea64c15b-48c1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637275824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275824, "uuid": "d4d66bff-ac1f-409a-92ba-f61eb075ce9d", "comment": "Malware payload", "value": "2f9e31877fe6911ac70b26f935144adc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275824, "uuid": "41ba80d0-e65d-45f8-80b2-6028f23ae1cd", "comment": "Malware payload", "value": "623f99cbe20af8b79cbfea7f485d47d3462d927153d24cac4745d7043c15619a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275824, "uuid": "5b07f3e7-9681-4e3c-be62-38cf09b5f1d1", "comment": "Malware payload", "value": "b2f0dae9f5b4f9d62b73d24f1f52dcb6d66d2f52", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275824, "uuid": "619ca3a9-c6e2-4eee-96dd-4e7124e51e7d", "comment": "Malware payload", "value": "de79cf413bacfb4c9ee0b17966db28d00f7e8b2235a569bb9423d18e5fc1f146ac1474f94a3c34e951a2b0c451c9f8fa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275824, "uuid": "dc2316c7-881e-4851-b1f6-b80f2d0b2e4e", "value": "T1D9D5A8379368F489E087C0749BCA83F1D61074791A7622AFBB61DB232EB1DDDA654703", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275824, "uuid": "444fb8cc-71ae-4f1f-bfbf-f864f8360cd1", "value": "49152:8+s1mTu2/+UnaxX3rbryk8agTMj7yOWqQZ4Dv8/sEyCYXg1+o1bFGqv9:Ns1mTuTUnahHlgTl+QbFGqv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637275824, "uuid": "270e4244-dc08-460b-8145-8a6e73b768f4", "value": 2816772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637275824, "uuid": "cc361f66-801e-42ff-9a73-e25d84d6a56b", "value": "application/x-mach-binary", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275824, "uuid": "57820096-576a-4d49-ad60-af8b3053da01", "value": "623f99cbe20af8b79cbfea7f485d47d3462d927153d24cac4745d7043c15619a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378e9e11-48bc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637273376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637273376, "uuid": "507b25c0-b7c7-4565-a9a9-a389a3edaab4", "comment": "Malware payload", "value": "4978b38de0382854a3f40cf292cbdd55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637273376, "uuid": "33445c5f-3e72-47de-ab89-1e4bf1aa1186", "comment": "Malware payload", "value": "6252c570ccbcf1341c947d28497ceb7f176fff9a90edbb32a4ceeb5045c27f8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637273376, "uuid": "ad97e93a-99c9-41f7-8d9c-2ebd18578d99", "comment": "Malware payload", "value": "2952d5d748b3191f10cbf2566edf2990adca8b0c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637273376, "uuid": "9ede9c03-e0d5-4ed0-b195-c8d8a2e780f6", "comment": "Malware payload", "value": "863035f1ae29d81f89c51bf8f2849d4391509d4fc32c93166d5b08079f7405036a60a2865fb5706342845562be3b960b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637273376, "uuid": "af9e1d84-b32e-4b3e-b4f1-47bd2ef3bb39", "value": "T184A4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637273376, "uuid": "8c6939be-85d2-4b41-91fb-48a82d200369", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637273376, "uuid": "f34f19bc-0b35-4bd9-b050-d04a00709ae2", "value": "12288:bdv8jkvzqZvv2wLBemTi12yD88kYwZ1h1:b2Zvv2cZTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637273376, "uuid": "c4b72f41-26e6-403d-8d26-593f300d1f17", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637273376, "uuid": "e468949f-cbb9-491f-88ac-f399348f2412", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637273376, "uuid": "ace5fd42-f00f-49fe-9e30-58ff5f68ada8", "value": "4978b38de0382854a3f40cf292cbdd55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac71fad-4851-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637227398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227398, "uuid": "aa093ed1-2e4d-41ab-a41b-8852db26159d", "comment": "Malware payload (AgentTesla)", "value": "f18372f2f003424d79436f8eb7a70799", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227398, "uuid": "ee9979e4-a1b3-4da2-946c-2e6f5be550fc", "comment": "Malware payload (AgentTesla)", "value": "62a4a9e63074fb5a0215b254df0a857f3c0eeeac2944e8c7700851ec0f7f3a80", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227398, "uuid": "cf91dfe8-883a-4bb4-ad99-ed7b386a2878", "comment": "Malware payload (AgentTesla)", "value": "210284f6bf15d5afb5bc297807b7a202b418b5f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227398, "uuid": "51cf0b87-c59a-4162-9559-431c320cf067", "comment": "Malware payload (AgentTesla)", "value": "d21efaa963017e15a3a8738186d2d1aa1881a7139f5549fbc30666cd82a184b6c75c68cd411dcf43cf8c00640269bb6b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227398, "uuid": "61567573-740e-4402-a36e-3b4ce5f965be", "value": "T1C5E4E0D036B8C813E77085BAD6B0D2BA4A70B16D0CE6CB467DDE2ADF76583647C58312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227398, "uuid": "2e2559f0-82d0-4543-be47-04cd2506f558", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227398, "uuid": "f2b202f7-48a4-4eb0-984b-dbf4c0d0245b", "value": "12288:zGzm31gW7NngGXSA4saYRQYBNQ4mR3FyRO0fOIeIw:zGzm3KW86RQkQH3FoOIe/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637227398, "uuid": "5785c8df-ec11-4265-bded-02e9da49c92a", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637227398, "uuid": "f5a668e4-21b4-4f29-ab03-ed7fdf838759", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227398, "uuid": "41d6f200-1fe0-497e-bde1-426c3d1e2615", "value": "New order - C.S.I No. 0987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92214de2-48ae-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637267515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267515, "uuid": "560405cc-244d-45b1-8561-f705096eb0e5", "comment": "Malware payload (Mirai)", "value": "b4218aac1c3994fd61ac6666ff9b3019", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267515, "uuid": "91dce62a-d3fd-46b0-9adf-c932097c1783", "comment": "Malware payload (Mirai)", "value": "632e2831b3c45f905048a8b2695e76ebb4a91a0d53f2419a0737f0d4f5ad36fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267515, "uuid": "b27d34e9-ff7d-4ecc-8c8c-804a94580450", "comment": "Malware payload (Mirai)", "value": "5274a0aa761aa550320d6e8cdb6b6289ca6a02de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267515, "uuid": "26e7296d-0e2b-4b59-bc8b-270cf7973184", "comment": "Malware payload (Mirai)", "value": "bb157dc0dc02b84e6d0b55318a1270c848855b02a92f0068b865bea58326cb7c4561a58967855ed962095d269b73a368", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267515, "uuid": "f94fe9d5-2bcf-4230-a62b-6acc84f2c759", "value": "T177234BC0A682F9F5EC11457C307BA7729E37F436A03AEDDFD7D9A423A841602920729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267515, "uuid": "c3f19101-9a06-49a3-aafb-42f5892d376e", "value": "1536:Ovmt6GStZRjrMcPzOubNm1poPYdIYfQ5Igomv4au:O5GS1HMcPCuh4oPII7iavju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637267515, "uuid": "d9dff05f-9e6f-4f3f-96c9-49d7a42b11a3", "value": 49852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637267515, "uuid": "5faeaee5-63b7-4611-8de0-e4125b637a91", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267515, "uuid": "4214c6ef-8173-4ccd-9a13-cbba484b3825", "value": "b4218aac1c3994fd61ac6666ff9b3019", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85801cee-48ae-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637267494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267494, "uuid": "d5b69577-91f6-4aa8-b4db-a40d871f0c71", "comment": "Malware payload (Mirai)", "value": "7babab7abd06d3b41f93a720dfe36427", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267494, "uuid": "4960c5fa-7ea0-4ce9-96d1-5026f99c5f19", "comment": "Malware payload (Mirai)", "value": "6367ff4d98e78e22efdeee64b3f42c546bcdde4dbd22b60e3ba7c3c870252ee9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267494, "uuid": "f0bb60af-3e4f-46f7-bc47-3838b1e80d3a", "comment": "Malware payload (Mirai)", "value": "3ccf4dbf18784aba2df86f976419f32d0f557001", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267494, "uuid": "f3782e28-9583-484d-b2f2-45f546a4e029", "comment": "Malware payload (Mirai)", "value": "d9c618b84e3c50a3cdb2c1240b93cfc49fa530f20e02c88b705381456d4f275146415550ad4a88e6fc341d8b5ce6aea6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267494, "uuid": "f35ccf2a-791a-46f9-8f61-0a9ec7425fc9", "value": "T1CD432925AD792E26C0D8B57E11F7C724F2E2620E25B8C65E3C721E4EEF0474065537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267494, "uuid": "2ad4d19c-c56e-4391-98ba-d52940a1f035", "value": "768:eLobAxU6q9Hfymp0xginSYKCLUB6WsTwR11IQdszoDaS0O+DCDZ:eL0AxvSHfymp0xgujKCLs6vTAIau6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637267494, "uuid": "57331bf6-d1e0-4722-bb4a-41d42a63e94b", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637267494, "uuid": "65fca80b-5e4b-421b-8394-3c3b6dee9055", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267494, "uuid": "6210e0b4-aa40-41b1-b9cc-5edfb3092df8", "value": "7babab7abd06d3b41f93a720dfe36427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f998aca8-484e-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1637226457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226457, "uuid": "1b3a0b4f-b8fd-4546-8265-be81c530b492", "comment": "Malware payload (Vjw0rm)", "value": "caf1e58d620579e5f59d417e4789e1ce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226457, "uuid": "f7e199ad-af13-4d2a-a4c0-d628e88ddffe", "comment": "Malware payload (Vjw0rm)", "value": "637ca3b5f21107e17940951fe9ce666789ab834dc1be0d25193f5c706b55d528", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226457, "uuid": "74cc2150-e1b8-4dc9-849a-415602651e33", "comment": "Malware payload (Vjw0rm)", "value": "f15572cdaf3bbf43e6b578631644213749f0ee18", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226457, "uuid": "fd934612-8e9b-4f45-8fdf-a904d5e55326", "comment": "Malware payload (Vjw0rm)", "value": "a2ed9ffa776aa17e440dd2c02a6a0ed56308cd1873dc01c886ece3b10719ca1584b1b146a12991c7c7b59ce8d016f395", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226457, "uuid": "1488f02f-fc29-4a8f-b19d-26143bba1a5c", "value": "T106B2AED8BDA5BA009781399541FADF0D1BFC8246BD25C10E3143F2C0A127ADD911FB9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226457, "uuid": "fc2f27ad-6bf3-4deb-af39-7addc859a6be", "value": "384:eyMk55KjYOiaX9gU5QcoaKnUc+pPNdHn5Azt5dwIApW04BE3DZmNhq9:eFk56iPuo9nuPNRnSMIA4yKg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226457, "uuid": "790d3213-01db-4f96-a64a-dc197e32ed05", "value": 23610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226457, "uuid": "125cc573-7c98-42f1-b630-a1f5ec0fb84e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226457, "uuid": "eb287d82-c2bf-479f-a7f5-7c36c7522118", "value": "Request For Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b78ded-48a2-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637262156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262156, "uuid": "f9255e37-814d-4fb5-8333-21409f2e3b5b", "comment": "Malware payload (Formbook)", "value": "29021284714de995a09931f1bb3819a6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262156, "uuid": "d92b7d39-7946-478e-94a1-9ebb9e54607b", "comment": "Malware payload (Formbook)", "value": "6431123c8350d26e97889aede974847d2ee647f2257a97b515589f4c1fa260f8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262156, "uuid": "cfddcc9d-edd8-490e-9c8e-e77ba715ea53", "comment": "Malware payload (Formbook)", "value": "6dd4c4d8f572d0186b8e618e673b19577b7debd3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262156, "uuid": "87448138-b9d2-4f5c-ba9a-1f7a5f7d8f96", "comment": "Malware payload (Formbook)", "value": "c374944c2e0efb48eda0a79cf5aaac74829aef6726486183a1472f9d0e9c7350641742baf0b7c01034dcbd12dad3753e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262156, "uuid": "b8bbe039-96f8-41fb-a16f-ffb7258ab7e0", "value": "T1BC92B6ADE1530698CF81A7B8271B9F45018C796EF3C8A53375B8A73027D2D7A8512D7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262156, "uuid": "3bbc8551-2edb-405b-8416-5d202909148b", "value": "384:OeRRC8wtGcwWyqh+ojy4Uv+SuOw5fuYA3GVTIO82+WI7DBX9BiJNUvRuN:vVwqWth+p4UGSuP5BVTI93b0NIRS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637262156, "uuid": "b764dfc6-5f2c-4aa7-ba51-95b3d0226db8", "value": 19361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637262156, "uuid": "cb8b0288-1054-4c6e-81da-5f950c071573", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262156, "uuid": "91041349-66a4-4070-a0f9-4161118c9fc6", "value": "PO 18112021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e69d21-48bd-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637274017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637274017, "uuid": "5c3dc7a4-8396-42c6-a8ac-ba0296e26221", "comment": "Malware payload", "value": "c057f72365f5c81f338723d29663d93b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637274017, "uuid": "d0bd91ea-30d8-471c-b972-886c1715f0f5", "comment": "Malware payload", "value": "6470451c598023887479c1c3552dd2d97c38f932ab54e53b94dfb78eb3de2edd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637274017, "uuid": "79e0b8d0-32b5-4b95-8e40-8555e530556c", "comment": "Malware payload", "value": "efba7b97b4d24e0bd5c3f594f78425bb0fbe65bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637274017, "uuid": "a203e484-cfc1-4062-a569-fdb1270a115c", "comment": "Malware payload", "value": "5f6b1b9a2bc89f880032427bea37cb1f52ded58f61b142b60a0e73ab2635fc70d6465ec8dc0fcee0503a5259e7ea7578", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637274017, "uuid": "09a38e13-bbfa-446c-9f74-503bbc21e94d", "value": "T101A4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637274017, "uuid": "1934d26f-1162-441b-97cd-db3469ea36e8", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637274017, "uuid": "e859e98f-dbd8-4fb4-90ad-1033b783b48f", "value": "12288:bdv8jkvzqZvv2wLB/mTi12yD88kYwZ1h1:b2Zvv2cuTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637274017, "uuid": "ee408fb0-1b97-4a2d-a2a2-49dfa4b089c9", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637274017, "uuid": "b35e8450-adc4-402e-aed5-ec134a4bc65a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637274017, "uuid": "4e42642c-58ba-45f2-a578-342ff3805034", "value": "c057f72365f5c81f338723d29663d93b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef11e104-4843-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637221715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221715, "uuid": "5d6593d5-9f12-4ac3-b3e3-e911aad658b9", "comment": "Malware payload", "value": "7f24dac93e740d50fa8e628857c51518", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221715, "uuid": "be59ef3f-f80b-4fb8-84cd-777e28d33a1b", "comment": "Malware payload", "value": "64855010b86e5776a9f7fdbd05cd95d71458f528523d9f7762cb4ddc600c7d0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221715, "uuid": "18797c45-292f-46ae-8383-1f3478bd4b70", "comment": "Malware payload", "value": "f9386964beff988ac02a004bedf2f311409f996e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221715, "uuid": "d8719644-5177-4838-9dd3-c6f282e9fc00", "comment": "Malware payload", "value": "457c1e232ba0dbb2d7c0ed142724130fe964918948e816730207f975007e12ebd09e7766dc1b903b5ab76ca1c50fe8c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221715, "uuid": "0215dd5a-d312-4c5f-b0db-7094450bbd28", "value": "T11FB5338473A690769CB7624A1A85A43E39F57BE8F17DCE474CD003C2454B228BE1DBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221715, "uuid": "efb3bf04-3448-4e8e-aed2-429c1b5541ee", "value": "49152:q1XHxnnkot7KjX0aKgxC2Iqy7/W5u5+OYyhV5TQdqBHFRX9KBnxIffVu:q13V3a0rqRIZ+wrvNoGRtKzIVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637221715, "uuid": "9c9bd2ee-97df-4f30-8ca0-d8d4d845d44f", "value": 2347008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637221715, "uuid": "3d60410e-3184-4340-87f2-98c3f216f9da", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221715, "uuid": "147da85e-9b45-4189-84f6-4de3ddd47cd7", "value": "64855010b86e5776a9f7fdbd05cd95d71458f528523d9f7762cb4ddc600c7d0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05d95657-487f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637247093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247093, "uuid": "9082c03c-aeb1-47f7-8541-5c75964b8527", "comment": "Malware payload (Formbook)", "value": "15ed74b1ca855d35a336689cbf2936df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247093, "uuid": "efb29a12-892c-41a3-817c-859d54619571", "comment": "Malware payload (Formbook)", "value": "652385ecfc8acbe450ec14e301e3f4067cd1e2da0d5675c589c393949febc58a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247093, "uuid": "22b99b8a-a099-4fee-ae73-c1b6da5c1376", "comment": "Malware payload (Formbook)", "value": "15319e8da91e64ff1a01d89f28c3b91bec92ab0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247093, "uuid": "0a94aec8-7fbd-41b8-a474-53a66b89d906", "comment": "Malware payload (Formbook)", "value": "f8587d051cf6ad56f37434f234d6a2e842dc35d1676c1e13fc64f96f830ddce284bc8a14a0f6dfd512158f35b7ac9039", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247093, "uuid": "103cdd28-e178-4050-8c74-f574b8a8053e", "value": "T16AC4C0553EECCB12E0A66EFCB760D1895B70F112123FFB5A6E9059DA14F87A309052B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247093, "uuid": "58cd3c33-afd1-4fc1-972c-2dd60c03d008", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247093, "uuid": "4474aa37-7849-4893-bb69-b6348faf6014", "value": "12288:3QZ3AcJzzi3i7mDYhB/7340D0Bp9wqlAiS+7k:gZ3Aeacjb6BwkzD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637247093, "uuid": "8679bafb-18f8-4471-af9a-0897ce18c9bb", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637247093, "uuid": "0fdeed40-ca1f-417d-834a-607c3173f5fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247093, "uuid": "f4bebb47-1eaf-425d-a8ac-f53d9e89b14b", "value": "Purchase Order no.202201EYL-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07bffe5d-4803-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637193839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193839, "uuid": "129e2383-3196-4b82-ba76-0f2f59c222df", "comment": "Malware payload (Heodo)", "value": "55d5180ed1bdb07332ec7147428cbde8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193839, "uuid": "39f67dee-7e59-49a4-a0db-dfafc6565827", "comment": "Malware payload (Heodo)", "value": "65a9f3dbead1dd1572a017406edc9508d55a97f987002b6a627ee69020e9412f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193839, "uuid": "25fee513-f1f0-497e-8b22-0bb8908012b6", "comment": "Malware payload (Heodo)", "value": "6ec4c3a9ffabcccd95effc64ec19d1e361269318", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193839, "uuid": "25d62843-8d5f-41a8-9cf1-0421106a1a4a", "comment": "Malware payload (Heodo)", "value": "ad5b6a8a8897d0b1777a303c8e22a286f383fdf73b6b91a21842ba76145404cd354079103b158a1fb82b3ddd7a2adae2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193839, "uuid": "6be54d85-5107-466f-a49f-43607291eebd", "value": "T1D944CF01B280A072D9FF193A85F5C66A4A6C7A500F90D9CF53D80DBE5B765C2B6309EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193839, "uuid": "519997e4-4b32-4289-b86d-f759b207268b", "value": "822ae775303d14fd9c529b33f0deaf77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193839, "uuid": "14a03bf6-b78f-4e80-9fba-d5a6e18c1861", "value": "6144:ndH09uYgR7OJSuwuZc2HEaYTy7beWTBdBm:dHJtlec2HEaYTXWT/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193839, "uuid": "3f1f0376-42d6-4419-b9ee-2a7d8417f18b", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193839, "uuid": "a3d18323-54f3-437c-b311-2f871cbc2cba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193839, "uuid": "7c26fe1a-c8f9-445a-acac-0bc235afca8b", "value": "55d5180ed1bdb07332ec7147428cbde8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6bcb166-48bd-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637273992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637273992, "uuid": "571d91fd-c772-4435-a6a5-a9f274bd036b", "comment": "Malware payload", "value": "d929f1c0b2ef9c1d0b4e26d247067de6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637273992, "uuid": "384b49d6-93e0-4a41-a0cc-c42fa5f91ffc", "comment": "Malware payload", "value": "663f3bb023d959cab066a7a92deff929073da207404177ba8d6df45043c9a139", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637273992, "uuid": "9f84b996-a69c-4e7c-ae09-da49d82e6675", "comment": "Malware payload", "value": "4310ddb52862ad850d9c0a462d8508d7ab3b85c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637273992, "uuid": "fd3d879e-bc25-4cea-8714-55d72f6711c4", "comment": "Malware payload", "value": "7835f2771b012198ee020fbb92a80325f50ea766eb09f1d6b6de5078c2a13fa45f428406b851d1636673ff0bfefba2f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637273992, "uuid": "05bbc948-3052-4f4d-a295-b1a9c2f7202f", "value": "T1C7A4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637273992, "uuid": "fbaa85c3-016d-4690-b6ee-45daafc4888f", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637273992, "uuid": "29f7c8d6-d57e-4fa4-a766-a0033129895b", "value": "12288:bdv8jkvzqZvv2wLBAmTi12yD88kYwZ1h1:b2Zvv2cLTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637273992, "uuid": "32979b33-a815-4024-ada8-d6f4ea116ccc", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637273992, "uuid": "286a830e-f4e8-4d17-92d6-1eae7fe8d31e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637273992, "uuid": "fe1555d5-1366-41a0-8a57-11992464cd00", "value": "d929f1c0b2ef9c1d0b4e26d247067de6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba1a4c7-48ac-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1637266752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266752, "uuid": "153e3bb2-60a1-4d53-8c87-c9285ca5104a", "comment": "Malware payload (CoinMiner)", "value": "5a1678b4826594606b867e5248b6048b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266752, "uuid": "dbbc8aff-931b-4204-a970-998ca6e8d880", "comment": "Malware payload (CoinMiner)", "value": "66b7920243197d2711568e498e3d74ee1da6611cf108e4542f3dee5040ed8fd8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266752, "uuid": "e67160b4-99db-4ef1-87d0-494b21b98ff9", "comment": "Malware payload (CoinMiner)", "value": "ad40d20e5b8f39f7796a13b1733f6721fe35e067", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266752, "uuid": "cd82104c-7f21-4dd0-84f6-59f26818fdef", "comment": "Malware payload (CoinMiner)", "value": "1e80b7031c14286b62e9879f3aa6500013683e804b399d09a317c3bc1fc1f9dd657a03b10c4dc897ee65a82c23b567c3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266752, "uuid": "ac171170-c1d8-4db2-86ad-330ad52b7fbf", "value": "T1122633C17703A26AC47816BE04EC756CA7B78B5C2A7B7A22B6C4099D6F119473B4CCCD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266752, "uuid": "4eff31e6-bb2d-4640-b961-61ec8935b686", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266752, "uuid": "639bfd65-5b38-4d49-8680-e01ff8f29cf8", "value": "98304:ZQ03yZy03aKkX1Ypa32dWBYAGOrdPbRfS5p1KTvPD72/78bh:ZQ03yZy03q1FvN83iXJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637266752, "uuid": "b698506e-cd0f-495a-8e37-8e7eb48af3c1", "value": 4464640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637266752, "uuid": "d0799e37-2464-49fc-98ea-78faae2b6a88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266752, "uuid": "0c732e4f-f677-4beb-91df-c8383192f36e", "value": "MultiWZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898a67c8-4860-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637234000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234000, "uuid": "fe0e18fc-1e22-4744-8d09-dedb9e3917c9", "comment": "Malware payload (Heodo)", "value": "54f642e2c56db53a35f00606ee96487e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234000, "uuid": "d9f01789-354d-44fd-a739-24c104ef153d", "comment": "Malware payload (Heodo)", "value": "688d4033139158dc68ac3835ff5013cf8ae240d685b2c8a3caeb2d18c85feb9b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234000, "uuid": "5b52944e-9448-4aa0-b9c0-e4c37b1c11de", "comment": "Malware payload (Heodo)", "value": "f33751c95d9c7ebccf64da5fafc6783d9181df90", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234000, "uuid": "bed38338-3bef-483e-93eb-6a4e4a7fbc75", "comment": "Malware payload (Heodo)", "value": "9e22cc8a65a5821eaf68fccff48af4966351ca1fac630d1edb31bebbba54a26422b13ae1c21a120729ce85bc6f349fb0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234000, "uuid": "a89fe615-02d4-43c7-962a-938826c12f78", "value": "T15ED4D0112843606FEC9C153C049977BD8FED6B55C2F4E8A7CF80E9E4AAC5CC185B6A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234000, "uuid": "893770d6-3934-4082-9961-f19b6d4b8555", "value": "9147e5ab6cd2dcc785393175990a85b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234000, "uuid": "e0f1800b-50ce-4c82-824d-04ba83a7e742", "value": "12288:uOyVoxITHISr3VYRJ0QvcaqNqMWMeWXm6QrXmZ5Y0sp4:ZkVYPZ9169Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637234000, "uuid": "68512605-311b-41a1-a7b0-4eba65d5bbf2", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637234000, "uuid": "d4034f6a-f9e4-4861-a71a-05e992405bb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234000, "uuid": "2d0823c0-fce3-4170-a4f9-3fc7d3376588", "value": "emotet_exe_e5_688d4033139158dc68ac3835ff5013cf8ae240d685b2c8a3caeb2d18c85feb9b_2021-11-18__111315.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34edc210-48b6-11ec-843c-42010a9c0014", "comment": "Malware payload (Pony)", "timestamp": 1637270795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637270795, "uuid": "d520c245-5c2b-4b83-b17b-65d93e64585c", "comment": "Malware payload (Pony)", "value": "15028e6210c0aef82b0ccf3f7e984fab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637270795, "uuid": "6e41e4db-1232-4a14-bf27-44130d7f0f3e", "comment": "Malware payload (Pony)", "value": "68f714680172a69fa5b4efa968aaa59d46f49a1bea7c8b6f768c8b1a1cfb116d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637270795, "uuid": "4e7dbd53-d180-4937-8bc8-4c2b1be9b8be", "comment": "Malware payload (Pony)", "value": "a027c72a983927fa0f70a0b834842a67ea45dc98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637270795, "uuid": "e53a9c6f-c5a8-49be-ab4b-9f76bd0b4a74", "comment": "Malware payload (Pony)", "value": "726331f69b33461f0ce369d19100e0ea79074e1548f7c786489fb2f323ca9074544f1e6fa24d5ac790d81258cbeeeaab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637270795, "uuid": "45a3a28a-b610-4580-894f-2c9aa4726cab", "value": "T1FD83C011FEB4EEA0D6C58AB29473C6653E137C39C7464E033608376E1D36BD29D82399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637270795, "uuid": "e206e76e-8e48-472b-85d4-606d6a16a5fa", "value": "2c1eda7245bcddbabeb6e3c921e0e876", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637270795, "uuid": "4769b5b7-7639-4d6f-b034-fb94d8cc5b49", "value": "1536:XBLvp9vsJpQ82i9aUHSkx2MauBJn+e1mVsZ4gqC1oDuzBnq:9vxsS621uBJn+e4VvC4uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637270795, "uuid": "b8f7cb9e-92be-418c-a164-57706baf80ed", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637270795, "uuid": "36db3d7c-9b09-48d9-bb09-424c1e6e6302", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637270795, "uuid": "32d12385-df95-40b3-87cf-549220f0ec80", "value": "68F714680172A69FA5B4EFA968AAA59D46F49A1BEA7C8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce07268-4805-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637194733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194733, "uuid": "42874d50-fd01-4ade-bb7d-756f88ed2204", "comment": "Malware payload (Heodo)", "value": "9cf653b2858fce459ed82e2af93e37c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194733, "uuid": "85917cd3-b679-437b-95fb-6f4a16d03dbf", "comment": "Malware payload (Heodo)", "value": "690ba25e16ec0ed5ca01874a97f85622b8541ba43d9e4ef8272988f2f74014ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194733, "uuid": "99e6ed4c-a2ad-437c-b427-9f6d54a4721e", "comment": "Malware payload (Heodo)", "value": "b848c278857adec7c5193ef4fa96cb07142ac5f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194733, "uuid": "05a11f85-7973-4e54-8e52-1e4aadeb1327", "comment": "Malware payload (Heodo)", "value": "31a6f241443850616f11969f311c4ac40d25b2f128706f793b590ad9474956e6090cf147cad7e16f9368520fa6ecd47e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194733, "uuid": "9aadff5c-45bf-48a2-a7b4-bbc84c233550", "value": "T19C44CF01B280A072D9FF193A85F5C66A4A6C7A500F90D9CF53D80DBE5B765C2B6309EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194733, "uuid": "3b85d627-e1df-4258-8540-edd9c183c7d5", "value": "822ae775303d14fd9c529b33f0deaf77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194733, "uuid": "6a4117ee-1631-4eef-8f7e-205b0b62ab76", "value": "6144:ndH09uYgR7OJSuwuZc2HEaYTy7beWTBdJm:dHJtlec2HEaYTXWT/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637194733, "uuid": "afe75d22-fc6a-4653-b061-00eedccfbb6b", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637194733, "uuid": "6175fb1a-887e-45c4-9724-210dbd4fe72c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194733, "uuid": "2f9b03f2-f1b4-457c-bced-472d46a17f91", "value": "9cf653b2858fce459ed82e2af93e37c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa471168-487a-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637245356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "41acec3e-5008-44fe-8007-2b3ee69bf77b", "comment": "Malware payload (Heodo)", "value": "98ac8e012a40767269cb983d242b9553", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "ef54b324-dd66-4964-a71d-526c2e9eaf55", "comment": "Malware payload (Heodo)", "value": "69349c94c819029c9f6e265d42d210e13573a9412eb37907e95acd4a467d1203", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "2e04eb82-cf55-4abf-bb01-e8c8f9979bd3", "comment": "Malware payload (Heodo)", "value": "d7985c369ced1bff7dd34e8d009cd219d8339d51", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "74b0a66e-3d22-49c1-a128-0ad229d9847d", "comment": "Malware payload (Heodo)", "value": "8863f47a2d30816d2f748ac03f65ab3726cb841e99ff9d4fbd293496c47dd670c5f909cd582712baea8b6ec7ee12d141", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "c2177ed2-1d79-4788-b8b4-d29b4431a31d", "value": "T183A4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "57812ef6-56ba-4835-860e-02d17e61e521", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "cd7bccf9-e51e-48fa-82aa-63e0604f5949", "value": "12288:bdv8jkvzqZvv2wLBwmTi12yD88kYwZ1h1:b2Zvv2cbTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637245356, "uuid": "301b2741-b423-4828-a422-c101459b956d", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637245356, "uuid": "9cd240af-10b1-4877-8255-dcb0f2fe890f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "4cfcda47-be70-453e-8c62-f6359a54ceb2", "value": "emotet_exe_e5_69349c94c819029c9f6e265d42d210e13573a9412eb37907e95acd4a467d1203_2021-11-18__142229.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2271970a-4805-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637194743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194743, "uuid": "ff8620bd-3b44-4a0d-9535-2568bed58e02", "comment": "Malware payload (Heodo)", "value": "5e6b17d35d2e0e8ab1f6280aca882777", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194743, "uuid": "fb6eee30-71cc-4b93-a544-d61f55608fdc", "comment": "Malware payload (Heodo)", "value": "6bb09175483f33f93120573304b698ebfb93ea4a1cfa19f116faf214e720c3e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194743, "uuid": "3a46feec-e16d-4e7b-a338-695d98da762a", "comment": "Malware payload (Heodo)", "value": "e65d08b72ba69d8314e3e0403176372436b4421c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194743, "uuid": "9f817644-ec33-463a-bc46-c15165cf5bf0", "comment": "Malware payload (Heodo)", "value": "f2f1ba4ed7aee3d370c906cf44dbbe6c1bce673bb6eded1f2c3c09acf258caca9a7117bd956e6c294d1a38751173c50f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194743, "uuid": "2f0d898c-4abf-404c-898f-6c1335e6a477", "value": "T14344BF10B1809032E8BE593645FAC56A4A7D7A600B94DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194743, "uuid": "137435cb-61ca-4b67-9edb-1e49452c1d84", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194743, "uuid": "86583023-0edd-4992-b2c5-d7e034681fb0", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTB46asb:prf+WPVXNcwUKaWTpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637194743, "uuid": "b6201e18-fda3-4138-8f09-e5a7b4495bdd", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637194743, "uuid": "51c35057-0b94-43d1-9c1e-9844cad9045b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194743, "uuid": "6c8742f7-6bde-4b12-bef6-33320db26cfe", "value": "5e6b17d35d2e0e8ab1f6280aca882777", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b5e9ce-4844-11ec-843c-42010a9c0014", "comment": "Malware payload (XpertRAT)", "timestamp": 1637222134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637222134, "uuid": "f6e9ac13-07f6-43e7-ab44-2824d354d87b", "comment": "Malware payload (XpertRAT)", "value": "485c081a0d8a94c07aa77a78fd1199c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637222134, "uuid": "fcf2a76f-1119-4beb-9b3c-079edf1fcf75", "comment": "Malware payload (XpertRAT)", "value": "6bf55bc421fadfd6e0ffc426390796b1a9dc4afd1e53ec9b36395951f0f539eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637222134, "uuid": "8356dc99-408f-4490-a9a6-db93298c69a9", "comment": "Malware payload (XpertRAT)", "value": "f3b561862b76833f1f4d4fbc816634a4ef062fec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637222134, "uuid": "38a223a7-ed5a-4ab3-824d-b0fec12d73fc", "comment": "Malware payload (XpertRAT)", "value": "cb7ba7eebe6b62ffe80cf2eeb6f0b82c29d8633957dd76565beec40e37ab1bdb26f64c6e1b90c933af6fa0122f6fae3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637222134, "uuid": "ca6eb7e5-d8e3-4f07-8b6f-135fcb14f961", "value": "T1FED4E0A03AB8C413E77045BAD9B0D3BE4A70B12D1DD6C6027CEE6ADF7A587647C58312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637222134, "uuid": "2b14bc82-a269-4320-8f42-389a6a67a339", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637222134, "uuid": "5227249a-24a8-4f92-8320-283c74393725", "value": "12288:wdgm31gW7H2FH551orANwbCl5skF8099+WqH1wi:wdgm3KWi7HorAObC7skB99+Wy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637222134, "uuid": "4431556c-bde7-4812-85d8-a98536fa510b", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637222134, "uuid": "5a817b17-b1e8-4ef4-a12b-b377bef8e341", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637222134, "uuid": "2b77509e-d619-490f-bfc7-c574d73c0f88", "value": "PO#601863490599600.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ce1a23-48a4-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1637263037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263037, "uuid": "4bbd0f0f-1edb-49e6-a71c-73c53328e09e", "comment": "Malware payload (njrat)", "value": "69cb30fd3d94cfcc7c89a1f41a47d8dd", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263037, "uuid": "1e2bfc74-aac4-464a-875d-fc2fced8f419", "comment": "Malware payload (njrat)", "value": "6cb5a93eec2726f651d8a61a9e865d46a93324992d9a2467edb6b83b64789985", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263037, "uuid": "134a90d7-89e2-42f9-bbaf-21e48e73868c", "comment": "Malware payload (njrat)", "value": "5cc7c867d8b5238fa7ad4718c5ba5d105e72cd22", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263037, "uuid": "414b0d6d-52b7-4ef4-9a86-6233d5e19633", "comment": "Malware payload (njrat)", "value": "02a8cdf6eca98e79ee020acba8caf13ab15c91336458ae0858f46efeed5373b7eb51b38897be76d6a5b9d6a500541dd9", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263037, "uuid": "fdba66ae-ac22-4fba-9f5c-86a297ae57f8", "value": "T1F8417B38FD1BBB824821F57661E78CD5CEEC1017DB843C3C21120C7849918BD6AAC0BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263037, "uuid": "b15ade44-77f4-485b-80de-c19cd25e42f9", "value": "24:JVkNGJYuIoviVLF5FFOY9NFMffNAVPvyJCCKaV7A9F0ZTFkFo9bFQZpFOyoQeFiT:bXgHpUf+VPaEqnIoTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637263037, "uuid": "9de135bc-e4a1-4b7f-8b9e-36b6be04553a", "value": 2283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637263037, "uuid": "4b662d73-1cbd-4c74-a445-744a4e9e1137", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263037, "uuid": "8985c790-2498-4ae0-a9b2-c8439f41c458", "value": "J3m1a_Payment_Copy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951e03a9-485b-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637231872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231872, "uuid": "1d4cffec-6329-4b4a-93e7-ce2641985bc0", "comment": "Malware payload (Heodo)", "value": "2cf93d421da213897aa8f2de104e5317", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231872, "uuid": "d36f7ce8-7674-443d-ba2a-aad341bc4cd7", "comment": "Malware payload (Heodo)", "value": "6e66eeb466b0f5ca73b2893a32c697d130ebd05cc6e68ef1404dc84279106b97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231872, "uuid": "746f0064-4a63-4e64-8554-aadbee9fe789", "comment": "Malware payload (Heodo)", "value": "45e3ec9724bbb8b9d31f5a92bff265588556ec79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231872, "uuid": "59b902ae-0afe-4b5c-9115-9dc9f19852f2", "comment": "Malware payload (Heodo)", "value": "384ebb74552f2f2ea0622bb7adb08c101b3c6cfc53c8e9123d8fa6f9ba2a69215d4b5618c237085a969374adc6c474dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231872, "uuid": "35b8a030-33a7-4253-bcb8-4688fa19d4d2", "value": "T1E844BF10B1809032E9BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231872, "uuid": "ec4ef8f5-c1f6-4714-b2f2-724f333d24fe", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231872, "uuid": "bb8a7ac1-da5d-4aa5-9c67-84925ded2ed9", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBf6asb:prf+WPVXNcwUKaWTOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637231872, "uuid": "8bf0d14a-08ac-4713-9bc6-400c0af303e1", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637231872, "uuid": "834b8df7-98e6-4d47-8106-e4a42444a637", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231872, "uuid": "a7802bd4-c97c-4730-b87e-c194961a4ae0", "value": "2cf93d421da213897aa8f2de104e5317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda07fa4-482d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637212210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637212210, "uuid": "7d2a5863-16f7-4fe9-9ae5-333946538310", "comment": "Malware payload (Mirai)", "value": "c0bf3aae7a84b7e68c1455f192f01f1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637212210, "uuid": "8959aadf-39da-42b5-8b75-f50181133abf", "comment": "Malware payload (Mirai)", "value": "6ef388ffcb0fcda9b658e33bcb3938b09c23851d563133343c6c8f59b43cc320", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637212210, "uuid": "76f98d41-1630-47bd-a7d5-8b773af3fadb", "comment": "Malware payload (Mirai)", "value": "61fab65e3ebbac307c616528b6d9eaf6870cc4ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637212210, "uuid": "de197210-8f45-4e11-b258-3c30023bcee7", "comment": "Malware payload (Mirai)", "value": "ba71c40b47739d07c93aaae1f9b883b624b3010bd35d9a1fdfef0908eb34292e7ee13d3e20c62a48a42cb81932deb1a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637212210, "uuid": "79406eb0-c193-4a80-92c8-f6ec43f6e28a", "value": "T1CC130158F4EA5504CC3C4137275F750999F1E91AA10DCBB35BC8235E8DDAB982E18790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637212210, "uuid": "ed4a185c-774b-4c88-9c3c-ca100b1e65b2", "value": "768:twZIsD6QtJXYx24BYilNiSIOovVFn54CDBNbyMXqP0fG0trZnbcuyD7UHQRjU:twZIseQtJIN6ilNVEFPBNJXy0e0trZnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637212210, "uuid": "c33c6124-0cd0-460f-af12-0ebcf4ae9aa7", "value": 44068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637212210, "uuid": "93964311-17d8-4d21-8071-ede5c6e29b48", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637212210, "uuid": "7b5e09df-e9e1-4e87-9779-d0db85edc13c", "value": "c0bf3aae7a84b7e68c1455f192f01f1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262709c8-4883-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637248865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637248865, "uuid": "cc425229-1a9e-4908-981b-996dca3c0bb3", "comment": "Malware payload (Dridex)", "value": "628c229a4afad6595d427aea6808708f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637248865, "uuid": "824e6b84-26d1-46ac-832f-229b678c7ed7", "comment": "Malware payload (Dridex)", "value": "6f2cb590bad8c42912576399c30686ffe95d28aee7adc9d0507335bb3d7e5824", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637248865, "uuid": "aac3f946-6705-4af6-824d-184c0bf9a7a4", "comment": "Malware payload (Dridex)", "value": "7a150becf3399ab4065e618fe0c567944f530b9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637248865, "uuid": "be87b578-750e-402a-a29c-75c61a9987e9", "comment": "Malware payload (Dridex)", "value": "f76b4ca72956c470d6af29c7ccc0c297be57713581668fd2577e849168f11ad9d65c3354f7a3a83a19ff99d967c8e4df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637248865, "uuid": "2b2753e5-17be-422d-834a-5a44a27d8d98", "value": "T107E48E0250D512FCFA898ABF155A67C1C6B310824ED1CB9E25CD07EADF64A03EE6D1B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637248865, "uuid": "84f1a961-7a85-48b2-afd7-d8f24641f738", "value": "fe16443ce39f2fcea9c5accdb27a9eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637248865, "uuid": "32ffeada-51d1-43da-9963-a53bceaea7da", "value": "12288:3VTlJzJzJBJZn/JH3lJxJLJZJdPgA1VKBUA1rlldwJw:3VJtpDv/lVbdT3IA1wBUA1rlldwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637248865, "uuid": "2b51c2a9-b59b-49ed-acad-ad0b59ca4437", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637248865, "uuid": "e4f78c16-eb93-49b5-90cc-3d52ce364204", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637248865, "uuid": "435aa015-08d8-4358-922b-f05ed48584ab", "value": "628c229a4afad6595d427aea6808708f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad1b0d8-481a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637203803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637203803, "uuid": "4e76cca0-6bf8-47bd-b680-e1c9f0deddd3", "comment": "Malware payload (Mirai)", "value": "67153785d5f6fd3d3a4b36ad1aea537d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637203803, "uuid": "0aee1648-3eea-46a5-a5bf-07fd8c5c46e0", "comment": "Malware payload (Mirai)", "value": "6f6b6d2dee59549e3f08c9d86fe90805d7741ac311428fd4ff8aa564d4fbb4ef", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637203803, "uuid": "4258eeec-2cc0-4a29-a582-f60fef5e43c2", "comment": "Malware payload (Mirai)", "value": "483fdd7bf50f7b84c17e039fb4ce1373dec5547d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637203803, "uuid": "9e8edbd5-1ec1-4172-b83e-e75aa49e8c72", "comment": "Malware payload (Mirai)", "value": "c274a35719ce457d2cb45104cf1c536f1ed14862e62580ee6f9bf88718bdaa63d468578e6a9171404333074a4d9525ef", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637203803, "uuid": "ed55958d-cfef-491d-9863-9d1af874baa0", "value": "T170D3D848EA50971DC6E272FEFF8D418E33271FA8B3FA342589317B5523E5BA61635120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637203803, "uuid": "0a6b4cc8-65bd-49f2-9d93-8f11adda269a", "value": "3072:/0WwQyMEho1aZTE+SGlMNS51PbXINCcm:8WKo1aZTE+SHN+bXHcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637203803, "uuid": "9af49a65-c3ca-4110-987f-83b5322f8e4c", "value": 136060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637203803, "uuid": "f9b2fae3-00d3-49b0-b1d6-70f5d20a1497", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637203803, "uuid": "b73a92c8-2903-4874-9a91-7e3d97c14b91", "value": "p4cka7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428c2120-4841-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637220566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637220566, "uuid": "2e772fd6-1d9b-49f0-b4d8-7b2e5ca20c9a", "comment": "Malware payload (AgentTesla)", "value": "4d5ee491764b95b8987ab37deb5f690c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637220566, "uuid": "1ecf78f6-a76f-4e46-87da-47b8ab5719b6", "comment": "Malware payload (AgentTesla)", "value": "71d098331f7bbaadc37926545d24533b920b971cee9f38dccb2668f2a1c1064e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637220566, "uuid": "d16812b4-4bbe-4ae1-ab29-87262a10e28e", "comment": "Malware payload (AgentTesla)", "value": "ac3e5d50e7164437fbabe8f6725bfa80d3b4fa8a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637220566, "uuid": "2010d295-6efa-4c94-99b7-2fb362f0b2e3", "comment": "Malware payload (AgentTesla)", "value": "82893ab4744b264fb1a2f7106b41c7e122c7aa8257069bfced60e9af4a565bb6a11bb29c1916f947a09ff890ded665ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637220566, "uuid": "4b29c960-8bce-43ba-9cc9-f765e1dfc697", "value": "T15C94CEB2538B69DEDCB4F4758366B5ED95F81EC7C02D2C9236E4297B37608300ED5AA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637220566, "uuid": "ec2edd3a-7137-4b36-b3ed-9fbf3413b600", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637220566, "uuid": "3095aaa8-c069-489b-9ec1-12ffa4bbe40f", "value": "12288:8+AzB9bNHUBAi+md5p6Z8+4GwEPA2UTc1Z3n:8+cZno86+RIin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637220566, "uuid": "3fff95c3-0026-4d89-b7e8-e331a1d79fba", "value": 425535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637220566, "uuid": "7d60b54d-7f21-4490-a188-2143e29f0f4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637220566, "uuid": "20b290b2-36f7-498e-b15c-4ced185a8a34", "value": "invoice US$ 74,100.50.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf1a2ac-487c-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1637246058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246058, "uuid": "35724f65-45d3-4e29-94ce-892796b39f1e", "comment": "Malware payload (AveMariaRAT)", "value": "58967f4ac9daf3c9c793f2ca3e971532", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246058, "uuid": "587f1cde-ef34-4e13-964d-e83440663892", "comment": "Malware payload (AveMariaRAT)", "value": "71f1357b11f35eef18854a9a7c33b65ce665b2b150ae5dd79aeaefc2691e9849", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246058, "uuid": "a28986d8-a1ad-45ed-a269-fd4478bf646f", "comment": "Malware payload (AveMariaRAT)", "value": "cb7a55328a2aea39f53a3111b541a944a7205a8d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246058, "uuid": "60d6fec4-889d-4814-94a5-bebb3dbf2200", "comment": "Malware payload (AveMariaRAT)", "value": "3d470f4c1c46aa8cf19e0e0b95ea145ca4cdce283e15dcd8607400e0cc286a3a23bc0ed5af4b6f3cc3740b73af433d87", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246058, "uuid": "478db52b-23ea-4d7a-babc-c647a8cc6828", "value": "T1AA358D2372D0D837C1A72D38A95F87F494297E6038A49947B6E97DCCAA395443C393CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246058, "uuid": "56544b12-c38d-4bc0-9589-9e36a90ed3b5", "value": "9932ed6ef0f007ba412ff7a0ba590c83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246058, "uuid": "3e497d2f-1ddd-4312-bd68-3adba6d4fc3b", "value": "24576:IAysw0SxuOso3abg4gGJaysrP/mJXgESvLq9:IAySo3vGJaysrP/mJXg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637246058, "uuid": "6047f042-56b6-4e06-b513-15f570572802", "value": 1112576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637246058, "uuid": "1020336e-a12d-4ee1-90b4-8e657951969f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246058, "uuid": "5da75f28-b7ea-4713-b7bf-6c18927e291c", "value": "Scan_IMG-SWIFT_103_SKMBT2021-11-18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f788cc0-4863-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637235110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637235110, "uuid": "2ba82632-309c-42f2-86b7-84b9faa0e86d", "comment": "Malware payload", "value": "35558a813f553d1ae9c8185e8f2b3b38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637235110, "uuid": "87e23adf-5206-4e34-86ce-ea8e17139ae1", "comment": "Malware payload", "value": "7212dd968ce2504f6835fb5cdcc868f9315ba35ce8f4e1162fc6fe339271a27b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637235110, "uuid": "ef373867-3acb-40b5-9805-b6c4828b3768", "comment": "Malware payload", "value": "23a9c540a0846d58791a3cc747e6c06a6881b63e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637235110, "uuid": "16c9f0df-b0e3-411c-960a-52182fd186eb", "comment": "Malware payload", "value": "08e3589962d0cf9f2650e08495e74204d6a1266b879246063447b187cc4e5925cec0b911b19d352087dce18d8241b3d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637235110, "uuid": "1f7437b4-ab0b-4567-a670-d1f7a2d49fbf", "value": "T1CB159E10E571197EC02B2E3E9C0BD5BC24B23F1128645C769BD96D499FB6A41333BAE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637235110, "uuid": "6775cca9-3799-44a4-b256-a75d89ee1e88", "value": "cdc6f052222d370bedbc119eddedf065", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637235110, "uuid": "6561fa4c-9beb-48b7-bd73-f4b7019e18fa", "value": "12288:cQBs30G4jiT/OoBVSqRIJS+od3xPzeH/JK/bZ:cos4bMSqOJS9SHhk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637235110, "uuid": "93e56b33-79e8-4be9-b8ea-70e36b93cea3", "value": 900608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637235110, "uuid": "d343eb8e-ff15-45d3-af78-3c4242dee544", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637235110, "uuid": "c4866cf9-d807-4ad0-9ee3-3ea3565ab504", "value": "35558a813f553d1ae9c8185e8f2b3b38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb15bd92-481a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637204126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637204126, "uuid": "2918519c-0f15-405f-a8f1-68578ea220a3", "comment": "Malware payload (AgentTesla)", "value": "5daf04bda9ff387f6d21c334c58a866f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637204126, "uuid": "6b804951-e245-4847-9e86-943ad44a08fe", "comment": "Malware payload (AgentTesla)", "value": "7646f318ea4a1625cb2e7ed06aa9d0da7bf869e8412f9bacda48055084247aa1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637204126, "uuid": "007d1a94-a699-4621-a83b-81db96fbb046", "comment": "Malware payload (AgentTesla)", "value": "2992734d265e470dbf6ef609bde4874895392518", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637204126, "uuid": "157d2987-013a-499b-a7dd-217adac8ddec", "comment": "Malware payload (AgentTesla)", "value": "19e1fe34447c0180fafd4b0c2ecda0a26a5cbf0c4979412d710c52cdd1b40c3811f876c927b5b6cfde2f06f7173b255e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637204126, "uuid": "9df565d0-c8bf-4778-aa72-3eccb36fe47c", "value": "T1E9F4AE5822E49E6FD0AE037CE0A90514C3F5E1116647F76F1FE0A1B82CB77A2CD856A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637204126, "uuid": "5fa4d975-6b5b-4f26-b628-81672b22bd86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637204126, "uuid": "445947e4-590f-41a2-a819-621ba81ea368", "value": "12288:URWzQhIzOI4qVzKDrSg0SK7TFH4e2qvCXDIuItMKlgh0Zq6HRUZ8z1i:vViDrSg0j7TFH4eFvCX0MOq6HRUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637204126, "uuid": "d2976cfd-432b-4208-8a3b-765fed7ed1cb", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637204126, "uuid": "9200255a-21fb-4fb4-9e37-af03109d5d65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637204126, "uuid": "7a381635-c803-4bb3-bc75-ffbfbf47d9f9", "value": "5daf04bda9ff387f6d21c334c58a866f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe013e0-486d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637239594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239594, "uuid": "67bf08ff-caea-4751-9c32-07c0457da065", "comment": "Malware payload (Formbook)", "value": "f8ec9ff402803832d5d92ceb0e00c133", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239594, "uuid": "7b95d1a3-9df2-4861-aa07-76b91e66f3e6", "comment": "Malware payload (Formbook)", "value": "76a186dadd691748e577dd75d5d5b9531f4168138e5d95edbb563acfe9da44d7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239594, "uuid": "a6c9dff0-7516-4149-9d62-f46df7f1e7d1", "comment": "Malware payload (Formbook)", "value": "88350fe7dcf539056560ac4d9434f236048894b8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239594, "uuid": "a3b5217d-5fdc-4d91-b0a7-ad76ae1a2cb5", "comment": "Malware payload (Formbook)", "value": "59a0c6717df3eab2f6c861f64166f1ca67c00abb989794b8ae7b35d365f1dcee192a5a51ff504d611f87572f660bcc1c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239594, "uuid": "18b3d77d-01b0-41dc-9db3-4dc1a019e33b", "value": "T197A2337EF58B0E499E97D668060ABBA5065DF01D73C840E637BCDB38791D8178B22D38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239594, "uuid": "475a2f19-6383-4ed2-945b-b07d764635fa", "value": "384:L/yhtOUaxaXjrKQyW1w/EIhtJxa+DCcz5qwaMoe3oPnsjg0kICnnXgrNMZyqj:LGTOQy78IhtJxaqCA5Roe8nsU0n+g5M9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637239594, "uuid": "500ab22c-c49d-47cc-8170-ead5fd8d3bd9", "value": 22776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637239594, "uuid": "8635ce6d-5aef-4f87-b3c6-5a7588761a79", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239594, "uuid": "3d90430c-3a1a-4a4d-ae68-8e1165ca7a6f", "value": "f8ec9ff402803832d5d92ceb0e00c133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba389ac-484b-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1637224984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637224984, "uuid": "c2b0ce46-7018-4053-a6d8-98c22861fb5d", "comment": "Malware payload (AveMariaRAT)", "value": "3c404c5fb1bf9e38c5957bc70d9ed639", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637224984, "uuid": "6c3235fc-8a14-4b6c-8a5b-c64e4c492a8d", "comment": "Malware payload (AveMariaRAT)", "value": "76ceef7be46c25df80ae843d2cc44448b271cef900aaea02af33e17404fc45c8", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637224984, "uuid": "e8b46e83-e0cc-4917-bb15-9d5b709e7464", "comment": "Malware payload (AveMariaRAT)", "value": "b789fc0c9c8620b726875bbe476d8e3b5aa3db9a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637224984, "uuid": "fb29e09c-8d4c-4b6e-8a31-d07d73fb1782", "comment": "Malware payload (AveMariaRAT)", "value": "32e3db8fa932755c476c4db2935e52177288625400300c09bd6b0fa20e4b83adb9a3cd586e00f0ecdebffa43d2d3fc8c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637224984, "uuid": "2c00992c-2fa8-480d-ba5c-27985b04af0e", "value": "T19AB4CF9036B8C493E77082F9E5B0D7BA4AB0716D0DD1C6427CDE6ADF7619760BC18293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637224984, "uuid": "3163ae78-e9a9-4021-95a9-4b2d415ced5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637224984, "uuid": "1b4ad8a4-048f-4a78-9b24-d170f1e21541", "value": "12288:NWm31gW7asdc/M5FclJeOcBmGLsb/hyDVebA:0m3KWvHycDsb/hyDVeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637224984, "uuid": "4824f422-7e51-4d20-9524-c56b1804d759", "value": 535552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637224984, "uuid": "88d70fa5-8b30-4814-8296-1e6f0ce55720", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637224984, "uuid": "443e1529-abee-4a32-a68f-f2a42024e166", "value": "3c404c5fb1bf9e38c5957bc70d9ed639.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f673c227-4859-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1637231176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231176, "uuid": "b898320e-fff8-4bd8-b895-6d6e91f108a4", "comment": "Malware payload (njrat)", "value": "cefcec10fb7d1486efb2d732d4cbcf0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231176, "uuid": "e51b086f-ec4b-4437-94fa-ea81781f8f36", "comment": "Malware payload (njrat)", "value": "772ca61d127be3c8992d2537bca4e0df6f77b68718d086cb4eef28fb7c6412b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231176, "uuid": "18d2f021-53a3-4913-8417-a5014b6eb296", "comment": "Malware payload (njrat)", "value": "2718cd30bc7b99d95367649ed0597ea3b3dbc128", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231176, "uuid": "576e8d0e-c53e-4baf-bc1a-7e0cccef3f13", "comment": "Malware payload (njrat)", "value": "c3dfb0b9bd434fecfcf57fccc231520b01b5147bacd9095cedc955d266091cf129cefe3b23d35300ed1c553219d6afa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231176, "uuid": "e98a90b3-e3cc-4a7f-b0e8-59978e10f08c", "value": "T1D4032A4D7FE18568C5FD057706B2D41207BAE04F6E23D91E8EE664DA37636C08B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231176, "uuid": "2e2e4586-0284-48b8-a17c-c2a9657dca0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231176, "uuid": "b37fe03b-f673-4623-8345-3b5bbf884b95", "value": "384:VLpZTj6ic1ri5Z7JAyk/24+PRhZe6KlArAF+rMRTyN/0L+EcoinblneHQM3epzXr:tpLHJ7k/24+7ZrK2rM+rMRa8NuZpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637231176, "uuid": "059dd333-4d77-475d-99fa-f968d5571b05", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637231176, "uuid": "3fd347ec-d9d1-4434-8150-e2b8960d0558", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231176, "uuid": "07c613d8-a683-414a-ac51-a9fd397d3f29", "value": "772CA61D127BE3C8992D2537BCA4E0DF6F77B68718D08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f1f6e6-4838-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637216841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637216841, "uuid": "de7adcb9-4242-4e20-ac68-fc37d569e326", "comment": "Malware payload (AgentTesla)", "value": "1be7fcf593899804218db4e1853554bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637216841, "uuid": "019f509e-5336-4a14-9d89-5ad514540e37", "comment": "Malware payload (AgentTesla)", "value": "77508660aad5f0b1bc7ec022ad6ae9437a5d9c611c9544981e26df740c6f64f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637216841, "uuid": "2444ae7b-4aea-4deb-94f2-4b1db75e4a4d", "comment": "Malware payload (AgentTesla)", "value": "5bc4842d693040bce12ee06d4c9fb5964ca41de1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637216841, "uuid": "1f216072-7ce7-4cba-9bd7-0cdd3d934f9b", "comment": "Malware payload (AgentTesla)", "value": "b519b292fe1a2a4202bf471b3c1e0c0380626b668964f240f94295b8b40249fb9e86b6067d486e2657ca082839196f18", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637216841, "uuid": "1951c9fb-0989-4184-afd5-2a5ef3b9b361", "value": "T16B055ABA325176DFC96BCD76CA682C64EFA07877431BC203942705AD9A8D997CF101F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637216841, "uuid": "bb3e2065-04f6-48eb-b173-8f1ceb19a1ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637216841, "uuid": "ca2c2ffe-edf8-4920-9276-43a83fde6bb3", "value": "12288:xd2tzsLxy5VoJqJFTPdCmWyMdXXfTw9LKBmnG1xuTu3UCcbdVsTT+EG9YVDReU3j:T2zky54q0mWyMdbmLKBJL3TcbTAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637216841, "uuid": "4b9960d9-a78d-4256-a6ad-8b4064ef1d2a", "value": 862720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637216841, "uuid": "ed9a9979-6bb0-4e12-a4a7-8d5f85454c5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637216841, "uuid": "bb8bdafd-d033-4a35-ac86-35abd0a9702e", "value": "ORGANIZITION PROFILE AND INVESTORS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0968cb24-484f-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1637226483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226483, "uuid": "f55632d9-841e-4168-bb41-32a3ff1aa10c", "comment": "Malware payload (Vjw0rm)", "value": "622a127bd3198958678997e6e1137371", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226483, "uuid": "6d7c44d5-5a8f-481f-9e7a-9275320daa14", "comment": "Malware payload (Vjw0rm)", "value": "780a511ced1ca91d5c3412556432c51e82211ff88e789ccedbaa06a248459c19", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226483, "uuid": "16436b82-1c30-4a96-91cd-4f101cd63387", "comment": "Malware payload (Vjw0rm)", "value": "ad0651e1ade3a74d69e1bf048d8fed72ecedeb33", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226483, "uuid": "8f675742-3a7c-4163-b03c-794917db5298", "comment": "Malware payload (Vjw0rm)", "value": "96f195038dd85035d0dc273b1f84b454c1d5252e1a65f86d227cb402fba1f6923dc3c078b5a4ed540c39b2f8f8188473", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226483, "uuid": "2048702d-eb03-4893-8395-fd6707eda2c3", "value": "T11181109C284BC63C53D23B8A802ED148CDF548B47E28D2B6148DDAC5360ED7987B59BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226483, "uuid": "bdf9ca51-abb4-4411-bb38-b7c2ee20f743", "value": "96:SABNo5DRk2c24ZRMHXE6/BIr+Ys+fJ/l+5DdQqR7bJyKhVOS4UK:zSa2c24ZRMlBI6Ys+fJd+VfRfSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226483, "uuid": "7aa91d8c-270a-4ff6-820f-a3ee0c65f1d6", "value": 3885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226483, "uuid": "add1376e-aa60-4b4f-a9bf-29d8095b097b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226483, "uuid": "dc9529cd-4c21-4fde-8d62-7010689a7944", "value": "Enquiry.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c5f0ad-487f-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1637247410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247410, "uuid": "1ef4f6de-f197-46e6-9846-c91fb5b8718f", "comment": "Malware payload (Vjw0rm)", "value": "6d4a3b384063526d3db581640141592d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247410, "uuid": "c9802f69-bf46-46ad-a744-1f9547214cc7", "comment": "Malware payload (Vjw0rm)", "value": "79d19fef3bb8d0bdcea5bb260dd8ef143c7d39e26fb99b734af8c630a5fd5dc4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247410, "uuid": "cee06771-8333-4584-a19d-f86a443c709b", "comment": "Malware payload (Vjw0rm)", "value": "771da1ff9b3445d89631c6699da9e17a48f017ff", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247410, "uuid": "04e625cf-b3a6-4b00-a486-4f1e7d4eaf07", "comment": "Malware payload (Vjw0rm)", "value": "82e21abf685acd3d910d641f237bc81ca69175310f581ef2b582332b0b7c9cf50d5256f68cb0472e90f97c3bbbce200d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247410, "uuid": "9b6cb3bc-c36e-4516-85b7-a1d95a8c8250", "value": "T15AA28ED9BE82BE195390611191AF6E0D2BF8C747F904814E7263F380A5275CEA42FF5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247410, "uuid": "ce648bc8-ef21-4c26-b224-808ba858893a", "value": "384:4Rh8st0mqsBkw3058NuJnO+E3/Z7gEQwNk08oXDaN+h7in+2Qdu8dtr1XwN9HtSO:4f8st0dV+0tOpZ77Qwj8Jm+tApstSHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637247410, "uuid": "7d98d475-9cf1-4efe-87a8-5c7fa8260a44", "value": 23076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637247410, "uuid": "cc60ae27-7afb-4d82-bfff-2ef77a107fcc", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247410, "uuid": "4ceb652f-8511-4927-a1c1-e57f2400bd90", "value": "Waybill.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c204d06-482e-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637212502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637212502, "uuid": "93068875-425b-4c18-8898-1057a8809b62", "comment": "Malware payload (RaccoonStealer)", "value": "fd164fc1dfed3445d8cdb9e72f08172a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637212502, "uuid": "a9d10aeb-96d2-4dde-99a1-3591923a848c", "comment": "Malware payload (RaccoonStealer)", "value": "7a71c46f5f6f27776603ee0de69e6eb83364942d8af0c16f5b54c14d7faba136", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637212502, "uuid": "187a9fdf-e55e-46bf-9113-b96613233c3f", "comment": "Malware payload (RaccoonStealer)", "value": "41065b87823ea86e278fbecc3cc486637720825d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637212502, "uuid": "f9b71cd0-5fea-4a87-9ff7-734767c5cc79", "comment": "Malware payload (RaccoonStealer)", "value": "f874ab6266787d8228d32d01b1a1491f7cf54534cf7d50b4fee453fe39f8e325555e0a485bfe1e9e50cb031c37cff41d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637212502, "uuid": "bb640166-eada-4891-9ba9-13bff8ed408f", "value": "T118548C10ABE0C035F4B746B8497993B9793FBAA1AB3590CF52D116EA56387E0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637212502, "uuid": "881df841-ef76-4063-8199-51a5cd4d055e", "value": "ff6439958bc7d1b926a3ea41188420fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637212502, "uuid": "69b97f50-e01c-43b1-a0eb-60eecdc2bcd1", "value": "3072:E0ZpT7yzkFoPwXTgZCoMFjhI18V6U5cwxfssOGP2epIMRKYz4RQFGGHb9PJ4DxxG:OCuCboMw18VcwCe2eRRTECFLRJQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637212502, "uuid": "121f1606-306d-4edb-9e14-e82c0a5bc1a0", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637212502, "uuid": "478e41f5-2c94-40a0-954e-99b25ace95b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637212502, "uuid": "77cc37fb-4c81-4900-a938-1ba2ad912639", "value": "fd164fc1dfed3445d8cdb9e72f08172a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3931bcc8-4888-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637251045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251045, "uuid": "5b65c62d-3f9d-4a21-b7c8-086ce15ac3f1", "comment": "Malware payload (Dridex)", "value": "4fd3c58bcc77a6ad2c4a54b5092e122d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251045, "uuid": "3a73d006-6fc8-4360-8442-7c1bc96616de", "comment": "Malware payload (Dridex)", "value": "7abfd89f20fc6b4d28c95fd22a977fbc247438071fdb6710fe24487d571c3314", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251045, "uuid": "21e3210e-5747-4f13-bfd6-a36bd2e41c1b", "comment": "Malware payload (Dridex)", "value": "a8e9668375c7ec641ee7533dfabeb35e023e7c3b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251045, "uuid": "9533ea6b-e065-464e-8951-dbbfd18e4366", "comment": "Malware payload (Dridex)", "value": "c61f76ce0850e458fbb5e1ef9fe9476363e56a5d6c2359197818d8acca3cd85fce784a4479e5da6335446ba3f6ba7ed3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251045, "uuid": "d63382fa-7537-40e9-929c-896222771198", "value": "T136E48E0250D512FCFA898ABF155A67C1C6B310824ED1CB9E25CD07EADF64A03EE6D1B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251045, "uuid": "ab280aa4-1611-49d5-8aca-9805fd091604", "value": "fe16443ce39f2fcea9c5accdb27a9eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251045, "uuid": "cdad6c3d-1d4d-491f-92c3-49c51a0b8461", "value": "12288:w0TlJzJzJBJZn/JH3lJxJLJZJdPgA1VKBUA1rlldDJw:w0JtpDv/lVbdT3IA1wBUA1rlldDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637251045, "uuid": "591f7a70-3948-4af7-ab7d-14912ea78661", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637251045, "uuid": "9113b606-9de9-4330-b09a-e21d08295fc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251045, "uuid": "a1ad1e63-438f-45bf-a193-fb8c704ab319", "value": "Dridex dll (3)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b684890-4892-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637255478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637255478, "uuid": "9c552456-a304-4230-b908-468396bbf8f8", "comment": "Malware payload (AgentTesla)", "value": "7add5e6c2c23bc4ec727ac392c7e69df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637255478, "uuid": "8f07b3a7-ef8b-4ce0-a85f-fea41b596561", "comment": "Malware payload (AgentTesla)", "value": "7ad521d433c2060e1f36679b1a47bc8f8b40aaad6a2769935295e59157dff49e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637255478, "uuid": "d5647e4e-afdc-4bb1-906b-046e3a67532c", "comment": "Malware payload (AgentTesla)", "value": "c94b4866d472e0965048942726bca3cf7693fe6f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637255478, "uuid": "9ea40a4c-dc7b-483f-b0ee-035efd5ae088", "comment": "Malware payload (AgentTesla)", "value": "6988d30cf6c25574cf8c77193fe7d67c9ffe200286ea9d3d1217724e8d90d044a63cf4c0cf903653e45f2979fbed127b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637255478, "uuid": "e801f721-27c4-4e48-8419-98e9ce343c89", "value": "T12AB41259967C4B27D27817F8A5B5FB3903B65D706C29E708AEC078CB3EB17424825B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637255478, "uuid": "311c0745-628e-4b5d-b099-198328b6e093", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637255478, "uuid": "eee8b320-b00f-46bf-87c6-8863eca8377c", "value": "12288:JrH9ZcWBR/IzqzqbMP21H+PClegQ3pe39nCoGOqgkyR0Ld:t9ZZ/fyMOM6egQ3p4RtkK0Ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637255478, "uuid": "f6d3275b-d313-4c9f-9753-c47931afb8fb", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637255478, "uuid": "e97f0580-de88-44bc-835b-bdeb7ac439d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637255478, "uuid": "d2b4d8dd-01ea-4429-ae01-d9a872511137", "value": "Pago transferencia-002021118450.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4161dfa8-4888-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637251059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251059, "uuid": "6f01fffa-fa8b-4bb1-9c99-855fbf6200ca", "comment": "Malware payload (Dridex)", "value": "1a004e8119128084dc0dc34b08855a8e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251059, "uuid": "d98530b7-a87c-4ce8-b67c-06676f8b9ad8", "comment": "Malware payload (Dridex)", "value": "7b0bd3060b2ac4d062b8b218fd68c357ebe716a7f51af5687d338d93a51f5c9d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251059, "uuid": "46259fc5-bf90-4fdf-9774-ede2c28897f3", "comment": "Malware payload (Dridex)", "value": "adfc929dcaad0c0585f26e51753b94fb08f24dc1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251059, "uuid": "44b24fef-c0b1-42d2-b369-15736097a267", "comment": "Malware payload (Dridex)", "value": "cc7e9da628a923a318abcdace7c9893ee37ab0427f90f750104474072ff05411c09b17990a78abc9091cc31f77cbc219", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251059, "uuid": "c6cb8421-0292-4468-bbbf-fa0885c10015", "value": "T1FBE49E067CF9989CD511ABBD421E86FB8BB089B784D0CAC1C1199F3A5C07BDBE54C62C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251059, "uuid": "5f794d32-8f10-4c00-bcb1-670368621eb5", "value": "43b460ede91c0828a2b4acde6b98d16d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251059, "uuid": "615a8190-98b9-4302-8ec6-ade213023f6a", "value": "12288:E9we+YtfLwxfZYnfh0xnf2xfH6xfpaEdk9qcK05GDdiO2cGoOUwgHD:E9we+YtfufkfonsfYfpuN5GxiO2cGoOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637251059, "uuid": "834833b4-4dbd-414c-b33e-47c604752421", "value": 668520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637251059, "uuid": "98b0c796-46de-4fe6-80ab-040d780c8e24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251059, "uuid": "af56b412-1f43-435e-a796-e2fbc8f917ce", "value": "Dridex dll (5)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d11a798-480d-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637198143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637198143, "uuid": "7aa5fb10-34a6-40b1-91c9-92bdc38c406d", "comment": "Malware payload (Heodo)", "value": "68d6fa2e6a5c3afcd11c421644157cfe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637198143, "uuid": "11440952-3728-4ffb-a24b-70fd4d969536", "comment": "Malware payload (Heodo)", "value": "7b3910cd5c947790823ce5cb5ed5778c2d642cb12c87ed6ad64d4eda55cf5375", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637198143, "uuid": "c0284449-e51e-4b0f-8618-051ea4f9670b", "comment": "Malware payload (Heodo)", "value": "bfcf92f8efb0ba4bb7e4016f9d2875aba6fbfc3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637198143, "uuid": "5dfe22e3-929b-40f3-b42a-dd3651c1ff12", "comment": "Malware payload (Heodo)", "value": "21af92ccfa8c7a61844f6fba8d3c3e271add502afe40cd62967b6a1ea36619a08ce5d0a57b374e35623124510117db4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637198143, "uuid": "e217108d-9fff-45c0-ab18-24ec0dfc8ebd", "value": "T18244BF10B1809032E8BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637198143, "uuid": "190cc81e-9055-481f-b5c1-117b68d070b8", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637198143, "uuid": "a4e8c4ab-f611-4c1c-a10b-cbfef2d0f689", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBD6asb:prf+WPVXNcwUKaWTmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637198143, "uuid": "b4d6806c-7738-472c-b22b-ff64a4bbe8dc", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637198143, "uuid": "202608ac-8c9b-44dc-b35b-c7bfa6d7a6cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637198143, "uuid": "833ecba7-2629-4d78-82f3-6d926d07a803", "value": "68d6fa2e6a5c3afcd11c421644157cfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb245cf-4851-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637227729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227729, "uuid": "949f9094-6711-4465-a1b0-d42f6dbe6716", "comment": "Malware payload", "value": "a397392f772cb0d9108ef01bee3ad56f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227729, "uuid": "556af101-f1d8-40ab-8966-882512bcc3bd", "comment": "Malware payload", "value": "7bebe7070de7a6479bd9f43757b959d9720e778f7bbea4e54900d9453055190a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227729, "uuid": "994bb4d4-9016-4899-bec5-d6efb8647165", "comment": "Malware payload", "value": "127e1d07df9b6fef547bf6d2417432c7f4a8ae01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227729, "uuid": "b4187a96-ab45-4999-985b-feb44d558cbe", "comment": "Malware payload", "value": "7d65811d82d9165088a7bf9677b0424dfde3eaf107041658762a7fca7a1fb79ce1cdba6348960dfcec401a622acc0eb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227729, "uuid": "920e4265-09d9-402c-97a3-d29a3072c6d0", "value": "T199747D10B7A1C034F1F212FC99BAA368B53E79A16B6594CF52D417EE4A34AE1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227729, "uuid": "b3ac598c-968b-4bd6-9428-80a550475799", "value": "b2e29795cf26e2405a95e142d139ea34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227729, "uuid": "5ef21ca6-71c2-47f0-8400-a031f47c741b", "value": "6144:eLnu8MifS9P7zgQjCtSagwrLgUZjTPr8LDLPQY1gVK1Llf:F8MCS9jEQjCtSagwrLBvr8T4Y1gVOLlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637227729, "uuid": "b74b117b-7920-4b70-a9ef-cbc260a78bbc", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637227729, "uuid": "6133a42f-9d3e-4914-8309-2dd86034ba34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227729, "uuid": "7d45ca18-a388-4d8f-81d5-5a9dab041d8d", "value": "a397392f772cb0d9108ef01bee3ad56f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c240e0fc-48ad-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637267166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267166, "uuid": "9cfce487-c246-4b15-b828-f0e158ca7f1b", "comment": "Malware payload (Mirai)", "value": "9f8e5e7f7407774d5db26e53a74e1c7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267166, "uuid": "a10a1500-bb58-42d2-9025-55fd5fe8aee7", "comment": "Malware payload (Mirai)", "value": "7c59d808696e189eda09a2b452a7826dcfa2a5345a48e1de6a15dcafa9bb4366", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267166, "uuid": "0b8b8378-c54f-4ec8-a427-7aa6170c59d1", "comment": "Malware payload (Mirai)", "value": "a7b973415d124d23fe75b475397b5c98415a0d7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267166, "uuid": "78df5146-9fb7-4a1b-a13f-f21222aad573", "comment": "Malware payload (Mirai)", "value": "b4e626f42e899cf7afa3d23598126fe14016e6f6a426594e538f8ef168a85ece4d5862095d10ea93caff66cddef01c30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267166, "uuid": "9a60a608-aeea-4370-8916-23e256eecd7c", "value": "T1AC43F8C17881A626C7D05377FA5F018D33199798E1EA33538D296FA07B8AC1F0D6B74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267166, "uuid": "1c2bb8c1-f289-4c23-817c-1f03cfda9ce8", "value": "768:3M8ShSh+IzgVLASTjQ4PYGO4dFs0msL5uEBwVt8k21+NLeE8QDJSULwCVy/rCxHt:tS8dzgiemsQ2Q4/M8fhWtn56O9mvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637267166, "uuid": "f5b87d9f-0403-425f-a10a-53cb96bcb78b", "value": 56880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637267166, "uuid": "18a9e109-1a90-4d06-9bd3-caea978a6740", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267166, "uuid": "7643c3e8-af4d-4df7-a18c-fc8a453ce6ea", "value": "9f8e5e7f7407774d5db26e53a74e1c7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb426125-484c-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637225520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225520, "uuid": "ad9af6da-ecdd-4b43-96ce-b62eb184b319", "comment": "Malware payload (SnakeKeylogger)", "value": "900407cb53d83bac9bc460abe96e6600", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225520, "uuid": "f2d231dd-27b9-4dca-a376-6a238ccd3487", "comment": "Malware payload (SnakeKeylogger)", "value": "7cbb963c64a0a87f7f0954f0220fa576ef030f0a6fb8ee8b3cfef993c02e335c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225520, "uuid": "cac7dbe2-56dd-4460-a98b-eb9cd7270033", "comment": "Malware payload (SnakeKeylogger)", "value": "1ac0fb5d7125f769cd6383123b3c08efbbee0224", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225520, "uuid": "db0b3df7-1bfc-4357-bb14-915630ae1b27", "comment": "Malware payload (SnakeKeylogger)", "value": "dc601f7080a25b11913156cb2caf9cbcad33387ee97626c99b1c7376794cb1c2633c3c94e00a8588d1b27d81613bd40d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225520, "uuid": "2c016334-463f-4c65-8620-7743dba62460", "value": "T187C4CFA036B8C827E77080B9C5B0D2BA4FB0B16D1DD5C646BDEE6ADF76587607C18312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225520, "uuid": "adf79109-fcd0-4af6-ae3d-2f4e598537f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225520, "uuid": "9c870235-3f49-4def-b881-7b9e0038304e", "value": "6144:By9SdUa3HXkh22hlECn/KqS15VIFI7M5IBOyVZsPl+3HU5TKR2Kqq5N0/WI7f7sj:Bytm31gW7uOR2E52/WKJ70W7RpjYf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637225520, "uuid": "68448551-4409-49ee-b6f9-69f78fbe108a", "value": 546304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637225520, "uuid": "2a51cb51-dbb2-4d89-a3a3-b115c8a9f76b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225520, "uuid": "9be0e0f6-2135-4f7d-a6d7-140fc2d7b406", "value": "FYI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fb0a05-485e-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637233162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233162, "uuid": "8f7b8851-334f-4a4d-8f90-1dd8a783138a", "comment": "Malware payload (Heodo)", "value": "094466b6cc8ff4e6926bac9e93fe9a05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233162, "uuid": "8f618d87-86c1-44c2-a3bc-9ca402ba6281", "comment": "Malware payload (Heodo)", "value": "7cd374d85cd6e38072113f7ab11403093791cf57ee0f51f6c85d4986e46a31e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233162, "uuid": "a9d9f616-6db2-4c4c-85cc-f69cf8d152cb", "comment": "Malware payload (Heodo)", "value": "3451604270ae3d81f8f1900519f30a3f1eccde05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233162, "uuid": "66d1c112-c3d0-4bd9-aadb-41d88aa38f18", "comment": "Malware payload (Heodo)", "value": "88bca58d98e0513a878f86920af5e006f461a485688780a7687d94a9fc76c6b75b10811cfd0f055eb8bc2f2449ad9cf9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233162, "uuid": "14254056-fa55-4975-86e1-a29ba34570e2", "value": "T15344BF10B1809032E8BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233162, "uuid": "1387379b-93e1-4f77-b9ad-35ffd2183f0a", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233162, "uuid": "04ddf4e4-157e-448d-a51b-6518bc4cfdec", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBH6asb:prf+WPVXNcwUKaWTeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637233162, "uuid": "e3bc09db-fcad-45fb-94eb-8f8b57eba214", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637233162, "uuid": "eb5268a5-e826-4d79-92db-bb60cc3253b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233162, "uuid": "8d1db9ad-9d3f-4b49-a4cc-d610d9cd25c2", "value": "094466b6cc8ff4e6926bac9e93fe9a05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62a184e-4802-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1637193702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193702, "uuid": "a927d229-766f-4867-a56d-765fa0ba153c", "comment": "Malware payload (Vjw0rm)", "value": "c98b05c3298bd445e4001f886cfa4d64", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193702, "uuid": "e6087388-52f9-42ce-bc22-3e6a93a601d0", "comment": "Malware payload (Vjw0rm)", "value": "7d203b4ccf98d52538c26e97bb15ba5ed497720f00d8e1225fef35570c0bb003", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193702, "uuid": "5e0ae77f-6eb2-4836-a964-f1c93c210b81", "comment": "Malware payload (Vjw0rm)", "value": "e16f6a11cb57ea848741863188c6bb45548f9ad4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193702, "uuid": "4daf017a-9551-446d-b7b8-cb00b6268f16", "comment": "Malware payload (Vjw0rm)", "value": "9268c846a8f314be99fe645bd49d559629c5f225c49319e6f4c5f3d296c7fe4cac36076450c1e194d4249e9884a53d82", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193702, "uuid": "21b9ba10-29fa-44d4-8edf-95d8eb8a9530", "value": "T191C28DC87C427510DB41679281AFAF1C1FFCC146F20CD04F6963BA886A26A8CD92F75D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193702, "uuid": "1b1ce224-a5ea-4b1b-8dcb-dbb19040ec25", "value": "768:4xuKXoZl720FNHt8Xj4pITCUr6Vxyf/IJ5GLvtkNS+u:4cKXoZla0FNHt8z4yTCUmxo/JvtkNNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193702, "uuid": "edc281e9-61f0-415b-8c60-e40c4a027952", "value": 26208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193702, "uuid": "52af497c-9797-4bc7-9bd8-215611f16c02", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193702, "uuid": "e96fb6df-af99-4fca-bdf4-cc2d1d5dea80", "value": "IMG-2100021.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4e91ac-4890-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1637254617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637254617, "uuid": "474f1064-dcd0-4f28-9c39-afd5b9fa70de", "comment": "Malware payload (STRRAT)", "value": "9ad46d68cef2e523d609722a475f70da", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637254617, "uuid": "e3e1490d-4db1-474a-bdf9-18f7d205941e", "comment": "Malware payload (STRRAT)", "value": "7d75276562942a6d767fb37475da7e34c5c908c0116a8b631eeb028bb627fd34", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637254617, "uuid": "8332fbd5-d33c-460e-ab1f-7cfead30ff52", "comment": "Malware payload (STRRAT)", "value": "47be8d0f83157ebf5943b89d55ab6f1070193682", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637254617, "uuid": "93c1cc5e-3958-4fb3-ae81-b635b8cc8e93", "comment": "Malware payload (STRRAT)", "value": "8364b699ec7f57bf8da97d28f733041db6d2ce46c6f81720fce95479c6177f3fa96aabb7cbd7299e2ad6e13255c34ae3", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637254617, "uuid": "25e8aeb3-2850-43e5-b379-f7a34ac47b76", "value": "T1B4C31288B6E8207EE77B26379D8E18CB139CFD8313731935C046B6A407AB1F1965A137", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637254617, "uuid": "a4fc06ca-53c1-4e85-b439-dd12b9e6a506", "value": "3072:ZeYqqL4g7buOhiwCMYnfQLlwJqsBNeJsgWE:ZeYq0uOhXCMCfQLlwJuegWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637254617, "uuid": "22688471-da73-4311-a18a-05bfecdc05cf", "value": 122783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637254617, "uuid": "60fb76c6-2b1d-47c4-8054-9f3829df0bf0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637254617, "uuid": "e9569390-1e89-4c81-abd6-5bdc4b67b553", "value": "receipt.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed186cf-484e-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637226117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226117, "uuid": "110f1428-62f5-40de-b3b7-796492515fce", "comment": "Malware payload (Loki)", "value": "3886bc5042335b65eff724567f920897", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226117, "uuid": "965d00c2-c40a-45c9-a095-8ad7514d4b3b", "comment": "Malware payload (Loki)", "value": "7e1ce834433ebab1676dd660bca396bdfe127bd7d40ff71eaf39a32b67eabe7e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226117, "uuid": "7b3aea51-519a-43d8-86fc-cebc0f5ddded", "comment": "Malware payload (Loki)", "value": "0d711d6096d4ca6282c9c099de449ab10dba488d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226117, "uuid": "afb7d238-0194-4855-bcd9-62b397eee7ec", "comment": "Malware payload (Loki)", "value": "52303030a5f53c2d7105dc3cf532a5d62404542460d0c49a5f642e8d5727f5a49eb5e2d71d7b9500a629c649c79d983f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226117, "uuid": "7538195d-fd50-44d7-90ef-535548022b95", "value": "T17B341276BAE7E0BCD275227D05D7B4C74C3BDC044B750E61AC923A2F823975B6488366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226117, "uuid": "7da7a255-a9ab-4f14-ba74-508a424aa9ee", "value": "6144:jB1jAUz6JmiCJSawAXnNunK89nWVWyFs0kRoWhpyXv:jjAkJ3z9uRnWVWyqR7hpyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226117, "uuid": "f9979352-b58f-4e12-9851-7e84112018f4", "value": 234184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226117, "uuid": "ec24b06e-af1a-4c5f-a5bb-adb0d9b8725d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226117, "uuid": "0243b5a9-dae4-42a9-a4a7-db3211f3eb55", "value": "Pda Quote Request Form.181121.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77659d3e-4866-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637236546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637236546, "uuid": "2daede71-b294-45c4-93fd-61f52f49f5e1", "comment": "Malware payload", "value": "64c325b55ccda8e3f3e839b63e0de87c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637236546, "uuid": "73f5a91b-80e5-48f5-b770-c04fbdd724c0", "comment": "Malware payload", "value": "7e824e7e4099669c7fc69cede411c0235dcbacb017f591ebca1807b4378e6148", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637236546, "uuid": "67bfb344-4f99-40c4-85bc-f474150d484e", "comment": "Malware payload", "value": "3f4d0d4ba195f03bd2265f11d3ed9127cf55e664", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637236546, "uuid": "c39bc684-ccb9-4486-aed5-a27cce47bbd2", "comment": "Malware payload", "value": "e15334e05b54bc0c888f826a75ed71870f4fd1a31558b15b672dd57790102e36d13315e735d0fb50dc99165f6a2aca01", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637236546, "uuid": "ad6fc4cb-f592-4ab0-aa14-7eae86d88d2e", "value": "T12C11A5188FF2742BA18E4974846372A927A1B248B37C50A1C7C9B08978519F3C32780C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637236546, "uuid": "5c6407a3-1c2f-4ea6-84d9-fdc65438152f", "value": "24:Wz8/P6r7Bn2IhE3fWYA3tCE6g+8yyc10GRNUDm8z3t:M8/P65nFieYA3tCEuNRt8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637236546, "uuid": "b9c5c241-04dd-4f39-8dba-c59fae2154a7", "value": 1000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637236546, "uuid": "ed2f8cae-8fdd-45e3-8050-3debb2977df0", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637236546, "uuid": "38902870-7baf-4050-8e00-2919785f55f8", "value": "CBA22-10-21[1].doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa55b7c9-487a-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637245356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "15f989db-fec3-43f5-ac2d-1fa726de8fa4", "comment": "Malware payload (Heodo)", "value": "023adf29ac7cbbc559682c873e20404c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "f93511e3-5c4b-4a23-a25a-e30622aa906e", "comment": "Malware payload (Heodo)", "value": "7fe97b90f76c283267b54de252ac51d102f4540c40e7d44bac13d742b29e8119", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "67f3ee0e-3bc5-4b1e-8d4f-0d509c90d760", "comment": "Malware payload (Heodo)", "value": "67c005a2e0aa2833d0b9ade50e2f0f20acf91799", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "c20e18c8-ce8f-4c29-885c-96e2e64282d9", "comment": "Malware payload (Heodo)", "value": "dd3c96c5cd2ec8c31c3195b58aaab10d846523f352932a53cd3a2f8abd9b5df59ae28d343bd921060d49bed7ee715538", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "2af25775-6f4a-40f1-9e30-09d3c86b9c7b", "value": "T124A4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "3073e7df-ac4e-4abf-a747-c7cfef48763b", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "abd158cf-f74e-4aa4-ae5e-ffe74465653a", "value": "12288:bdv8jkvzqZvv2wLBLmTi12yD88kYwZ1h1:b2Zvv2ciTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637245356, "uuid": "b1898b98-7edf-406e-8ea5-6b960b8a99e4", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637245356, "uuid": "0d900ed3-4c2c-4516-9a2e-b766016d05ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "34a3c9b5-04d9-46c2-a129-3f6a6fdb4039", "value": "emotet_exe_e5_7fe97b90f76c283267b54de252ac51d102f4540c40e7d44bac13d742b29e8119_2021-11-18__142229.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c8ccee-4839-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637217218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637217218, "uuid": "56855d21-a010-4e57-8e06-7d663900f9bc", "comment": "Malware payload (RaccoonStealer)", "value": "dad9a8e22c210176ffb0402f1dc02444", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637217218, "uuid": "52952c22-ad6e-4f17-b12f-c5ac02b6e3ca", "comment": "Malware payload (RaccoonStealer)", "value": "808a1353be2e23a511c577b86ca5c2e37ee4a30d8b5abde669e7cc2f9d91d5e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637217218, "uuid": "b3de6d7e-11da-4b93-9cdd-da666eb97103", "comment": "Malware payload (RaccoonStealer)", "value": "5d6384435146967bf86c8f55b13a44998f7f51ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637217218, "uuid": "030d8efc-7bb3-41c6-8c88-7b993291a057", "comment": "Malware payload (RaccoonStealer)", "value": "d21b6028a1f197e747cc29ba5e68e37187abfca39b782440e2ecdb0a2e0fdf8e0d61d7a16d41de283311f79dc18c1d74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637217218, "uuid": "25831d48-ec6a-4824-86c5-b7f4515608ed", "value": "T1F8548D10BBE0D034F1B716F849B99368B93F79B1AB3594CB62D116EA4635AE0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637217218, "uuid": "9aaf4aba-db32-49c1-9dd1-a00f764a9064", "value": "ff6439958bc7d1b926a3ea41188420fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637217218, "uuid": "0a115981-3a32-4d4d-b556-8905c1967248", "value": "3072:T0ZpU7yzrIHdJV9w/FZqOVtxaI59rfgcwvYPXeZTAsBL4IYhJ7kchqeb9Js9xMW9:srudJLw/FZ/Hr1/XeZbBcpT7kcIwsj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637217218, "uuid": "3cae7e32-cd56-41a4-98b8-7489d049be7f", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637217218, "uuid": "0a5c370c-b4fe-4b6c-ba09-9df0bd036f51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637217218, "uuid": "8b34744a-49c1-46ea-9b72-cd1109f05538", "value": "dad9a8e22c210176ffb0402f1dc02444", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1dabe49-480b-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637197587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197587, "uuid": "779de837-91a5-4771-a9d1-8a1eb02c2432", "comment": "Malware payload (Heodo)", "value": "db0744b7c2a83f29b66498a9b8fa6620", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197587, "uuid": "debc6b2b-3c07-4532-9712-b98ae7478719", "comment": "Malware payload (Heodo)", "value": "80ce105824913252a6835d3644877c6cc71c640970e1c3329f389a77e064eecb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197587, "uuid": "8dd97976-2b56-4b77-8658-93b7693a231a", "comment": "Malware payload (Heodo)", "value": "818973d869a8e6be3019ac9eaaa70a97bc018253", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197587, "uuid": "afada600-6eba-4983-9194-38a71e47a3e7", "comment": "Malware payload (Heodo)", "value": "eadc8fec4d43d2ee94c72c3a93b9daa034c757c1f77498b7a3bdfe7486aad38a21fb472c87e4411782694609c37103dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197587, "uuid": "c978ec92-d073-456e-bc0a-aaa97e7a6e1b", "value": "T16B44CF01B280A072D9FF193A85F5C66A4A6C7A500F90D9CF53D80DBE5B765C2B6309EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197587, "uuid": "644d52c8-ad79-4908-808e-2aed87621596", "value": "822ae775303d14fd9c529b33f0deaf77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197587, "uuid": "2c690105-a2eb-4911-a6a5-f4c8be240cec", "value": "6144:ndH09uYgR7OJSuwuZc2HEaYTy7beWTBdlm:dHJtlec2HEaYTXWT/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637197587, "uuid": "318c8135-bdfa-4c08-b0ce-9d2e928a092c", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637197587, "uuid": "5cdbf754-3a9a-4178-9971-b27fa9fbfc52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197587, "uuid": "13e3fae8-76e0-438b-8ae9-5ea824751b26", "value": "db0744b7c2a83f29b66498a9b8fa6620", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32272777-484e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637226122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226122, "uuid": "15c10d44-13f7-49a1-864f-6ee57530c761", "comment": "Malware payload (AgentTesla)", "value": "97a6c2dd51f2dfff14f395e029ae0a7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226122, "uuid": "21c6b2cc-d7f6-4bf6-b939-cb2c26fcdb12", "comment": "Malware payload (AgentTesla)", "value": "80f57a191fd783ce972fad7af1b076b1e81c658c000152c7db469f285e69ed16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226122, "uuid": "943ca898-2b7b-43cc-88fd-9601242e6fc0", "comment": "Malware payload (AgentTesla)", "value": "64f22243e0fb12db655d9f31e7cc31d3ad8716ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226122, "uuid": "557370ca-a33f-4b9c-8888-78d42234ece4", "comment": "Malware payload (AgentTesla)", "value": "599be2ac5fe2afb697de16f0bc4e7b898ebf3fb8ba639b321f9e02dedd82c41be5edc9558201e86cb7695e82de25a97a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226122, "uuid": "f363a341-3e02-410a-afb1-4c01fe42c6ed", "value": "T1C03412583AB2885ED16ADDBC2C85D728CC35DD21E76166214B90F7CF0D78E224337427", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226122, "uuid": "e11a8483-36ae-4906-b57b-89d156cdf31d", "value": "6144:v71mDqs2NOTkugn8IqOBKRPUT9JnhGFLOWIGU4PrD:v7QDtTkFn26xJhjuzTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226122, "uuid": "1ca12c9d-7161-46bb-80d6-f058e697e160", "value": 234104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226122, "uuid": "07b4626a-d671-486a-9a0a-ba5f12e62d66", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226122, "uuid": "c627e2e0-1ac2-494c-9011-af7e1d7f3fa7", "value": "ANT_0402205_001_144747_20211117.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "596830da-48a1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637261836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261836, "uuid": "1b5a8ee3-99ed-4f85-b6e2-2afa489c6821", "comment": "Malware payload", "value": "996aa1090c7e59b5a40ed6865970ad6d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261836, "uuid": "a4fff7f4-25b8-4e64-a7dc-d702c4cd6d77", "comment": "Malware payload", "value": "812ecafbcaf00f96706a4a3d8064d2e30702a92b1454a09569f9c3ce3e1b3a6c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261836, "uuid": "97baa271-a109-4f39-a511-4548692b6952", "comment": "Malware payload", "value": "dcb2e3befa11a4d62f43d2f4ab07a93af330709d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261836, "uuid": "d743a329-42b6-453d-b800-910986e26998", "comment": "Malware payload", "value": "64979bc75e4665e22701f9bd4d84f0b1d8934725baa38aec97578b0ca5edb755ec652cbd47487a2116d7cd50fbafbff0", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261836, "uuid": "62d7f990-6591-4223-9e48-034d2e146aa4", "value": "T166E52307B6C74B3AC4AE0A31A69BC3368166BC705561C41B639D5B1D2EF36A4B3E33D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261836, "uuid": "98d3f5f4-2bf0-42fd-a5c3-6b96bc25421c", "value": "49152:+Y4b1Y5A2iFtk1F2dRj45Zize1bpQ0LrUSw9C8gTJq/19n+s9RFz+p:Yb1Y5A5tW8dRj4JlnvizR1Ys9RFz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637261836, "uuid": "2dcb2a89-b0d6-4a04-b155-5f0f35a17ebf", "value": 3090944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637261836, "uuid": "006af9b9-d01e-4539-8974-335da74863d7", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261836, "uuid": "4e4cfedb-a331-433d-bd9e-7d50c10b1a90", "value": "996aa1090c7e59b5a40ed6865970ad6d.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2230fdd6-48a4-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1637263032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263032, "uuid": "ad4afca9-0c03-4fc5-b791-d934a191fdd3", "comment": "Malware payload (njrat)", "value": "13f187df5383e456f90b6c337d9fc0e7", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263032, "uuid": "5a3d22a4-2578-409a-aa83-4c71f77342db", "comment": "Malware payload (njrat)", "value": "816d9c966736b02b56d23629f8968fdb4f910fd575c4c07b524bd51948c5d4ed", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263032, "uuid": "e2866337-963d-495b-8d35-717d5e8c47bf", "comment": "Malware payload (njrat)", "value": "5a37a0a1d44f7fd4323234d1a6c8264da4a64ee4", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263032, "uuid": "a0ad7504-8675-446c-917e-21bf43dfabad", "comment": "Malware payload (njrat)", "value": "e7b8cf8e6855e82fa77134c76f58abe775918988d7b32c03e633a14fbd2f6872ed9102415bd39764e1d6819e967a9583", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263032, "uuid": "c89a7710-a312-49cb-95d0-946b9ffb53bf", "value": "T165417B38FD1BBB824831F57661A78DD5CEEC1017DB443C3C21124C7849918BD6AAC0BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263032, "uuid": "09f5a370-4696-4399-9bd8-eb9f92f46e84", "value": "24:JVkNGJYuIoviVLF5FFOY9NFMffNscNVPvyJCCKaV7A9F0ZTFkFo9bFQZpFOyoQeM:bXgHpUfucNVPaEqnIoTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637263032, "uuid": "43a7a1da-fafc-41af-bff2-fbe02c8f47d6", "value": 2284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637263032, "uuid": "7bf1cd05-be8d-4011-b11c-baa0f5cd6097", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263032, "uuid": "7fbb89d2-a881-4c16-8718-1599e0d389cb", "value": "U2M19O_Payment_Copy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0101661-481e-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637205798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637205798, "uuid": "4f09fbee-d629-41da-96a3-e627497922c4", "comment": "Malware payload (Heodo)", "value": "44b1a3c120d5209d93d1506b33ce4e48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637205798, "uuid": "4bb47b43-1afc-4813-adc8-262e77a55ab6", "comment": "Malware payload (Heodo)", "value": "82c7b0af93f725fe07bde3d0784aae99990f81ec07e77ea203fc2b9c3a199960", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637205798, "uuid": "36c5cfd4-7c90-4238-a5dd-3b962c9bd1e0", "comment": "Malware payload (Heodo)", "value": "edd3f3db2b1e38712aacf62e52896fde8fbc55a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637205798, "uuid": "fe852739-5f23-4f9f-a6cb-1277b4e50696", "comment": "Malware payload (Heodo)", "value": "d2bf7eac4376ef69da0105d9596f9889b11c25c232bb8ab713b8eab80906c4bb460620527f9ad2135ce04d30eeb1dfc6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637205798, "uuid": "6a6fc662-1dc5-4d70-bf8d-b6e281cb26f9", "value": "T18944BF10B1809032E9BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637205798, "uuid": "e8bbda58-01e0-4de6-95a3-073d0c2a4d56", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637205798, "uuid": "16bf6541-81d3-46c6-b2b9-dec802c7fc96", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBk6asb:prf+WPVXNcwUKaWTVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637205798, "uuid": "03d64451-1706-4ebd-bda8-0463e06fe0cc", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637205798, "uuid": "ef1db5a7-32d0-4bfd-9c3d-b7d92ae2e8b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637205798, "uuid": "686df20b-68ee-4ce1-b565-d384c8be4c53", "value": "44b1a3c120d5209d93d1506b33ce4e48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d4cbda-4819-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637203280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637203280, "uuid": "1a294011-6d72-4693-b225-c5a2bee42d2b", "comment": "Malware payload (Heodo)", "value": "f7e24b6d10f19e54fdfd84e15f8f7adc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637203280, "uuid": "8bdf20a1-167d-4769-a11c-9c763cdfe0c6", "comment": "Malware payload (Heodo)", "value": "8488ea5b0d9c44f553ee22ae7e9badedc1085f80d5d6ae3bdf114f68bb648a55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637203280, "uuid": "5fd80eab-53cf-454e-840a-49767d075f9f", "comment": "Malware payload (Heodo)", "value": "29eeecc66ab1892609c915059590255f060efd0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637203280, "uuid": "aef05f96-7b46-443c-8f25-5d193b283a02", "comment": "Malware payload (Heodo)", "value": "6de1c5e1c25993bd2c991db75c90ee031f904f88842a0c3b1363268a33e0eae4768e7aac46cff62d559d661c4e9481b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637203280, "uuid": "15156cd9-d469-412a-a4a8-c0509ae9788d", "value": "T1E944BF10B1809032E9BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637203280, "uuid": "5b88a254-c45d-4aeb-beb7-c4f9cb67e634", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637203280, "uuid": "56809f42-8c23-4599-aa80-425ae17630ab", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTB76asb:prf+WPVXNcwUKaWTqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637203280, "uuid": "75ef64e4-8976-4cdf-ba54-466c7c11696c", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637203280, "uuid": "6900fd55-cd6e-44b9-845e-ae64dc0636ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637203280, "uuid": "d284f42b-0f26-4f86-8e2d-e5290f38ddc2", "value": "f7e24b6d10f19e54fdfd84e15f8f7adc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd42560-4817-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637202442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637202442, "uuid": "a4f2c760-c449-4c99-92ab-d5c93ac1124d", "comment": "Malware payload (Heodo)", "value": "5259727f243b7dffe26e1574a0fc1ec1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637202442, "uuid": "9a9156ea-40ce-4eda-9d65-1254d4bc2fea", "comment": "Malware payload (Heodo)", "value": "85342c1c2fb91f2ca8c462077af1bf214b3c37c78efa1ef83d5966c2aed212a5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637202442, "uuid": "c196257b-47c9-48b4-aaeb-21a04b77578d", "comment": "Malware payload (Heodo)", "value": "736e9a6b76a52872c6f2396a8b678e6cf85be985", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637202442, "uuid": "4b26f03b-ccd1-44ff-8a77-1e621f7b43c2", "comment": "Malware payload (Heodo)", "value": "6118c9739e9df70033250eb1ad5d3b676e21404ffa8c0c46744371734f0f5fa24fa72b84e2a45230b40d6fc2e74aea6e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637202442, "uuid": "3750d27e-97c9-4268-879f-0208dbfdc6a2", "value": "T1B344CF01B280A072D9FF193A85F5C66A4A6C7A500F90D9CF53D80DBE5B765C2B6309EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637202442, "uuid": "aebb6b14-2c5b-46b5-a296-7da288319d37", "value": "822ae775303d14fd9c529b33f0deaf77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637202442, "uuid": "fae281ff-d478-40ce-9aba-ddf3d70025bd", "value": "6144:ndH09uYgR7OJSuwuZc2HEaYTy7beWTBdvm:dHJtlec2HEaYTXWT/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637202442, "uuid": "474bfda1-3414-45ec-a249-15839a2878b0", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637202442, "uuid": "1383240d-d0d6-4e20-8637-b777b49d08c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637202442, "uuid": "7c7dd47f-fafc-481c-8195-3ea5e9c0fb29", "value": "0Uj43uUded9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5c2f83-484c-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637225413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225413, "uuid": "21c78319-65f7-41e1-ab8e-cefe529f226c", "comment": "Malware payload (Smoke Loader)", "value": "631708a58efc2be0bb74b1502e25604d", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225413, "uuid": "aabf1405-2901-478a-9cd0-40128506aa62", "comment": "Malware payload (Smoke Loader)", "value": "85c4a1011cc20d2f954aa77d5e041adc8d2e13262df61f99170c2866a9eee844", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225413, "uuid": "144133c7-8653-4241-81b0-1f3bf7bc614f", "comment": "Malware payload (Smoke Loader)", "value": "865372fdf1c4fe50d18985bda0b4d0ba1f88e3db", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225413, "uuid": "1ea3979a-0df3-4a99-b790-769869088c86", "comment": "Malware payload (Smoke Loader)", "value": "c8143a0e8f491e0396591997cf2c4582661012087027cbd29651bd6cc9e791cb98c5eac7d5b58c44ae367277fbd18535", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225413, "uuid": "465460f2-ac1c-4ef3-b009-750a09c92e14", "value": "T11B748D10B7A0C035F5B723F889B9A269B53E79A16B2494CF52D516EE4B34AE0FC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225413, "uuid": "8dd1b342-65a5-4159-89df-1de6a8f4b63b", "value": "b2e29795cf26e2405a95e142d139ea34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225413, "uuid": "cfb84d07-1a52-4f18-afa6-787554b7a0d0", "value": "6144:5HPHOz0E2rjtVaIA5LgU+rTPrgz7Ywt2oA03KvtQoKUK:5rZrjtVaIA5LGnrgzvIoA03KFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637225413, "uuid": "a96af714-6a75-49d3-a8f1-028a3264758f", "value": 343040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637225413, "uuid": "5d1695d9-10c9-4206-9026-91b92019d6fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225413, "uuid": "0c5d22c1-a0c1-4320-8622-5f2b2eda4398", "value": "631708a58efc2be0bb74b1502e25604d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67de4ec-48a4-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1637263362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263362, "uuid": "2380e15c-0ff3-4d1c-bb18-fd207c03f387", "comment": "Malware payload (Metamorfo)", "value": "c5cd415b0f56f6083717eacbe6351145", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263362, "uuid": "664198c1-bd85-4ff5-a9bf-c2e79dff7955", "comment": "Malware payload (Metamorfo)", "value": "860878b86ec6c991a7accebb5c48ae8151af176f0ae25efdc2613ebdbb1c04d0", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263362, "uuid": "5539c07d-58a5-4e01-b6ab-ae3999290319", "comment": "Malware payload (Metamorfo)", "value": "4b81482eab7196f1101a7dc03493c525186476d4", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263362, "uuid": "f0392dc5-741a-4678-b543-91589a016292", "comment": "Malware payload (Metamorfo)", "value": "b356291e4ed422cd0a1fc86e1940ea614d932598675a5560e0ad32f06521ae65b6514ab23a25c136639b2c774e48189e", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263362, "uuid": "558a0bd6-c01d-4a04-aa6a-47316c9b4e7b", "value": "T18D41F0002EEA1325C2B3DF7A28F6A6868E67BD519D934F4E8040478B5861690FC36D6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263362, "uuid": "58cc9cd7-6d6a-4084-890c-39559dc4ec34", "value": "48:8+uH+M+LDvPCXYLH21cIXv3KaIqiHkb6NS6:8+ueFL7CoLW1cGvKdEbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637263362, "uuid": "3c780b34-7a43-4b9c-a33e-542a2cbfe2de", "value": 2032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637263362, "uuid": "06f9962d-18c6-45ce-9a24-18e471fc37e3", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263362, "uuid": "2fb64e15-de22-49df-95cd-9d58bc3c57ed", "value": "18 de Novembro.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbd20af-48ac-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637266733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266733, "uuid": "987059e3-128a-4695-a09a-99f11b4e1bac", "comment": "Malware payload", "value": "74a7e2df53880519d2bbad6397c8ecf7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266733, "uuid": "3564d258-c2b2-4c61-8b91-abdda29957d6", "comment": "Malware payload", "value": "862aab1f62349d70f33bdfbcfba008e6ffbf499c6e79e6f701641f478e5e30b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266733, "uuid": "5a129220-0765-4ec7-994c-a6850b5b11e6", "comment": "Malware payload", "value": "ac2f85d2b4cb752093a1200840252c207316f670", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266733, "uuid": "9f46b0f0-e1be-4500-b1cd-d2751725a1d4", "comment": "Malware payload", "value": "1c6a24a2e8069b9954bb97bf3e32e9490cb44cabae2639b230d2893b2c5d48e6204497b77b379585f3ec7bab32249774", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266733, "uuid": "0116e57b-4ea0-4473-93d0-784e6baccc1a", "value": "T110D4D0A03AB8C413E730457ADAB0D6BA4AB0B16D0DD6C7027CDD2AEFB65D7647C58312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266733, "uuid": "e202202f-24b6-41d4-8ea3-c48ec71def12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266733, "uuid": "87e25094-1254-42b2-b0bc-c8771d8f0a5e", "value": "12288:1vm31gW7IGk2POArx97hlUn1cQ92dH6Q2Itenbr9tLMn:1vm3KWkN2POM9NlUnj92dH6FItq9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637266733, "uuid": "816b0f54-ebd4-4bcd-88dd-76e8745e9a37", "value": 624128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637266733, "uuid": "a41468ef-6e16-4c20-95da-632abcbeb567", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266733, "uuid": "9bab105d-0319-415d-90c1-ffa2d3222a71", "value": "74a7e2df53880519d2bbad6397c8ecf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d165c8-487d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637246318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246318, "uuid": "713882cb-cf3a-46f3-b29c-e25f25f16026", "comment": "Malware payload (RedLineStealer)", "value": "9c214ba32558f2bde1dc4ce8707aa469", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246318, "uuid": "be0c785f-5c3f-4ca6-8c73-444c2d2f8632", "comment": "Malware payload (RedLineStealer)", "value": "876caa967b75b4fe3a6931efb20c41be49891bab4daf6c869dd41fe892574f06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246318, "uuid": "f5de4544-4409-46ff-be79-5c231c6edfa7", "comment": "Malware payload (RedLineStealer)", "value": "ebf116f8296318406f5abc0869578d542bb9cdf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246318, "uuid": "42643fc4-abc7-4030-bfa6-d5e4688de30e", "comment": "Malware payload (RedLineStealer)", "value": "7352c1a5d13fa57f072971fd4f5243aa2c8d3056fe57d00aef39d3fabb1b94747c9a99e40d654b6df40dce32b6afb521", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246318, "uuid": "7de4a028-c0f0-401a-9455-658b45f6f1ab", "value": "T11584252864BFC05940E3EEA62DDCA8FBD99A95E3640C743701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246318, "uuid": "771b8d70-5156-4680-83b6-23271151eb1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246318, "uuid": "237c704b-e240-4a91-913e-0cfa550346ef", "value": "12288:KEmiYT4r927ZmtEt0rdZCk7kM4dX4QJ+D3:uip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637246318, "uuid": "f44eb7a4-8453-4747-9233-f11169c41f53", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637246318, "uuid": "c0143154-d019-49e1-b553-645d3185e3ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246318, "uuid": "8a851b82-5a2d-4225-bf50-24bf31446708", "value": "fortnitemenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f546793d-4843-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637221725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221725, "uuid": "af09ce00-6e06-4493-aa7e-fc9b4b230cd2", "comment": "Malware payload", "value": "bbd6bc86df76f2884703de2fcc8124ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221725, "uuid": "ec088737-c824-4e80-9225-b61cad675e0a", "comment": "Malware payload", "value": "8791eea0dea39ae6ad8745453e2e29d1372f03c82401f6fa388bb341379bcd52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221725, "uuid": "67482067-77b6-468b-9933-14e9c2a10d77", "comment": "Malware payload", "value": "035300a0028fbf60af21a78ee686de3c2eba3de4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221725, "uuid": "98fd4bed-05e9-46f5-8cd6-5e18aca2a6e9", "comment": "Malware payload", "value": "dcf4a7e089830c7a95e3103adebd02926967db9c37afb7801fa329d9bf3e46eebedeb857241ed51a952a280c662793f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221725, "uuid": "61775ad7-fc36-438a-bb2e-0998f6418b5f", "value": "T14F06335055C012CAF698DD1E57DC3A35123FEECF38B8ADE3955283F1040EE85DA726A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221725, "uuid": "dac3f967-6ef8-4276-b7a9-3b904da1a0f1", "value": "98304:G1wwAjzIQOMK2GNKslgus10Y1/UJ7BdlRbTBAlYVz:G1wwAYBr21uQsJ7vTBAlYVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637221725, "uuid": "1f09015f-9be0-4bab-b56d-424f526d79e9", "value": 3997696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637221725, "uuid": "8d2d73d9-5bb0-427f-a109-f19cb6738649", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221725, "uuid": "39ec42df-47fe-4db7-8c4d-ba80dc7e3ee9", "value": "8791eea0dea39ae6ad8745453e2e29d1372f03c82401f6fa388bb341379bcd52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb321c17-489c-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637259960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259960, "uuid": "a573f4e0-a284-4837-b858-2222d34c4a67", "comment": "Malware payload (RaccoonStealer)", "value": "2d1bd8a6abe634eca3ed468d60bd82b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259960, "uuid": "967b19e8-6e5d-42aa-8796-8f571a168c48", "comment": "Malware payload (RaccoonStealer)", "value": "87da691d7cc3e60c8cfcdd20e2499c1e37e21a615e6e3ec4a0317a3af0227ada", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259960, "uuid": "f5fe3720-a3b6-429d-8b62-5acc5a31c7f1", "comment": "Malware payload (RaccoonStealer)", "value": "52d5931aec6da2cd63a9a3f750bc0fbe87a6366d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259960, "uuid": "d0dcface-87e3-400e-9e05-ebc940d33cc3", "comment": "Malware payload (RaccoonStealer)", "value": "928ee9db9fc732680cc2c5ceaf57960f655178e660739207172b30577ae4f1e3c232179f5774e56e595bf71e5f70d4c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259960, "uuid": "124aceed-3182-4996-994a-632406b0b62c", "value": "T1EC55DF023ED1DB75F627CBB1F820A251C32868D23E35E6495F8673C955A3B8C2A1167F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259960, "uuid": "78b5da24-2e10-4e66-a694-b63ab4a01c9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259960, "uuid": "f4fa1831-a6e6-4794-b12f-ebf53b7511b3", "value": "24576:mOwJ9+pmM81WAtgK2fjdWyfkH6JVRC0HR7:kvwMzOjdTYaC0x7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637259960, "uuid": "bf951d49-a943-4a3d-8ce5-ae58b6a05097", "value": 1310536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637259960, "uuid": "64fa0e03-b51b-4ba2-9d67-2c46f6583cd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259960, "uuid": "e8bb9848-f8ab-49c1-a3b5-a64a0df93245", "value": "2d1bd8a6abe634eca3ed468d60bd82b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "408229e0-4823-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637207678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207678, "uuid": "e19db5b7-2b3d-4cf3-8074-d5c8837d0207", "comment": "Malware payload (Mirai)", "value": "1d901917829d8420958793c62ebc674f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207678, "uuid": "15ec5e8b-73bb-4abc-9f65-612cc1a9f613", "comment": "Malware payload (Mirai)", "value": "87db055bee5c89ee6d8d71531436cae9f41046810ff1dc7e498b7e62c366cf3d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207678, "uuid": "c4bfbdca-e2ea-4606-958c-e628721a3c0b", "comment": "Malware payload (Mirai)", "value": "ad576792acfa7502ef3f8776b9e6da6092b8bf86", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207678, "uuid": "e49a0178-ff4a-458d-a97e-f328c06a6adf", "comment": "Malware payload (Mirai)", "value": "017f08b115c73a2f171481a19da921d62b8310469ac1436e972c61f2ea32281cb8eb5659cd5b12868fbe2376b618807b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207678, "uuid": "dedf6ae9-1eb2-407f-bc09-7a3f332cfde3", "value": "T1DF933A3773A5C97FC057A1F82AEA86A2E422FD3D0530A06E33D17E952F359D02959723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207678, "uuid": "85a3256f-299c-4e6b-9025-a25a1df7a019", "value": "1536:7nirULBtKUjZ4LkRR+qSlMlcWX8e+LWO1Bs0W5nh7oOkDVmovsIzu3hq0q0:birhUj2W5h+bw5ZoOkDXvsIzShqB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637207678, "uuid": "2c3fc5db-8f3f-4e32-abe2-d7f228b0cd2a", "value": 95736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637207678, "uuid": "c9cb4f1b-a9f7-447b-a423-c93dcb34ce45", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207678, "uuid": "e202b03a-10b0-4126-b927-3c09d28f1764", "value": "1d901917829d8420958793c62ebc674f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210a85fb-4883-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637248857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637248857, "uuid": "ec98e57e-a461-4d19-b783-16273581d90c", "comment": "Malware payload (Dridex)", "value": "4e56e551c6c189a52d3e890f84394842", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637248857, "uuid": "7872fff7-50a9-4920-a487-bbc0b39bb08e", "comment": "Malware payload (Dridex)", "value": "87ec152bfeda4a61988a9ade1dd1f45e2f39e7030b584be83de9da95d53a299e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637248857, "uuid": "2867772a-ba73-4001-aa5b-24f7aa9e6717", "comment": "Malware payload (Dridex)", "value": "a4101d34d5dbf7d7248750937905202ec6723037", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637248857, "uuid": "46822762-7749-4587-ade8-97bcea9ba13f", "comment": "Malware payload (Dridex)", "value": "85197c4cffd7fab31e5b0e9944a2a1a2a65811afd18bc4d0f6c6c9ea72f6eec37339a9837a119b9ff46f12c1cac8c821", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637248857, "uuid": "548a5635-dcac-4a94-846f-d8d6b41f295a", "value": "T164E48E0250D512FCFA898ABF155A67C1C6B310824ED1CB9E25CD07EADF64A03EE6D1B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637248857, "uuid": "a39e0e98-9737-49b2-b2f2-4a5979259f94", "value": "fe16443ce39f2fcea9c5accdb27a9eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637248857, "uuid": "4d1e5949-42ad-47a7-8e8b-ce3c8b180549", "value": "12288:8KTlJzJzJBJZn/JH3lJxJLJZJdPgA1VKBUA1rlldgJw:8KJtpDv/lVbdT3IA1wBUA1rlldgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637248857, "uuid": "f8e1f1fe-9e44-47b7-9286-d53657d910b2", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637248857, "uuid": "8b2c9ed2-9a75-42a0-99e9-d032412a0e90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637248857, "uuid": "e4a62ae0-624c-4dfc-be64-ef70328a33a5", "value": "4e56e551c6c189a52d3e890f84394842", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f1e9e24-480c-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637197878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197878, "uuid": "c591e341-0ff2-451a-8a54-d2f445967452", "comment": "Malware payload (Heodo)", "value": "149702de248ad62d7dc27f8b706f6880", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197878, "uuid": "8271c345-48e7-4ef0-920e-44cdb68808ac", "comment": "Malware payload (Heodo)", "value": "890a46e8cfa929a50cf4458434121adf606cbc57290b567c97e7d34282f60955", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197878, "uuid": "ac646a3c-1998-4749-a62a-4a3069e3f880", "comment": "Malware payload (Heodo)", "value": "0f4d19c6a633839a50f2d8a551208ab919d1cad9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197878, "uuid": "30d72a08-0b10-4e09-9c70-39cbe38c2e76", "comment": "Malware payload (Heodo)", "value": "0fa0377f8598ae98bc4af236c917b9676868a046dccd6b5619f0343a689ba565c1fdda60ba9ae64d72d808c1ae930cbe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197878, "uuid": "e6c98d5a-ebe8-4b3d-a038-a5160d888f02", "value": "T1A544BF10B1809032E8BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197878, "uuid": "599df35c-ae00-46a2-b75c-8fa2345c2cff", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197878, "uuid": "e84b490f-c27a-428e-8661-16af5aebef37", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTB66asb:prf+WPVXNcwUKaWTvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637197878, "uuid": "9d66a031-d3e5-47c8-8c94-fc3b964195fa", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637197878, "uuid": "d2242a92-5eed-402f-bdef-11654b32976c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197878, "uuid": "3881009a-2fb9-4833-8a56-6e589b57eb16", "value": "149702de248ad62d7dc27f8b706f6880", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a432f60-488b-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637252496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637252496, "uuid": "c20941d2-836c-4e1a-8673-850b4672e00b", "comment": "Malware payload (Formbook)", "value": "f90d076815f8e877b6b4f7c5dc6ce5f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637252496, "uuid": "a06f8870-9b6d-435c-8e4d-c4b6c19988f7", "comment": "Malware payload (Formbook)", "value": "894f9fa39a5922cc3ec8d79c7957cfacbb99ce27c2b3babdb23e061a5a178ddc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637252496, "uuid": "cbd30a58-c339-4949-b3d9-104d4e056c68", "comment": "Malware payload (Formbook)", "value": "844dde3c2ffbcb7eafeaf4b9a9449f295ccc819b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637252496, "uuid": "dbeaa122-d950-4254-84b1-e8a7ed6efcb9", "comment": "Malware payload (Formbook)", "value": "d53ebefa441ef5e4b130bcdb94575a7a661b76239da4e1b6da3e06decd879503f36d267c0eb35e982257d31581bec538", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637252496, "uuid": "9f2568f3-3bbe-42a0-8ed2-464606df6915", "value": "T1B8B4E0677E89D857CC508D3124DAF3A299BDAFC172674213A320FBAD76308DD8B29D41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637252496, "uuid": "d19828c8-f20e-4d20-a56a-752d44898198", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637252496, "uuid": "9df583db-622e-45a6-80a2-131af2de59be", "value": "12288:kp9jKFFXBlpoh1xxZCyDAh8vgk5C4JpH3:kp9jKvBlAxxZBDAKvgepH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637252496, "uuid": "8a5a9b9c-8c20-4747-a14d-4008434e9ede", "value": 531820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637252496, "uuid": "acd774fd-47f4-4933-bf13-be530ce08228", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637252496, "uuid": "05669b82-f280-4cf4-bc1f-e7f7d5e21aee", "value": "PO N0-2600002488_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e09b42a-485c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637232263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232263, "uuid": "6844401c-e606-44a8-b744-70c0b8253641", "comment": "Malware payload (Formbook)", "value": "d93485214a34d7f7a47854960cf51e89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232263, "uuid": "c310a451-45aa-4c64-a020-9d98140b6f93", "comment": "Malware payload (Formbook)", "value": "8968808899b3e810e675fc87e6ff0f61c82b444183fd7f8febdb276eee05e683", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232263, "uuid": "ce52d76e-a834-49b3-b2fd-d8a029e51111", "comment": "Malware payload (Formbook)", "value": "c56b0862d03eb581ce6e75fe356debadee618bb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232263, "uuid": "98adc2cc-84fa-462b-8f1e-ae37b2e689cb", "comment": "Malware payload (Formbook)", "value": "d884034c9fc5f4deefe9d6cd3b056593d64878fdab5d63620f68ba5b119a1a32a77b1e1fb12bb0f020d21f22e3b43378", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232263, "uuid": "f7dee794-67da-4179-ad1c-0637931dd2d7", "value": "T1D0358E3A7350C83BC1732FB8E95B56F55C1ABE58AD20844B73B43E5EAFB5140342938A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232263, "uuid": "a5a65211-e1c3-471d-9fd9-99bd33bf6437", "value": "9932ed6ef0f007ba412ff7a0ba590c83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232263, "uuid": "c26ee5ee-a849-4e7b-9e2f-43d893cbdbe0", "value": "24576:IAysw0SxuOso3abg4gGJaysrP/mJXgESvLqk:IAySo3vGJaysrP/mJXg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637232263, "uuid": "47ca7a9e-5590-4f32-8dfc-da329232308a", "value": 1112576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637232263, "uuid": "32021096-e9df-4cbf-a1e3-190a1ee4c705", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232263, "uuid": "a48b9a45-c657-4b3d-8004-cb83953b0025", "value": "d93485214a34d7f7a47854960cf51e89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f938d50a-487a-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637245354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245354, "uuid": "fa414ba7-2cce-404f-9b2c-4bf19c90ef02", "comment": "Malware payload (Heodo)", "value": "bece135a19e8d73b4e14f0dc74304436", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245354, "uuid": "d6cfd576-cdf5-49a5-8e73-edf55247eb83", "comment": "Malware payload (Heodo)", "value": "89bf1bc064539d9dea44dac2c5ffdf25f825c1db8f0cec8b872d6fb2fb09ce85", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245354, "uuid": "936537c5-26a8-4d00-a2c3-4916957ac968", "comment": "Malware payload (Heodo)", "value": "86474d6754396b63a165efc26814861451640aee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245354, "uuid": "7cb2ac0b-1d2f-4ba6-8762-e8655faa7e68", "comment": "Malware payload (Heodo)", "value": "d9c75698187226fea4c3b5af5677d09ef2d7d3ffae3be218903e251c52e1c2359ab5e363cb3e9fd4b8d0f7d648765e75", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245354, "uuid": "db8d6823-07e2-44df-a4d1-eb156a6525ca", "value": "T179A4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245354, "uuid": "d8f8f12d-bc7e-4a34-a39c-fd5014ab24f6", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245354, "uuid": "140b520b-0fc2-4c8d-b96f-ebf440814355", "value": "12288:bdv8jkvzqZvv2wLBWmTi12yD88kYwZ1h1:b2Zvv2cBTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637245354, "uuid": "7c57e8c3-a74c-4028-a33a-12cda9a42910", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637245354, "uuid": "76b5b5ea-9b97-4251-9322-0820ec69f428", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245354, "uuid": "2eb838d1-8922-42ca-9e3a-5b07d3fb19a4", "value": "emotet_exe_e5_89bf1bc064539d9dea44dac2c5ffdf25f825c1db8f0cec8b872d6fb2fb09ce85_2021-11-18__142228.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896e8a8e-483f-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637219826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637219826, "uuid": "59175804-d990-478a-a23a-cc683f55a478", "comment": "Malware payload (RaccoonStealer)", "value": "9d6933a15b542014eabeecddd013fda1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637219826, "uuid": "5134d291-471d-4480-99db-fcaf351da54a", "comment": "Malware payload (RaccoonStealer)", "value": "89cd51fc68d776d4747865626b83cbfcde7b112387b9bdcd14f8ed9d0b01f88f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637219826, "uuid": "7bd094c3-1388-44c0-8249-7f75611e2ab5", "comment": "Malware payload (RaccoonStealer)", "value": "41cbef358e965ca8a0e76e682c84abf3c2776e9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637219826, "uuid": "f7cb56a5-8370-4b88-8169-a85560efda3c", "comment": "Malware payload (RaccoonStealer)", "value": "99fdea2485a7dad01b929c628d73a5b1a1ff30b479e5859ad5b184e3c1f2f2532f4b36a84600d4d8033a98fa4493271f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637219826, "uuid": "72f7615c-b24f-4450-9ca9-a2a015587287", "value": "T1DDC47D06B690C072D9730875C9B6A6B2DA3D3C24873496DFA7D43E392F717C0A93971A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637219826, "uuid": "ea474149-7623-4e07-ba08-1ebbc91f8ce8", "value": "9f1127f86499f6cda40cf38ebb837b1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637219826, "uuid": "84c0ead4-73f5-4d05-8edc-456b51d0225a", "value": "12288:HLGQiID9fAHptNZrH5yW1+557sjuu5yGI/xMwZ4nZ25Xtmf:HLSokH5b1+MjP0xr4n45u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637219826, "uuid": "3de2dd08-e418-44d4-8ce6-f0ac0e7274c1", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637219826, "uuid": "ea7b38d7-483b-4be6-baf5-718a35afa937", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637219826, "uuid": "83a3af7a-b4fd-47f8-8777-68a8a30564de", "value": "9d6933a15b542014eabeecddd013fda1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc01f404-480b-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637197577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197577, "uuid": "1dc8efd4-3f59-407c-8aff-8b37e3a3c44d", "comment": "Malware payload (Heodo)", "value": "07137738691d2c10fa9b5af20534c486", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197577, "uuid": "74e791f9-703f-4c47-9b41-35af332962ab", "comment": "Malware payload (Heodo)", "value": "8b9dcddcdf9121bcca2300a543547acf4757f0966fdf2664e79be9ad22865452", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197577, "uuid": "934e0b2c-25f5-4bb0-876c-43b772cac95a", "comment": "Malware payload (Heodo)", "value": "847914e10633cb8b47d18e126b02d88673aee35f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197577, "uuid": "3d295d10-ce0d-4634-8904-19fa5570a11e", "comment": "Malware payload (Heodo)", "value": "e0290c6808a9fd855596cdb92fe1b1a18e66e653862dc090cd085c40bad87991437e52a94ca754b0776ca8765c7b51a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197577, "uuid": "6a928074-f63b-496c-b53a-1e71c23a1b92", "value": "T12944BF10B1809032E9BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197577, "uuid": "a96d6ae9-96f7-44ff-856b-d19f2e93bba7", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197577, "uuid": "84585f60-de9e-491f-9137-9935151c00c1", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBq6asb:prf+WPVXNcwUKaWTzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637197577, "uuid": "c58e87d2-323f-40a0-9940-19467c70870c", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637197577, "uuid": "cabd015e-f372-46bf-98ac-ea2ed72d5efa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197577, "uuid": "2069639d-5959-49ad-9d6b-645b452e9716", "value": "07137738691d2c10fa9b5af20534c486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae15ba2c-4839-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637217311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637217311, "uuid": "1ed11d30-58eb-4ada-8bc9-f90a8af5469e", "comment": "Malware payload (AgentTesla)", "value": "f8c97e6f6236cde1ba17f90005908a04", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637217311, "uuid": "3649a45e-8b1b-434b-8197-79597b9607f5", "comment": "Malware payload (AgentTesla)", "value": "8d3ce7000835474fe760b962dafed1655422b712735ae6fc660755e5ea64c78f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637217311, "uuid": "aa3e9c34-d39a-4309-a9a7-c769f995ff37", "comment": "Malware payload (AgentTesla)", "value": "e2d62df5e108cfe1bc87e81ed776aa2a4bbbcd80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637217311, "uuid": "6b9a7a21-c84b-4b08-a973-5d134d2e78b3", "comment": "Malware payload (AgentTesla)", "value": "3ca97ff6a107e6cfdf0e2625902fb8a176b45f2caa6e956e322190357231ad03dd94571f189e2cdd3e8699e0a7749170", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637217311, "uuid": "b4a068fd-897a-468b-9f35-73ac8a3dcdc4", "value": "T1693539A931D530DFC733D9B39FD99C6D9A4178BB430BA2276143369A862D943CE413B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637217311, "uuid": "b8236fe5-7a88-4b23-af4b-55b452b6cd1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637217311, "uuid": "d00e68e9-d95f-4136-8455-a659e4f167d3", "value": "12288:xN9SZaNvZlROfK0uEneEpCI8iybCVbwPi5ymFD/E5xEOBZjvUomPrhax6El/grHr:znLb0QQCIMbgbwap+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637217311, "uuid": "6ff2b4a2-e572-4c5a-88ba-a8052e9525d9", "value": 1082368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637217311, "uuid": "c2e9ed35-5ccf-4b02-90e0-5b31a0ac64db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637217311, "uuid": "36960986-6f9a-4d70-b95a-70c37fb965f2", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f9aeb16-48a4-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1637263028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263028, "uuid": "da95f84a-94f5-4a8c-8a30-85e608be4743", "comment": "Malware payload (njrat)", "value": "76d64bdec97716fc5db19bf4d9fd3255", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263028, "uuid": "75ca238a-a110-43d9-ae69-0d87235c680b", "comment": "Malware payload (njrat)", "value": "8d8c15469072ede8e80eb85c7f3ef44ba53778831c28dab5a6562a0672b1bc72", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263028, "uuid": "2343b64e-edee-44a1-a058-17c0cbab2f40", "comment": "Malware payload (njrat)", "value": "35f62e6cc17c8bc982db07c556216d98fd600c02", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263028, "uuid": "594358f0-0bca-40e0-8f20-831bf321bdc2", "comment": "Malware payload (njrat)", "value": "ebefc46b2cccd802596e6eaaaa07cdbc4e24ebd73318683b5d52e5d18e7e5220b8d280c33fa4d6dedcfe64c45442e606", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263028, "uuid": "fda88b0b-d653-4e20-987a-60791bacd22f", "value": "T17E417B38FD1BBB824831F57661A78CD5CEEC1017DB443C3C21124C7849918BD6A9C0BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263028, "uuid": "059489d1-3ed7-461c-bad0-161478a801af", "value": "24:JVkNGJYuIoviVLF5FFOY9NFMffNx0WVPvyJCCKaV7A9F0ZTFkFo9bFQZpFOyoQeM:bXgHpUfXbVPaEqnIoTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637263028, "uuid": "ef76e751-46e3-4b3d-bebe-a0f8a1533ea2", "value": 2283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637263028, "uuid": "fd1c69d4-9cae-49ff-b2bc-591ac62a41e9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263028, "uuid": "e1cb8567-0578-4474-88a8-27a7d9c0e579", "value": "N2K18_Payment_Copy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c720866-48ca-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637279558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279558, "uuid": "77e0d5b9-f5a7-4891-9976-f2c860ef792a", "comment": "Malware payload", "value": "9369750d8d21d8fcb1b35365f232625f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279558, "uuid": "7577c82a-c62e-4f27-8110-fa22658095a6", "comment": "Malware payload", "value": "8d91807aa27ee93694388b7cbfa9d74a3d93407036650cdd29631360b675853f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279558, "uuid": "46a10545-2201-47b4-b812-4606a0731280", "comment": "Malware payload", "value": "30902a381e823450780e0efbbdc4d4130a032e20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279558, "uuid": "3e29668b-8fa8-475b-89d9-101161d0fccb", "comment": "Malware payload", "value": "40e1b8ad8627a46f453fa295da5e26e44847fde5f099596c5d6e3740af36bf58a09cf01e092b7e73fdd6812840623f1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279558, "uuid": "bad18e8e-5cd0-474a-973a-bd67e8a93868", "value": "T157A4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279558, "uuid": "e61ff3c7-18c8-495c-a9f9-dcb03deea489", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279558, "uuid": "43578487-3d8e-4a14-971c-3071b3a55bd5", "value": "12288:bdv8jkvzqZvv2wLBVmTi12yD88kYwZ1h1:b2Zvv2ccTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637279558, "uuid": "26ddbff4-e0bc-4b9d-be5b-cedb5dc34769", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637279558, "uuid": "740993e3-97fd-41d5-8c16-dd03753ccc3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279558, "uuid": "d007d907-d2d9-4fb3-b0af-8240430b18b3", "value": "9369750d8d21d8fcb1b35365f232625f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d6e868-48ad-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637267149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267149, "uuid": "80c77726-eb44-4c96-9c22-0767aedbf01b", "comment": "Malware payload (Mirai)", "value": "280bd4233f96397bef827d47985fb4eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267149, "uuid": "93545f7f-972a-4170-8cc4-760eba30fa4c", "comment": "Malware payload (Mirai)", "value": "8da37c10f195feb243e73be31c1961d0ded740b720c324977a14c4cb59eee971", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267149, "uuid": "507625fb-5e7e-45bb-a2b0-b263d5b88fef", "comment": "Malware payload (Mirai)", "value": "8e587bd6bf81ff20738bba50861f0fd4d798e5c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267149, "uuid": "58e0c309-e994-4271-8702-bf00f22f9c74", "comment": "Malware payload (Mirai)", "value": "9393277b26d55d8eea2e38150f8d3f4c30d8111cbf70ded9dfb0e77f06ea048b59e7a12db34fea3e7f6a741cc5baa283", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267149, "uuid": "d6868c57-bbd6-4a12-adf5-4c94b72e1eb3", "value": "T1BF332B027228494FF9E61EF0353F0FE093AFE98024E0B585694EEB458676F771586F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267149, "uuid": "e5deb853-fc16-44d8-986f-6b7a4a248748", "value": "768:opgPdUwOe1Po/7wni3RiAPSnPfvPK5Ctjcxt8mizjrvVwipnpBX9Qej3:D1FOe1Po/kcE94Fomi6wvXey3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637267149, "uuid": "2edd313f-fc88-4536-8358-89aa39be995e", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637267149, "uuid": "9b46d670-5153-46db-8422-16f5375428ed", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267149, "uuid": "cb8c01a7-61cf-4039-92f4-855c5d48ffdf", "value": "280bd4233f96397bef827d47985fb4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed743ab5-4865-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1637236315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637236315, "uuid": "3c891921-73c2-4167-bb2b-ab56072bddfb", "comment": "Malware payload (GuLoader)", "value": "a758a0bb452f696d7421ad2e945c9f1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637236315, "uuid": "d4f4ba6d-56aa-43e3-b734-eb505e3309d9", "comment": "Malware payload (GuLoader)", "value": "8ec1dc64d2249cebaab4d9e31d53e3779c0c52d7f1ae7b04b1e8d2a54ca5b71f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637236315, "uuid": "814abacd-1996-4367-8965-e0b2b1070796", "comment": "Malware payload (GuLoader)", "value": "7c62c305b345214dbf9529c2550e33e1039d10a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637236315, "uuid": "4408b6fe-01b1-47af-a7bf-9e5dd2e54c8c", "comment": "Malware payload (GuLoader)", "value": "805dac03ea813f1d48a91692670b8efd407811b79aaa51d5c4da6072492f72b698ed814d3e18dcae453f2322c913409f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637236315, "uuid": "ef9a3db5-0f81-4fcd-8161-8c69f3ba9027", "value": "T18C24D5017A05EA2AC814E4F16930D70F5301FB33623A3BEBBAC57799A5745F368B5A0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637236315, "uuid": "09f62112-6354-441a-b342-e7ee888eb705", "value": "f104c0d3c5e62753d0f5e557895a5e41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637236315, "uuid": "e1421d62-96b6-460b-b52a-b6fe7f04b680", "value": "3072:Cka5H3dV5vCbZyxWfUqlpsbaH4BfduXU0OdGJ:CVHA0Ec6T4r0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637236315, "uuid": "9aee3c74-1e78-40ea-b772-a7f02f02ac63", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637236315, "uuid": "a9e480fb-7816-49be-ad91-2c397f0f5aab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637236315, "uuid": "d479dfe8-e744-4bd9-9d1b-8ed4e2c95cc6", "value": "Solicitud de Pedido N\u00ba 111700028645.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae542fab-48a2-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637262408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262408, "uuid": "1d017fa3-3107-45a7-b50f-29b27db0f457", "comment": "Malware payload (RedLineStealer)", "value": "822ee7026cc416eab1f36a87fc4d4b86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262408, "uuid": "dab596d2-a8b4-4b24-a75f-2960e6373252", "comment": "Malware payload (RedLineStealer)", "value": "8ec387e2f939562019e489bedf349bb3807713a0168021ec2505aa7d392b04d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262408, "uuid": "8efa8b6b-2e51-4ec7-90b6-0a51aff8f9db", "comment": "Malware payload (RedLineStealer)", "value": "d6ceb502b92e9f46d4796cf8be16d98434cfdbff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262408, "uuid": "aacf453f-74c5-46a2-91c3-e5fdcc4c6a61", "comment": "Malware payload (RedLineStealer)", "value": "e92d9f894f36cc1d9b2b0ef3981a675ec5de968b4449d395ec994bbbe215cccaf36629b60b8063b5779b232383726b75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262408, "uuid": "f4db1af0-3541-418f-9672-0ee31fb94abd", "value": "T105453393D9C39C8DD60B56B44ED016F78A983212B9C4B71AB12F2C8F4E6950DC7BD9C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262408, "uuid": "17764709-6c4e-4a79-8aea-2d31302854c1", "value": "15aeac4aa1d11f9ad3fc4c4ac7bb9468", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262408, "uuid": "2385f842-ab7d-4543-8477-ca1b66336563", "value": "24576:UGIPiEpVt3BySXHo5RtUJ+P4cxw+zUtk4eBawEBbCMXKk96vkEaHNYK3h1ZOeQqN:UGIPiEpVt04o5RCAdxQtk4gubCMXn9uo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637262408, "uuid": "e8cd6fed-1ba9-484e-a9a7-77344878ca78", "value": 1271296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637262408, "uuid": "ce3222d5-f480-4f08-a326-ac29c77956e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262408, "uuid": "866ff127-653d-4dc1-918d-2a6dfbf25860", "value": "8ec387e2f939562019e489bedf349bb3807713a016802.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8baa5864-486d-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1637239587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239587, "uuid": "ecdcaf2b-91b3-405a-8ef2-942fcf65c7fb", "comment": "Malware payload (RemcosRAT)", "value": "89459f4bbafdeac7ae4d11de0b098a6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239587, "uuid": "541bf329-1a0a-40ee-a1b2-d7f54c1977e3", "comment": "Malware payload (RemcosRAT)", "value": "8f173cf55118549a76b1cdfc51a9969bc6b737d19440e8160a8f20d0ed5a7dc5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239587, "uuid": "5bfaa6d3-e096-474f-bf76-1d4b7325e25b", "comment": "Malware payload (RemcosRAT)", "value": "289554f8b3512caac5f94249cabae31df427414b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239587, "uuid": "5892addd-18c4-47f0-a292-e8edc930ad0a", "comment": "Malware payload (RemcosRAT)", "value": "fd966bf7ca7bd71aee72850dca9f1228a8b49dc0af15f2fd130b87e6ad72bdf229ced1810f146c6a9611a08e5bfb42e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239587, "uuid": "ad979ad0-1113-4e3f-809d-3e868e5e708e", "value": "T1CB25E0A12978CF63E33F8175C5A4D6BA8A733D6C2CD1C3C578992E8F3A657607819213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239587, "uuid": "a0017f40-cb6f-4af4-bdf2-14c9be90a6d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239587, "uuid": "46bc6e08-1430-4148-bbe0-b7bb8011dd05", "value": "24576:hm3KWNmOlkYrlSY8D5+dLdXQ+WhREYjf:43F83ulSY8D5+5Vjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637239587, "uuid": "71f4c52a-6b09-4678-8fa3-7d61e7377b18", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637239587, "uuid": "ccaa8a73-782b-413e-aaad-d129532e5457", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239587, "uuid": "fa823a09-ee3b-4efa-9ac6-c897bb8c4342", "value": "89459f4bbafdeac7ae4d11de0b098a6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c394b9-484f-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1637226717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226717, "uuid": "b448bd8f-cfed-4a0b-84ff-9e422adf8cc9", "comment": "Malware payload (njrat)", "value": "dffaf08a25150b38c19210c180862aeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226717, "uuid": "c856130c-874e-4884-a31e-e6d9980dfaf0", "comment": "Malware payload (njrat)", "value": "8fdbfbf55033187c6a4d3cd7d42394cd56cbd3b5a9dc905e72aef2886172be36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226717, "uuid": "fb75c116-1305-48b6-ac6c-143881b5b904", "comment": "Malware payload (njrat)", "value": "a28b135b64a08d5ed30621aac5c3e955d4d090fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226717, "uuid": "12b3c546-1130-40a4-a392-d61e67ff4f11", "comment": "Malware payload (njrat)", "value": "d5c9cc9fb05a5c2c7fa9e3464f6881e55329166f5c5f0bd721052f28954a3d2573d2ac8a9dc52e4d71d9c4296050efff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226717, "uuid": "e17a53b6-6fb4-4b8c-a81e-448fc92ae1c7", "value": "T17A7533986D5DA0C9C498027DC80CB85A2D731FF05A024927BBB57EDFFBB0598C1C9B99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226717, "uuid": "a2ed9618-209b-4995-a00c-d9e77ff0c309", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226717, "uuid": "c7358434-2a99-40cd-be68-b22dfe6a3bed", "value": "24576:Db9maw2TucZ2p7oPGutOb82k3QfRq661wRISp5iygGVBi9NTFABQHFidcQKwY:VgZWfu79UOq61IYLOZUQHifKwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226717, "uuid": "2752168a-8e4b-426d-9979-a7e05fbab6c9", "value": 1634464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226717, "uuid": "c61c98e1-5428-4670-acd7-da83e5a51798", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226717, "uuid": "c09c253d-69b9-495b-874a-7e0a00423896", "value": "dffaf08a25150b38c19210c180862aeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59f3609-488c-11ec-843c-42010a9c0014", "comment": "Malware payload (CryptBot)", "timestamp": 1637253079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637253079, "uuid": "3e482618-f60a-4742-984e-b94284e9c8c7", "comment": "Malware payload (CryptBot)", "value": "755ebe42ffa07fe0a24f21681a314d44", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637253079, "uuid": "b7c06557-5c54-443d-849b-01f4198975c2", "comment": "Malware payload (CryptBot)", "value": "8fee491edf91da322784a560a7f4544226dd9f29cdaf5f6d09040dd06fd6a1a0", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637253079, "uuid": "f1e178a1-f763-4ab2-a435-048376945fca", "comment": "Malware payload (CryptBot)", "value": "afb9a97461ceb5bbf04400bf85c973c611a5b01d", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637253079, "uuid": "b5bb74be-a88b-4d5e-9c2a-a99f53e92fcf", "comment": "Malware payload (CryptBot)", "value": "7c0e35ca9d6f0a10c205866a4e70fee5aafd147241b15f030f8b7735c8efa57c51d1958728d9095aa74a6fa435558a31", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637253079, "uuid": "3de9897e-8c4f-4210-a410-f16766db7059", "value": "T1F0054BE0F82AAF57E277C57C9C18B6DCDAE414B2DE03D0BA7095EDA054B2380D519B2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637253079, "uuid": "400578ba-c968-4d59-bf4a-696f54ccd813", "value": "c34e11db92473175947624b5e890b7ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637253079, "uuid": "045fb723-d0ab-42d9-81e9-f36d39b0b850", "value": "12288:oYkqd9JDBkQncz0CD6e98RdT2/xCBaWFc59NLVislUfM1B0MfDQJBF:yq9B3A0+6hRF25CaZDfrQJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637253079, "uuid": "e344cdae-b5bd-4b4b-9c59-99e4ea9c03b6", "value": 868464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637253079, "uuid": "117f382c-d355-4e52-9634-403ec02c95cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637253079, "uuid": "fc163fb5-3fb9-432f-afca-4f552b453d2a", "value": "p3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b691e1a0-480f-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637199286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637199286, "uuid": "e924a248-c2dc-4eaf-acd5-af29ca1faee0", "comment": "Malware payload (RedLineStealer)", "value": "7ac3f25c9146b54f113475a1538e1f51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637199286, "uuid": "d2b90f7a-c5d3-4293-b94c-6874c851043d", "comment": "Malware payload (RedLineStealer)", "value": "9080ad18b8544be796e953db1fd42c8f4364859e28a6d1dfbf64b33d2fddac66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637199286, "uuid": "f07274e9-d5cb-44b5-a688-9b8492cc58d8", "comment": "Malware payload (RedLineStealer)", "value": "8fc0dd0da3f76e59113b3e67aee4656ef6906c85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637199286, "uuid": "b1358af9-1eaf-4ef5-99a2-28545b3590e8", "comment": "Malware payload (RedLineStealer)", "value": "818d494ddf64ca00fee06dc7461eab0135390d6dbb543551cee7c7af34fa76522c1b7758a0e1ce81e593ba908fbc4eeb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637199286, "uuid": "962ae544-0581-4be7-b9cd-95ba8bd70ab2", "value": "T1FEE43F0B2ED6D509E9932372CAE3A734BFB711DC331387C87B1846898EAB2915F91D54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637199286, "uuid": "4313f3d5-5f64-4973-af02-0baff5eb9406", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637199286, "uuid": "bc136230-b97d-407a-bba0-d2566ed3d894", "value": "6144:u14kjlJJE/sTLmqwk11tZOaiA5DeH6LocOTzLpMHCG7Y6kRuY+hCDXSiELOwFZ:u11jlY/ElzvAcO3pOCG7Y6k4Y+hgCtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637199286, "uuid": "33bb5d7e-27ce-434a-b08d-ea6ee9c144aa", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637199286, "uuid": "c9d2a868-a4d1-4bcc-93f1-b6963151a1cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637199286, "uuid": "d1e061d7-d4ba-4c41-9ac4-f207b0d5f308", "value": "7ac3f25c9146b54f113475a1538e1f51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c4eb9b-48b6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637271033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637271033, "uuid": "4c0eb59f-b2eb-4f47-bfa6-88ea85dcf653", "comment": "Malware payload", "value": "4a8bd2b38336ed80ec1035543554adbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637271033, "uuid": "3f85a415-bdab-4269-a084-1ae9047a6baf", "comment": "Malware payload", "value": "90d96faaad24677c1540112836990156c17cf4dcf99aa8570a71b4b52863a391", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637271033, "uuid": "004653b9-5229-4556-9c61-248de66d0812", "comment": "Malware payload", "value": "8e308053be53d0aba7ac0de7dfe2e3923f3e43f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637271033, "uuid": "f2b3c0d2-e7c8-4d0f-8f8d-d36aa86f43ac", "comment": "Malware payload", "value": "d9630fb9342c775e5ea1cf2c95c141701cdd9f09ffb7e3e8e94d642a5f195e4a4b3db1936af46aa5ec7cd8f24bdd364d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637271033, "uuid": "23e2c685-6003-4172-8c3b-566c322a923f", "value": "T11DA4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637271033, "uuid": "98ceee56-6f39-43c4-ae49-1159a9afd81e", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637271033, "uuid": "d3ad35e8-6abf-4523-9f3d-df7ec54a2f0e", "value": "12288:bdv8jkvzqZvv2wLBFmTi12yD88kYwZ1h1:b2Zvv2csTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637271033, "uuid": "e22eb886-b9a9-45b7-85f9-030e8fab601c", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637271033, "uuid": "3eb815eb-eb21-4e19-ae26-407a82651b21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637271033, "uuid": "5ff27500-9309-4069-acd3-15c0a01038cf", "value": "4a8bd2b38336ed80ec1035543554adbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a98e1a-489c-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637259948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259948, "uuid": "cd24445b-ce4e-447a-8375-ff7d5b86dc81", "comment": "Malware payload (Smoke Loader)", "value": "707e623446fb1d119571fd8308dbcd0b", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259948, "uuid": "e5f1fbad-48af-4eaf-abc5-ffb82ae3b3a8", "comment": "Malware payload (Smoke Loader)", "value": "915be33599fb782e1cd4e3137cb908b1c1ee8c8674a12c74bcd77c0e97d7b8b9", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259948, "uuid": "704f03af-8548-4fb4-b60f-2dac03c2d9eb", "comment": "Malware payload (Smoke Loader)", "value": "770b209d8cfb6239eb87777b60706e07adf771fc", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259948, "uuid": "d20ccb4b-9afe-45f8-b700-702687911aaf", "comment": "Malware payload (Smoke Loader)", "value": "e1c2f9f47a2ce76bc9b46fdcfdf8bc3b4319658ff7ea71a220df0fd7b22e427e8e4366b73aa18a1302f81543ed193b46", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259948, "uuid": "6ce7e5a9-116e-40b4-bb8c-dccec3d27480", "value": "T133448E10A7A0D034F1B716F849B9A3B8B93F79B16B7194CB62D516EE4635AE0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259948, "uuid": "ddd6fa39-1a5d-4578-b380-3206269f77f9", "value": "9abf03d4e22c0a12cb29c8d67fb192e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259948, "uuid": "b8d3238d-8870-44f1-a8bb-a2606070005e", "value": "3072:b0Npn7yw27Jit+RBPettq5j7vEo7B7z4rOU1Yhc4IYFVunj7PLzXUlpti:kOJm+RZetObd7KrOU6hlpjunfP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637259948, "uuid": "f83e6b76-c436-4fc9-b11d-6065d7ec5485", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637259948, "uuid": "65f93099-b250-462e-8d3b-51edf6b1bebb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259948, "uuid": "4d2bda86-c8c7-4cc9-9edc-28f036442790", "value": "707e623446fb1d119571fd8308dbcd0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ecbb966-4802-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637193636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193636, "uuid": "7c56c778-7a32-47b6-9709-f509c0f84626", "comment": "Malware payload (Dridex)", "value": "2800b01b787dd6756d185ae40cb8548e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193636, "uuid": "179ec0be-b466-4a93-a7cb-8763ac5f15e9", "comment": "Malware payload (Dridex)", "value": "91f9be412fb992a88aef5dc2b905e423a45081fd175deaf9e2cf6f14c34af17f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193636, "uuid": "2651b23e-a63f-41b7-98b3-a00d01e36508", "comment": "Malware payload (Dridex)", "value": "a26bba46214fed963701e67d54ed62bdf7f4087e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193636, "uuid": "eea5f83d-1f23-4345-834d-0ee90c3cd184", "comment": "Malware payload (Dridex)", "value": "44e05d4812cd2a8186d1218f26f1ef6ffd47b31da297ac946a680700c745ef679e30d88014c370a0320acc63ee0671b1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193636, "uuid": "b5e7f4cf-d337-406c-a14a-adda257c9f2c", "value": "T108E4AFEAEA45BC3DD25E14B4A529A4133D8BF98C009ACBC1D971BD16E0FC94E7A1F407", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193636, "uuid": "85e3dff7-8c60-49cf-9de3-f8b1f6cbf3c2", "value": "02156850f54cd7e0fd2be68227189293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193636, "uuid": "43ce6683-f7a7-4e6e-b462-9e1398d72849", "value": "6144:GvooH1bTj5/vvrldK+FrWYtvhkMV3LqQ8JaiwKwmw6wicKdXbXh:GvooS+NpV3eQ8JaUbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193636, "uuid": "4c96a189-a130-47d5-9d2f-43df8b2bcfb7", "value": 668520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193636, "uuid": "d80d3c81-dcb7-4a95-b4e5-0544fbe2e822", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193636, "uuid": "3f8d547a-73b1-4418-a995-9039b51658be", "value": "SecuriteInfo.com.Trojan.Dridex.777.360.24351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b4f6fe-4873-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1637242065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242065, "uuid": "d974a909-58f7-4516-9cfb-36188d8e6efb", "comment": "Malware payload (RemcosRAT)", "value": "a4f0ed4ca9c03e99b507e68d63333610", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242065, "uuid": "ad1e7c38-9290-48e4-996c-a478651a9566", "comment": "Malware payload (RemcosRAT)", "value": "92618958f407b9913e9bfb39580b6583faf48d0ea02f0a2e0bab4ec373a9fc72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242065, "uuid": "05d77062-e6a8-4f93-a465-3cafc92f3d9f", "comment": "Malware payload (RemcosRAT)", "value": "45cfb551ddc4fc97f39cc7481c3c7d5e8f1824f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242065, "uuid": "1ac5a283-7397-444b-a3a8-18230086af4b", "comment": "Malware payload (RemcosRAT)", "value": "a053a55d0a1aea6d976be3bc2ea82f533493126efb2cbe3ccf315f9bd8dead5e8ab6d7eda6fc1fc8d6d782ac87e00ded", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242065, "uuid": "8973be37-f1ae-416f-b255-cd93804eb1e0", "value": "T14D2501107F985EA2D626AE705B53A234C6673E756921D78B2DC035CE24FEBC03623B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242065, "uuid": "633abf7c-6983-4e62-83bd-ec8ccc73e6e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242065, "uuid": "f4544161-b384-4fda-8565-c48ad5aaf973", "value": "24576:J38q+qUMKnOihC99KFnr5gzqSjr9eSC0n4H4444C:OZznOCABJLC0n4H4444C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637242065, "uuid": "c97eba94-9ca4-4dfe-a2a8-765c0c81e1b6", "value": 1025024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637242065, "uuid": "4a9f0366-82c0-45f2-b444-c0c8d8b288c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242065, "uuid": "bc0ff642-b2c0-43c5-b70c-8dd483773661", "value": "a4f0ed4ca9c03e99b507e68d63333610", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb1ee14-483c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637218600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218600, "uuid": "a3d4ee88-0d65-4494-bae5-afb9c0ee0531", "comment": "Malware payload (Formbook)", "value": "8db9b822e7552296d23fa78ed86b04dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218600, "uuid": "57d1c258-c78a-4da4-b5ec-7fff7a783091", "comment": "Malware payload (Formbook)", "value": "92e261349613889b132d4e535ae01a8433a485f21823396d51beca5bf7340eee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218600, "uuid": "a43a5324-fe24-4d51-b3f7-207f7dba083a", "comment": "Malware payload (Formbook)", "value": "f44f6feee082b1a45ae04c72eff5d9ec019a59c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218600, "uuid": "71bf628b-c919-469b-b816-e3a645250f60", "comment": "Malware payload (Formbook)", "value": "f77068eee6b8521ca1a72dcc3329bf9d0061f1374c83a3eb089e8cd06d4f62a21991478763b2338b478878942a8b2b34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218600, "uuid": "94d59b9e-ee65-4f6d-ab1a-d4cd78fd40f0", "value": "T1E3541286D6D01C37DCAA833105B7DA39A777FEA8C6B11C0F279A7D713D332160526A62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218600, "uuid": "a7f133e4-6c96-464b-a11a-0df5190eb9b0", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218600, "uuid": "d6118ec9-a392-4633-82d3-8406b6ec61d0", "value": "6144:jGiii4mBwfKTgbRZQpJg4mlrsQK++uI35R2l7eJndWolbt:WNkBasssmVw5k7eJndfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637218600, "uuid": "c7ce5cc8-7a3f-4678-b405-e15abce150e6", "value": 301428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637218600, "uuid": "807374f4-62f3-44dd-b371-542b9188ce62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218600, "uuid": "71e5bf68-6e89-4e1c-9dd7-4bfef988a73b", "value": "CTM ARRANGEMENT_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c9d878-484c-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637225531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225531, "uuid": "a127c152-eb72-4bd8-bf0a-e74b30133dea", "comment": "Malware payload (SnakeKeylogger)", "value": "11447b80c762264b0a3b3eb392080f89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225531, "uuid": "00f4c955-99e8-4d4d-a1ab-62c254333549", "comment": "Malware payload (SnakeKeylogger)", "value": "93091f981123d4f6da005d50897772c580411b3de7e80d34e53f706b792a21b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225531, "uuid": "f7e40740-504f-4e49-9322-e011116c0999", "comment": "Malware payload (SnakeKeylogger)", "value": "f618f7bda48ce3bee91f23f250c3edc5bc6529b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225531, "uuid": "e9fc2f0a-ed2e-4ffd-93a8-d47acbd772da", "comment": "Malware payload (SnakeKeylogger)", "value": "687c0ebf7c663226351c2621143dd62f24d2b1ce5d46866ecd36c74b40b8d4618ba8140ba301c0aa5b4b479c11b10211", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225531, "uuid": "eb59fd2a-10e8-41a5-af63-79d13944bebd", "value": "T181C4CFA036B8C817E77081BAC5B0D2BE4BB0B16D0DD5C6467DEE2ADF76587607C68312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225531, "uuid": "9019115b-cd2d-4155-b0d1-9e4c411c46f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225531, "uuid": "c36a1d13-b409-412d-bbe7-0e8e1cdc5690", "value": "6144:B9JFUa3HXkh22hlECn/KqS15VIFI7M5IBOyVZsPl+3R0Hilu6W0ZP8aSDFSkjM5G:Bem31gW7AQrKFSkjM5RjmIpyybcrWMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637225531, "uuid": "d994a2b3-836d-44ac-9478-436e43f8c65e", "value": 546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637225531, "uuid": "b25b9ee6-1cb3-42af-90c2-963e1cad5bd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225531, "uuid": "6d8d8d5b-e4aa-4937-8317-ddf3d7f43294", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c744b699-4859-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637231097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231097, "uuid": "e947b358-676f-4230-b17b-45c29a27b66b", "comment": "Malware payload (AgentTesla)", "value": "c84481df69aec2c049a49567e4290495", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231097, "uuid": "041eaa41-3a50-4276-9ccc-371e3b0ebd62", "comment": "Malware payload (AgentTesla)", "value": "93353095ec20b348490396b58860554459789d8ccfa98fa42f0d336b9eb94eae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231097, "uuid": "344546b2-e0e7-4aec-8dff-794daac30cba", "comment": "Malware payload (AgentTesla)", "value": "f7d95ac6525f724afe4185340bf746eea6d08e45", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231097, "uuid": "820dba47-a0ed-4b1e-a164-e64d84926fa1", "comment": "Malware payload (AgentTesla)", "value": "05ec4a34bcc95b18da0ae4f104f86b2b0a4bd7e684bd08e72aa7ec159d673eabaa7567dc765537ecad8c5fc02eb2291a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231097, "uuid": "ed25c4bd-9166-4742-be50-ae42dce84f2e", "value": "T16BE4E0903AB8C423E770857AD9B0D3BA4F70B52D0DE6C6067CAE6ADF76587607C58312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231097, "uuid": "b1dd4200-e8b7-437c-b650-1e459c3b72c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231097, "uuid": "aafd43f6-e443-4799-a45c-95303cc8bd15", "value": "12288:Nb7m31gW7qNO3uH4WkrXcfzFFn1DZjhkNq/yP00gd:Nb7m3KWA46hF1ljGNqIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637231097, "uuid": "03582dc4-a04e-4659-907f-552722e39af2", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637231097, "uuid": "ba051993-4ecb-4312-8ee7-6eed4342dc0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231097, "uuid": "77cf1706-36b2-412b-a4af-d09e941453c3", "value": "DHL Shipment WaybillDoc_TransportLabel_3990350980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c47ec0-484f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637226638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226638, "uuid": "8be735b0-97db-4fd7-b7a3-bd2a0eb792a4", "comment": "Malware payload (AgentTesla)", "value": "fd7a38c623d2857f6300d77acd626008", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226638, "uuid": "1fe7598f-6195-47ca-b09e-1f82caa1ad4f", "comment": "Malware payload (AgentTesla)", "value": "935c36e8ee2af203b1e5fb55faf08efcbdd37f3dddf27a34b45595633c33f8c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226638, "uuid": "b4edebf0-528c-4f9b-a094-0db777ab9232", "comment": "Malware payload (AgentTesla)", "value": "2ae0048a8170bd5dda5f5ab5d66aeda9011a0210", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226638, "uuid": "1bebc697-11a8-4981-a38e-0e03d11f70ea", "comment": "Malware payload (AgentTesla)", "value": "0163bfa7a2883b81b3e55ebad674ac4ba77cb0e9a159f75ed611ea3fe56afcf52204a698c831617072c9af8a669c65d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226638, "uuid": "0454c3f3-b410-4aff-9782-c4e89caa382b", "value": "T188B423550E8E6D8499BB5307E1FB59F498B523A910DE250B9EC70C4DB990DBCCA3E3B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226638, "uuid": "d59ab83d-07b4-4163-b6b6-079b1514b6a4", "value": "12288:MNrJPWh8AM4rebdvlduCIkF02paje3/EQdkcHo5YCR1:aJPWNM46RzuB2wCdfHo5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226638, "uuid": "c7e7a46c-64a4-4c48-8d51-4ed97236c75e", "value": 522571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226638, "uuid": "3239a8e2-82cb-4806-bbd0-ec351510fb53", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226638, "uuid": "851b9b71-783f-4d11-a290-05b63655bcd1", "value": "PICTURES OF DAMAGED GOODS.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d12fe9e-485e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637233147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233147, "uuid": "a30660d0-d707-47b0-9c5f-ab6d8b204ba4", "comment": "Malware payload (Formbook)", "value": "3202470053412fe3bf830321ad225d75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233147, "uuid": "43210561-a7b9-4d01-9682-847fbd7186e6", "comment": "Malware payload (Formbook)", "value": "936a3e9dfd299c365c2de9e998f6858f4329378fcbeea90b940b98d2eaa1d152", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233147, "uuid": "0f210575-b5d5-4a1c-b618-6e1926e01ea4", "comment": "Malware payload (Formbook)", "value": "5c28c36a3bd05c02b135f641bf5195b8c9b960b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233147, "uuid": "61f50d8a-87f0-4fd7-a228-8dd181411430", "comment": "Malware payload (Formbook)", "value": "91350af9e6722d503065bc015e9e0152acfcf59f77d52831e0fcc5b4b74ad65ae02bb879de16bb35eb4d99e764dd7942", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233147, "uuid": "c0be09ba-f1c1-4c45-bb5f-181019212a6f", "value": "T1AFA4A096EF986A83C98543FF0A9D95A8CB19FD3A2A6442CF0B40F5994231DD24017FF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233147, "uuid": "06e1f319-d0a1-4167-a156-dffff66a077e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233147, "uuid": "57b806ee-d522-45c2-8b96-6b0abc5b33c4", "value": "6144:wGiP23+MJU096BdELJcLPrroUI3fA7zNXeJfR+0GRS0yJqQTZSpO9cT2ivBK6aE:Y23+WU0gBdELurkUVnNXeO3OqQTZdnFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637233147, "uuid": "49e7c680-f56d-4474-beae-8eace0663c96", "value": 470219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637233147, "uuid": "da6dbc9b-0ece-46e6-b2db-bbf0767063f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233147, "uuid": "5d17d9b4-6fdc-45d7-b6ff-1b341f5b766c", "value": "3202470053412fe3bf830321ad225d75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41832e5b-485d-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637232590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232590, "uuid": "2a46fa0f-cae0-4b0e-8f69-3709422ff9b6", "comment": "Malware payload (Heodo)", "value": "0870fa613d947ab7e8ac38e5a7307006", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232590, "uuid": "ef1d36ad-65b6-416a-9d57-d9fc0ef5e119", "comment": "Malware payload (Heodo)", "value": "93c3b47fe831630ab5772daef394ea7beb6e00b3b6ae6da7514238560236a796", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232590, "uuid": "8082f0d0-09fe-4fc0-b8e0-87e91c1ba99c", "comment": "Malware payload (Heodo)", "value": "d6f9aa5c58d9260844ac073d67f17dd6fab424af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232590, "uuid": "c0bd3c73-c552-4f47-8080-24ff5a949128", "comment": "Malware payload (Heodo)", "value": "27a8049e0f9a2b55de11008c2982069d1986900b1d4af1f24b1c5b17558c19d00f138033aa1a030573ff2b972345ee17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232590, "uuid": "84d66ca0-448a-4613-a3bc-7b6c81aedd14", "value": "T17944BF10B1809032E9BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232590, "uuid": "813b8a91-99dc-431c-8d4c-ae5725d288cb", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232590, "uuid": "197383c5-eb9f-4879-b2e6-b50eb44d559d", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBt6asb:prf+WPVXNcwUKaWTsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637232590, "uuid": "b1dbb8a3-2ab9-4d82-87c9-8c50bf400a2f", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637232590, "uuid": "dc015d11-1dcc-41a9-a15e-7cd8bfccab5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232590, "uuid": "e64b1b42-04af-494a-bee7-a2436ee0b2b0", "value": "0870fa613d947ab7e8ac38e5a7307006", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32f6440-487e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637247035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247035, "uuid": "9ad541dd-cb4f-439e-9e5d-013a0af14e08", "comment": "Malware payload (AgentTesla)", "value": "ee775ecb9daa451238e024b21d4a1307", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247035, "uuid": "7888eb61-f2a8-4d56-ad75-9137c0cabba5", "comment": "Malware payload (AgentTesla)", "value": "95ab05353d7d52ab368f9f6e60b0d94b1d37438f21dfc88a587c6c39c209ecc2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247035, "uuid": "4a929a8b-71ba-4242-bc45-d90ba4869e49", "comment": "Malware payload (AgentTesla)", "value": "90c0ec027e8d88c5d35e6fa39cc3d40bef36706f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247035, "uuid": "ba5d5838-5906-4f95-bc65-aeeeaeabf561", "comment": "Malware payload (AgentTesla)", "value": "60262efdea4ab7b4638527aea3f54a61958201841287f3a8cf341da5dab22c81ce73adddb83bf073d0ffef81560597a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247035, "uuid": "6c455a0e-47f3-4039-a923-fff788625eff", "value": "T109C29E26E3D48633D9FD8B7EA441900093B1A2177423FE1E68CA714C5AD7740AE62B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247035, "uuid": "ac540f9d-6a4c-427e-baba-dc9074870576", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247035, "uuid": "ad707ada-044b-4c03-b6db-a1bbfd45c524", "value": "384:2BbgNBLuhcNFvfAJ3n4oxLK7gOSaJ8uKnZWUlgjgovgyggugcgifWwZQoYC1K33x:qAQUldkVFZYCo37cJXL+JmWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637247035, "uuid": "3e774835-3aea-408c-b9f6-c83278b7bf4f", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637247035, "uuid": "f2896a3d-904c-4915-b5e5-2f68f9ce0c2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247035, "uuid": "c2e6a34e-53d2-4c7f-9d50-a1df31f53a39", "value": "AZLYS00006251062285.xlsx.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4aff70-4850-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637227270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227270, "uuid": "5c2c6d04-1469-48e3-b74d-969b5f4f1ccc", "comment": "Malware payload (NanoCore)", "value": "67a1e85361529ab5cfad62261b6d70b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227270, "uuid": "c8c0c43d-7fab-4eb4-aadc-e7592b9956d2", "comment": "Malware payload (NanoCore)", "value": "972a01221d9e780a6f553d7c44cfb2d0bfb70e4639a3d7e33ed5c295eb9bca14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227270, "uuid": "6e4606c3-9ea9-4270-a3d1-f401279c5090", "comment": "Malware payload (NanoCore)", "value": "9616b3db5d9711bac98bb751f46a8ba8c6b7da45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227270, "uuid": "e85f2e1f-c52c-413c-92cd-74b43ae2806d", "comment": "Malware payload (NanoCore)", "value": "e7c144053ba964d47504609b7d506e58ad32dc325aad1165e0dfaaa6de20a7811abc32e5772d7e6b9a1b31392428ef4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227270, "uuid": "04ee1967-5ac1-4e21-a663-3c0550caf88c", "value": "T12625F1D036B8C817F370427AD5B0D37A8AB0B55D1EE6C6063CDE6ADF7A297607C58212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227270, "uuid": "ab6c0d88-14c1-4085-b8de-570855fae29d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227270, "uuid": "f6f06cbe-6a14-4f5a-b3a9-599b6da5b61e", "value": "24576:XWNm3KWUcY+03BytIoqMTvMn9NfMMJCKlLrS0c:V3FU/wIoqZ9NkUhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637227270, "uuid": "527048df-e685-495e-a6d8-8f100a9f3e67", "value": 988672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637227270, "uuid": "cded390e-638b-4331-93c8-d0fd0c99ed46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227270, "uuid": "e1328eb2-97a1-498f-9681-a460a929d930", "value": "67a1e85361529ab5cfad62261b6d70b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a74b21-485f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637233757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233757, "uuid": "eaffb928-4e6e-4e28-ad33-c7f108f39fde", "comment": "Malware payload (Formbook)", "value": "12cefd7b8b3716cc7bd3633aa6f848bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233757, "uuid": "644f83dd-ba9c-4ada-b9b1-d5cbced9c164", "comment": "Malware payload (Formbook)", "value": "974a753b6be631d76aa556b3eb8c6638783a410bd0fbf6e4982a4ae41cf8c305", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233757, "uuid": "1adacc69-2276-4456-8d38-467a02f90a51", "comment": "Malware payload (Formbook)", "value": "4cea57f3530e2aca52a7034f138e652e52685070", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233757, "uuid": "b87cd9ae-a67a-4db5-a3f8-5c2c7a9dbadc", "comment": "Malware payload (Formbook)", "value": "1ede5efc0ce319f6919aa64f317297bdd5a76b84079efb48924644b145c49f504dfeb4b07d9cafb211fa96a176d5646e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233757, "uuid": "4fb6cc3c-cfc5-480c-bbe7-f83ee00d19b9", "value": "T15A54239BFED1A563D84B06720E779BFDE73312880007090B87A8BFC56E75EA64B141D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233757, "uuid": "b77292b9-aa90-4645-a16a-2b50fa6bd459", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233757, "uuid": "fcc00ac2-2908-42d7-a3c0-de45d9da3693", "value": "6144:rGicnmRKXY9WR/aAibQQ50bLS/8gtQV41+a05:ezo0haFp5KGM41o5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637233757, "uuid": "8f79b53a-0c9c-4606-8851-1533f44626e4", "value": 299355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637233757, "uuid": "891a7184-5cca-4583-93f4-3b28311d771a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233757, "uuid": "059f0f7d-25c5-45d6-8f75-bfd33f93bb8e", "value": "12cefd7b8b3716cc7bd3633aa6f848bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d794d4-489c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637259951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259951, "uuid": "67ce6770-314f-4c18-aaca-bdeee320a5e9", "comment": "Malware payload (RedLineStealer)", "value": "6ee503935f725986f4b87d239c59cff9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259951, "uuid": "7bd8ea8c-24bf-498d-8d70-2df9093d33f1", "comment": "Malware payload (RedLineStealer)", "value": "9766e98be6a5ec4073cc6faf537b4cc7dc14646d98ebc7c8a8be957b5f78e5f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259951, "uuid": "d77eba53-f580-423d-b37f-d23f9bc2b55a", "comment": "Malware payload (RedLineStealer)", "value": "d881052c0c78391f495ea50d15f38073f04a6f74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259951, "uuid": "d828a5d7-39d8-4ab2-a559-f21d1eadc242", "comment": "Malware payload (RedLineStealer)", "value": "fd6e65ad2004247c8348a5fe5ab094dc2ae88b239acf0d717b7edc02623764175fb2616c1205b465f012adc482895424", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259951, "uuid": "a41be594-c2b7-4de4-ac8a-5771b098beb8", "value": "T18CD24B4A82549B63E8BE8BF2919199104BF597433452FE2FEDE610CDA651F083290F7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259951, "uuid": "82ac21bb-8d0f-41fc-a45c-3f649869cdea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259951, "uuid": "0bfa6f37-293e-4bc3-9097-d222de2635a8", "value": "384:HtKqBj+2s/VJt4ZAUnySKrapNi+MJD8fckQ7LCLdvVVUJpoZCYUQiBGUBcvkcuvv:Zj+2s/VbYukOw6qwLB2f9Fh3i3l8hqWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637259951, "uuid": "ef3bc6bf-38e6-4a6d-ac97-1a7e2c886319", "value": 30136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637259951, "uuid": "30931327-2988-448e-8845-1658eda9917f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259951, "uuid": "fa7a9032-2d74-464b-84a2-33600cbcce40", "value": "6ee503935f725986f4b87d239c59cff9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a8e9ad0-4893-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1637255798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637255798, "uuid": "c0788bc3-07c1-4ac5-918a-322ca17a1c48", "comment": "Malware payload (Vjw0rm)", "value": "663200a2fc5d79228cd173fb500d1de4", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637255798, "uuid": "f28686b3-0941-4b8c-bc2c-78d3ab089151", "comment": "Malware payload (Vjw0rm)", "value": "97ccd70fedeaeb6026e8813f9c07d7ecbb772fe948835fd0c60f70ffac9e4b0f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637255798, "uuid": "dcd324df-9195-41d4-a716-98db705cacd1", "comment": "Malware payload (Vjw0rm)", "value": "6b3a2a8b748750af68092acb1b1d04a3b94029bd", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637255798, "uuid": "e6e5c1a8-69d5-44a2-a65c-3fc7457d815e", "comment": "Malware payload (Vjw0rm)", "value": "d44a964935d5848bcceeaea90630df5f9c8266a3e120bad5b6526063751d478bf0882440c88ec2f5a82fad683ea1c40b", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637255798, "uuid": "8b83f00a-9778-4bef-bba7-5c6b8634743d", "value": "T11D42C088B07A567EC505A2701FDC426C360CEFDA39C4125ADAC3DC8E29FEDC0ED4885A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637255798, "uuid": "b17ead93-0165-40c4-9aac-b48b111d581b", "value": "192:wJ98t68hjlP24S7FcK4IKDIzj6iML2NgYEYbVek3aPeh1U9KstTe:w/E62B+f7uK8SjMCNDEYbVZ3gc1stS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637255798, "uuid": "d6c5042a-6046-40d2-aab3-310a23ad91aa", "value": 12066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637255798, "uuid": "64c0404a-e809-43a8-987f-36ec0dbec405", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637255798, "uuid": "9bd25784-5b1f-48e3-80fe-a5e4cd7228e4", "value": "vjw0rm_formatted.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87505857-4802-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637193623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193623, "uuid": "a80332e3-2d12-4db8-ae5b-410ab142ea66", "comment": "Malware payload (Dridex)", "value": "a7842678dd9d995c8b29f1106df5ddcd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193623, "uuid": "25c3da7f-490e-422a-a521-7bb45119e5d8", "comment": "Malware payload (Dridex)", "value": "9825b854b1cad2fe8e8e59b74a63106c6bbcc133a52438ea6494b29e3eddd448", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193623, "uuid": "50d29750-df02-49c0-848c-13daaad8d30f", "comment": "Malware payload (Dridex)", "value": "61dd849de339d38a59bee4455b8be55ff33b36cb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193623, "uuid": "6d5cc72b-cb52-4c9d-a41f-35482cbc203f", "comment": "Malware payload (Dridex)", "value": "5e296c3a62b3164120b2290423cb7dc707c283eaedb43e8516372f8bd3c06e00dfe0b593022cf2503fb69554df8bd714", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193623, "uuid": "5ba4aafb-fd78-4d82-a3df-b4de58e4ea82", "value": "T15FE4AFEAEA45BC3DD29E14B4A529A4133D8BF98C009ACBC1D971BD16E0FC94E761F407", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193623, "uuid": "f457f344-be1d-4c2b-9333-71a34df12df7", "value": "02156850f54cd7e0fd2be68227189293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193623, "uuid": "333fb6f0-57e7-473a-a5af-e98060a5b467", "value": "6144:znooH1bTj5/vvrldK+FrWYtvhkMV3LqQ8JaiwKwmw6wicndXbDu:znooS+NpV3eQ8Janby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193623, "uuid": "8dbfc090-0772-4082-8d7f-210fb38849b3", "value": 668520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193623, "uuid": "b68e788f-ed81-49c5-b32f-c0b7e30451d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193623, "uuid": "be857bf7-1b5c-409c-9915-87516b34dea0", "value": "SecuriteInfo.com.Trojan.Dridex.777.2590.26710", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d2803e-48a6-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637264219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264219, "uuid": "9a27cb0c-38b7-428d-a7b3-55e82159decd", "comment": "Malware payload (AgentTesla)", "value": "166bf765f9160ddc65ea5c141614fccb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264219, "uuid": "0588c8c3-818a-4ba8-8af0-39a0d185d048", "comment": "Malware payload (AgentTesla)", "value": "992019b0215b0aef6a277f120f10d7b893a01f4b97ac6cf627088652e458e6c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264219, "uuid": "11f97937-efc9-42d9-9435-e9b3a9bca76b", "comment": "Malware payload (AgentTesla)", "value": "81f588e360650a43ae1ca17efe0d678f006e7a89", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264219, "uuid": "dcc2851d-3fd4-48c5-97cf-f23ae8dc8716", "comment": "Malware payload (AgentTesla)", "value": "8a320ef06cdca2c25f6b379024917080d7b5ad68537c9debc750ee9a082a348f6598c725bbd303232b6c222adeb79b12", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264219, "uuid": "d12ba294-54fc-494e-8a0b-343a59a1bc7a", "value": "T17CC4D07963500B97E8983CB9D61308AD5BFDB4DAD226D748BDB3D1799F6B7400B02283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264219, "uuid": "14157156-1e5a-47c2-b3f1-435f336287fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264219, "uuid": "a9a00720-75b9-486f-8aef-41342b7b0a25", "value": "6144:hpp2vxpGDma1F1rdkO/5akGhhuOjzmt/hyMWnLQ3bXSoUbvV+Wv2TxvatJsTYX3o:yxp8PHr+wakGhhrSyMWLQWcW+Txvru4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637264219, "uuid": "5656a4db-e57a-41bf-a7e0-7b15aab16546", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637264219, "uuid": "ed0fe7a1-bce8-422d-9af8-9902e6c73896", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264219, "uuid": "06ec3abd-29b8-4b96-9b7d-7d1ec5bc239e", "value": "166bf765f9160ddc65ea5c141614fccb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb785123-4843-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637221736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221736, "uuid": "95e30855-389f-451f-8cc0-ca80468937a8", "comment": "Malware payload", "value": "8b67b48ca9bb5040af7090e2b319d9ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221736, "uuid": "b16173d0-a07b-4f84-bb3f-f6f0c5ed8659", "comment": "Malware payload", "value": "9930a9c2ac23a2b7b65a4e0443f222ff1ac42e645aeed2f9380263892e385ce9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221736, "uuid": "1048de2f-d2a7-411d-bddd-3d2792ab9003", "comment": "Malware payload", "value": "fa6b54109029bb689d2c55760857c38a86a8ae0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221736, "uuid": "c809f341-a09d-4e0d-8dc5-83e63e3976df", "comment": "Malware payload", "value": "f639a1b2087a6db4fdd830b2823cd73d623216c0b896e73cd4e5d164bc70906cdaa50b5cf2382bdeec26232a67d3a2b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221736, "uuid": "306421a7-601e-4c7b-b081-2bbf5fb7e850", "value": "T1AA16331045D122CAF6D4ED1E5BDC2A75413FEECF28B8ADE3DA9383F4000EDC99662656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221736, "uuid": "9bca023f-3af1-4002-92c4-d26908cf26a2", "value": "98304:G1wwAjzIQOMK2GNKslgus10Y1/UJ7BdlRbTBAlYVu:G1wwAYBr21uQsJ7vTBAlYVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637221736, "uuid": "91f2f214-890b-4c2e-a6ef-5bb557380784", "value": 4222976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637221736, "uuid": "b0b0b1ef-ec0c-4043-b745-3b3683fc6fbe", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221736, "uuid": "944c608c-cc1b-4762-8616-8da9e27d450d", "value": "9930a9c2ac23a2b7b65a4e0443f222ff1ac42e645aeed2f9380263892e385ce9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc91a441-4872-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637241870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637241870, "uuid": "70076bfb-8f6e-44dd-8d0f-87cb53390da0", "comment": "Malware payload (AgentTesla)", "value": "6c1ba10404c0bb339c248d0a777641f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637241870, "uuid": "645cc827-527b-4b82-b8bc-592cccabd4b4", "comment": "Malware payload (AgentTesla)", "value": "9938bc695987018b57ad875f15ab884d7c0d1b9660504293c92b1e5ff006bdf4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637241870, "uuid": "4d1d914b-c3f3-4869-b9d8-ffe417a540a0", "comment": "Malware payload (AgentTesla)", "value": "1a5c3ec5b6a21539dc55e1b89cb9e7cfcf0a5b57", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637241870, "uuid": "0bd97217-cc0e-4f9d-8e02-792cc905bfd7", "comment": "Malware payload (AgentTesla)", "value": "f9cf601ea258e6f6c27468605a81d40e79574a23cf12975ac319e73af3d76eb96be28f4805d9b6654a279e2ca9e31123", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637241870, "uuid": "97ab07e2-7957-418f-83a7-c84ea896cf30", "value": "T16CF4CED1A9B4C402EF244B3590B1DE794A77BD292CF5C20D7C9D75AB367B3A23829207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637241870, "uuid": "373efc35-b603-4fd7-ae9c-b4e1efce6a9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637241870, "uuid": "7135428f-e0f2-4f6e-b079-e77edb389398", "value": "12288:LW1Bm31gW70WC5dEjGm/S+RmeA1wtaW9Zmal107zp+FA/+S/:EBm3KWgWCvYGmK+RXA6h9Zzl10H8u5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637241870, "uuid": "55898b26-07ad-4213-b90b-e073c18a400a", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637241870, "uuid": "42f214af-68c0-43c6-a590-a4112e1186a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637241870, "uuid": "8b7e462f-c3aa-4225-afcd-a31ccfe712d3", "value": "DUBAI UAE DCES234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2519e8-4875-11ec-843c-42010a9c0014", "comment": "Malware payload (a310Logger)", "timestamp": 1637242967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242967, "uuid": "f2dce930-4d22-4adc-9d74-9298226ecb2c", "comment": "Malware payload (a310Logger)", "value": "0b9f3a2e2f2a868a47ab93cd39ff5f6b", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242967, "uuid": "b88f8c5e-5471-4a14-95f1-4cf0676fcd89", "comment": "Malware payload (a310Logger)", "value": "99f8dbdf69123254d0cc94494f7ec6b9bc0c1cf649f8c01fb0997d403172f335", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242967, "uuid": "b9b6d42f-aeb9-448b-ac0b-371cf05d4971", "comment": "Malware payload (a310Logger)", "value": "eecc7d12c93aaf1cf9695e3a4cc3543df001c6fd", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242967, "uuid": "d54a8002-6907-4cbc-8e46-2aaa28701567", "comment": "Malware payload (a310Logger)", "value": "02d44aae7a39e57b72f21ad67e158bcbbdba6febe043b3ad436c654464222512273ed71bec79cc117ef0e65a11e3f4df", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242967, "uuid": "7b5528bf-e9ca-4433-a1e6-38de8dde4119", "value": "T1A2F412119729DA2AC7C116BAC499F7F4DB7C4CD8E82906978B313E683A397CD2CE5053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242967, "uuid": "f8a35410-0af6-43d5-a491-d89509ddacf0", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242967, "uuid": "0c751c4d-2cc1-4bf0-b955-3d01c26ba733", "value": "24576:zURtbMnmFCScTUl9Dpsz+YFU2gaocbaaKg5n:z+tMmFCn0Dps9ZgaoYaNWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637242967, "uuid": "72c68f38-f17c-489c-a36e-66345e55b9b4", "value": 790687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637242967, "uuid": "46eca00c-8b0c-404c-8193-03425e9bb7cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242967, "uuid": "e6ccbc97-0bee-40ec-aa72-560c3c98733c", "value": "Quotation PC mm single Sheets 002.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25388a7-48ac-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637266737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266737, "uuid": "d67d08d9-49f7-4eff-937c-c173a6e33fd7", "comment": "Malware payload", "value": "9b2f3c6e7c6bad771eb1dbd2ab07315e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266737, "uuid": "d5d75abe-f259-4398-acc4-bee2eb988a0c", "comment": "Malware payload", "value": "9a5a742cbe0c5fa8c91ef1d400896ff833476df27a9d28afc4a76838774174cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266737, "uuid": "aa8e8ed3-6cdf-4a7f-8824-bc12b692126a", "comment": "Malware payload", "value": "ce78c820e6fb8150e39907530b76f55eb307afd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266737, "uuid": "c18df768-fdd9-4ce1-ad71-73a4bad3a998", "comment": "Malware payload", "value": "2735e6e086a0048c60df6fba4068ff47684d2bed88017801ba4c991db9ceeda28c21de9ff2b567a1197d7bb66ce43c2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266737, "uuid": "d147814a-300d-4a83-ae18-32c5d241b1b8", "value": "T1B6C38E67731810FCE2A7D2BCD6A65A12D7B1B806036097CF13A0852A0F57BD4BE7EB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266737, "uuid": "497a34e6-4c35-487b-b394-be0934aab17d", "value": "4aad82b7040b5c1f82203f4f29e4e8ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266737, "uuid": "fb9b7646-7450-48d1-9965-0ab6d546eddd", "value": "3072:moYa8AXY3dfleipykE79gmJTQSaMm5/6E4:moWAXY3dflStWlF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637266737, "uuid": "5ed182da-ea3b-4bed-a4a7-7f8a0b212511", "value": 124928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637266737, "uuid": "bee9b87f-7db6-400c-a00a-7299846c6174", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266737, "uuid": "13e256fd-a145-43b0-b6c2-ff5733aae5bb", "value": "kdmapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93177e4-487a-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637245354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245354, "uuid": "7073b945-d652-44c5-b4df-de24c9fb2c84", "comment": "Malware payload (Heodo)", "value": "dd1b13dedab6453129302e4668fdea24", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245354, "uuid": "3b5a6bfa-bac6-405e-a9d7-04bf1e35330e", "comment": "Malware payload (Heodo)", "value": "9ae2c45830db6baa8cd9a411bb7bc89b12365a0c1e5311c085b654fd733c702e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245354, "uuid": "f9c50713-107b-4a46-8674-28b4bc90f270", "comment": "Malware payload (Heodo)", "value": "695b44c5bf89764cf18a93f02872da0ab1143531", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245354, "uuid": "37216857-94c5-4b52-b98a-77d27f677ad1", "comment": "Malware payload (Heodo)", "value": "6b87e65802d0090186da3ba57a1f92d9800952caca7aa0dd0bbed32ca9c22aeeb5a5706c47cfc0cf0e0232e3163bf47c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245354, "uuid": "0bdca5b6-45e3-46e0-a87c-8e038dd3cb11", "value": "T15BA4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245354, "uuid": "655ce4f0-e9f9-49c7-9313-5e8ce85c522f", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245354, "uuid": "57bdf73e-7d02-4e6c-ad6f-5dda1d7104f1", "value": "12288:bdv8jkvzqZvv2wLBxmTi12yD88kYwZ1h1:b2Zvv2cATi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637245354, "uuid": "b8f7d422-d561-4cbd-b14c-00602244a9a7", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637245354, "uuid": "09c4ca15-cc42-4e30-8e41-2a62d961226e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245354, "uuid": "f0b1d808-8a32-4e4e-bc3a-976b14aeb404", "value": "emotet_exe_e5_9ae2c45830db6baa8cd9a411bb7bc89b12365a0c1e5311c085b654fd733c702e_2021-11-18__142228.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30acb042-484f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637226549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226549, "uuid": "6c4ca9a7-1fb5-4108-94d9-d5377a5beffe", "comment": "Malware payload (AgentTesla)", "value": "b5c1aa680aafc53b2c7fa4572b9de0d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226549, "uuid": "2c9d15b6-36f4-4166-b236-aa2bc5550fd9", "comment": "Malware payload (AgentTesla)", "value": "9ae85c83b639478b9b0cc47ac8eb127edeb182f826e85256011941ed10856cce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226549, "uuid": "5f4c6f25-3c52-465e-a814-c6b9fc18aa85", "comment": "Malware payload (AgentTesla)", "value": "72bf31e2980e8e1bc4532371d10f4ca0c477001b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226549, "uuid": "f973c500-16d6-45eb-a8d8-0b98d62e0d6b", "comment": "Malware payload (AgentTesla)", "value": "de435f1285fef3f3a7a651c72a576ed180d18fa757a5c92b05e66bb93bb0373e4aa8c80076e37e13d5b03639ed9b7d4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226549, "uuid": "5407c943-e7d7-4d2d-8ba2-5b12a42b3f2b", "value": "T130F4D09036B8C813E77082BAC5A0D3BA8BB1B11C1CE5C6467DDA6ADFF65D7247C59302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226549, "uuid": "a047e64e-e98c-48a3-a949-6cd7e8a7ddfa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226549, "uuid": "955373c5-fbe6-4ce4-96d4-75c05d83bf4d", "value": "12288:6MN8m31gW7CshCwaSX0aEYgLFux39Lu949dZx7ISWXiQxGVCI1dK:6MN8m3KWGshCP8Xooc67SXiB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226549, "uuid": "f6266969-daa4-453f-8d54-40ccea1335e2", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226549, "uuid": "b9e0f3d4-353e-4b2c-a516-49fa35a95eda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226549, "uuid": "8d0dc47c-13ae-4075-9e6a-760d1741d60f", "value": "DHL Shipping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0701731-4848-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637223757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637223757, "uuid": "a0eb0a81-fdef-4275-ab24-fab744c11330", "comment": "Malware payload (Formbook)", "value": "7a472b26cb03fb90b7f7a98f0e3aaaac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637223757, "uuid": "265af52f-a890-40f4-bcb5-4b3d72ae36d9", "comment": "Malware payload (Formbook)", "value": "9bd94109c257b316e248e2486f3b84bf358cc5b9b259154e6b0544bcb04269d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637223757, "uuid": "b0a5587b-8b40-4043-8361-ff9ec87eabf5", "comment": "Malware payload (Formbook)", "value": "0dfd979849653398c60d791ee385f80a3648dc0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637223757, "uuid": "ccb42c7c-b761-4890-9450-7309c32a0429", "comment": "Malware payload (Formbook)", "value": "e712d6ffe4ea9f26614b96df4d442ed7225846410f6cd1c2f04a7f5f5cca385074cb3049e268e3003226a1093e0b080e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637223757, "uuid": "91af2c5c-d782-47ed-92c2-a82197a304c1", "value": "T1AAF41552A9748453DF2351F9C579CF79BB70B9EC4C918E4E3AA67ABB3524210783B203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637223757, "uuid": "eb29589f-33f0-4b7e-b91a-c8ea6366b331", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637223757, "uuid": "22f969f2-634d-4d59-a576-603d8ec8392e", "value": "12288:LL07m31gW7zoGCn3iUwpKHqTnTRrbOiFogI49RQCv:f07m3KWPof2pKKTduiygd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637223757, "uuid": "e0c246db-c2c6-4d90-888f-f3132155694e", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637223757, "uuid": "52cc574f-253d-413c-8a19-d43b3dd9a054", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637223757, "uuid": "fa0d7df8-1780-4822-a830-9fc5f8583895", "value": "Order Inquiry_List0811221Group_Pte Ltd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f458edf9-4850-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637227307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227307, "uuid": "75ca2fdd-9b78-491c-bb32-65f14f285310", "comment": "Malware payload (Loki)", "value": "ec56202d633ca43ac29e04443e829658", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227307, "uuid": "93c65e45-2802-4cb4-b956-8b600d66bf0b", "comment": "Malware payload (Loki)", "value": "9bf478e69afcf5bee2f2e1db3dd286e4a0d6b8d284bcd85dc3f6c7cc011d204e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227307, "uuid": "25377176-66ab-43e7-908a-980e36360535", "comment": "Malware payload (Loki)", "value": "2ec49d740b2bdeb6de0fbdaa80a4bfefeef08d5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227307, "uuid": "7bf8cc14-db0e-4cc8-a10f-a3491e47117c", "comment": "Malware payload (Loki)", "value": "73a744c0fc2b16d46b94a5682a5bc7d4fa6637ca4165ffceee7afbb091f6a303455d4da5d0fd943228b51d5df22bb857", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227307, "uuid": "7f1e1d61-470e-4c24-92f1-362c10b2d43d", "value": "T14054226DFCC34B73EED51A7123F29F39E6B1DBA602C61907131CEE592A668064A0C5D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227307, "uuid": "483e2adc-46be-4fbb-885b-59a97858e2c4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227307, "uuid": "02f9f0ac-2343-4c1a-a546-11b3f7e04f54", "value": "6144:rGiVAwnqdX+ZDnWQDp0OAA6MiIKJaI+3WEaHNiSBEWmJPsx5RnhN:5AwnqdXGDWQ14VzIKeKaJPsx5RhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637227307, "uuid": "459ec775-ed23-4fe8-b5b6-4414c9cb9ab6", "value": 284143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637227307, "uuid": "dbc7712b-abba-437c-bb87-675fc21bd560", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227307, "uuid": "a5da0c80-c9b6-4001-be4c-22af0f889a71", "value": "ec56202d633ca43ac29e04443e829658.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ba1048-48a4-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1637263137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263137, "uuid": "bc9b7d8e-f654-4b88-9915-9c1cb70e34c3", "comment": "Malware payload (Vjw0rm)", "value": "93fe46db778234adfe6926bd5bc80472", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263137, "uuid": "0eec69a7-2916-42f5-b711-21f3fbac6483", "comment": "Malware payload (Vjw0rm)", "value": "9c632ee7c28c6a5e9a90a7c36eedfa7218e359d88fb3ced77520b9ef6e02456a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263137, "uuid": "e55c27aa-ee4d-4738-8ad3-ec00cba3d19e", "comment": "Malware payload (Vjw0rm)", "value": "5aba6bf1a9ececd549035ed78fd642787a2639f5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263137, "uuid": "cf1e4a63-5078-44a3-a690-7cafd3502029", "comment": "Malware payload (Vjw0rm)", "value": "e10556a8663eb857aed61a468e97cca78365d176b39ed32c7ad3d710973971b910ae878591b04d8043cf4fa79e493a4b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263137, "uuid": "1eef86f7-b49e-4b9d-b017-b682cc4da495", "value": "T19E72D0268C89D5D39FA26E7E957FDFE391091DF4C309B76805C2D26FD828112AB64A10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263137, "uuid": "1e2132a3-2232-400e-8ee5-96076987a535", "value": "384:EQghS+C1D17X+SvZRIjzrGw7FcHdQOKRyuVpjWsUhFC:FghbCJ5rvZU/DiCOuykZgFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637263137, "uuid": "8c201848-3a0f-47f7-bb8c-47acefc110b8", "value": 15981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637263137, "uuid": "cef62000-60c6-433f-a3a7-358d222a37af", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263137, "uuid": "5be58dbc-cd7e-443f-baf4-7aaa8f4b2673", "value": "6430_Invoice#001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3c879b-484f-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1637226896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226896, "uuid": "ab23a539-def2-43e9-ad9c-71ab776b9f4c", "comment": "Malware payload (Metamorfo)", "value": "7829fc405827d0c78229be8e1d802a11", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226896, "uuid": "cca4e39d-14e4-464d-9371-ca22254ee8b6", "comment": "Malware payload (Metamorfo)", "value": "9db0cc953a8be87d9f214c1ea5e672bf6e9a2bd36e6ac56b6d6b75f7d868e128", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226896, "uuid": "2ae87dfe-f094-430c-a4df-1582a8e42c0d", "comment": "Malware payload (Metamorfo)", "value": "b93e080bfbdfe27fab3d8cebc474bdb0df59c66d", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226896, "uuid": "473fe557-9e79-4325-8927-c0330af8c18b", "comment": "Malware payload (Metamorfo)", "value": "58eb886dd0cc57ba197e8a2e88091121987ecf52a26891dc3958039e2190a53dadc211d7665205b2eec4fa84c35cf5c4", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226896, "uuid": "4e46b893-630a-4c58-a097-38a1eb6985a6", "value": "T19341F01429EA0719D3B3CF7A24FAB29A8A7FBD91AC535B5E408483CF1851150EC35D6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226896, "uuid": "3f4cf3ab-18e3-4b3e-a727-6bbf843058c1", "value": "48:8+uH+M+LusScGkWO6pE1cIXv3KaIqiHkb6NS6:8+ueFLuuHWOSE1cGvKdEbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226896, "uuid": "037ec36f-0556-43e1-a5c1-335909f570b0", "value": 2016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226896, "uuid": "6a6c9159-2e59-488d-b99d-bcaacd0084a2", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226896, "uuid": "efbe6925-3cfd-4c3b-90d6-edc68ef666bd", "value": "Curriculo.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208f3e7a-4803-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637193881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193881, "uuid": "5f8ae5ee-cd8e-44d3-8d83-de6fc78ee67d", "comment": "Malware payload (Heodo)", "value": "38e573112666faf3df9ea82e5c812988", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193881, "uuid": "034312af-c2be-4396-acf2-f140814adbae", "comment": "Malware payload (Heodo)", "value": "9e1e1b9b910f0d5d5f9c62411601409aea305cf7f70ef51dd0eb34c1dd75f639", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193881, "uuid": "c2f8c2ab-9bf6-435b-8fe5-cbe475917edf", "comment": "Malware payload (Heodo)", "value": "cc8ba246ad08c97e9cb13e00bf8442f4f38e3247", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193881, "uuid": "07477340-c233-4a30-b0b0-aeb0d92abe2a", "comment": "Malware payload (Heodo)", "value": "e86c5f10a3573c95e340553e5ae958ffd8144232b5063e5ae881b4034945f4db3321e4d83609b688fdc3020b712cb23a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193881, "uuid": "6a1bc942-7ea8-4e9f-9e58-86091517e3c1", "value": "T1BC44BF10B1809032E9BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193881, "uuid": "aab27697-e9b6-4619-881a-aba732d52abe", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193881, "uuid": "1f1c5725-d19f-488e-adb4-55bf73b19673", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTB26asb:prf+WPVXNcwUKaWT/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193881, "uuid": "27cb7536-9072-4ca1-ba32-4a4fa0845875", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193881, "uuid": "95b42502-dbb2-4695-986f-2948ed0018e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193881, "uuid": "c4ed9770-1534-4b7e-be74-f897cfc5a694", "value": "38e573112666faf3df9ea82e5c812988", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d880f6-480c-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637197887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197887, "uuid": "92d70b85-8f7e-4953-b8fb-e01defe88c04", "comment": "Malware payload (Heodo)", "value": "4edb6bae83c0bee080608b18b1a50aa7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197887, "uuid": "fe37d6d9-0b35-40ce-af4a-a305bd626852", "comment": "Malware payload (Heodo)", "value": "9e30e199865aac588db22875256efb8d609223fc800d497e2dcf5ea0c2ffa750", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197887, "uuid": "0e656356-5f50-4e45-b7f6-fbbbff9c3210", "comment": "Malware payload (Heodo)", "value": "03c87561b8bebea6c283083ff37ff078f799922e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197887, "uuid": "34873acf-cd18-4d85-be33-8b979824a27f", "comment": "Malware payload (Heodo)", "value": "2f75198cd27197fad53e1b21c1ad70b4105659806b0ba671ae2f894cebe3b204496ffa85de02ef89068108a62c3d1ed3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197887, "uuid": "9ff4c5c9-1d85-40e4-9703-54a2c051abb2", "value": "T19044CF01B280A072D9FF193A85F5C66A4A6C7A500F90D9CF53D80DBE5B765C2B6309EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197887, "uuid": "faf081d4-eda9-4530-9496-aafed5353554", "value": "822ae775303d14fd9c529b33f0deaf77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197887, "uuid": "2b56a39f-01ab-439e-9173-a437a53f729e", "value": "6144:ndH09uYgR7OJSuwuZc2HEaYTy7beWTBdnm:dHJtlec2HEaYTXWT/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637197887, "uuid": "910932a2-719a-43d2-8f6b-8b55e63329a7", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637197887, "uuid": "2940a6fd-7d66-47e3-bb33-7199c0fed119", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197887, "uuid": "97a5dbc3-3f96-4db7-9e79-24c0ef9c570e", "value": "4edb6bae83c0bee080608b18b1a50aa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42dfdd96-48ae-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637267382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267382, "uuid": "186fcdb1-3453-4dc9-8c35-58d9b65b1cd1", "comment": "Malware payload", "value": "59ead041c3556789d19f64ef8da28a92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267382, "uuid": "6d1cb1c0-892f-4d4a-a37e-b0b71e6ac427", "comment": "Malware payload", "value": "9e98c56e8030cde3786de76a937611e79aa1eaae8eb4f5d1719c285fc6bb1d70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267382, "uuid": "47fdb937-e7f1-4600-8c99-97282a465acb", "comment": "Malware payload", "value": "40757c931ae1c210948776065a1af3789b7a095a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267382, "uuid": "c15ef4cc-2571-4cdc-bb7a-6ed1cfabda1c", "comment": "Malware payload", "value": "cc8e37ad3e10f8b3bcf46436d8fc46b6e9c9b1a4142cf011b6e51a6867085c5be14cbf0d967124550c6221b47e002955", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267382, "uuid": "9525878a-9ded-4bfa-af3b-99af45f080f5", "value": "T1FF143B3439FA9019F273EE755FE8B5ABCA6FF3732A06546E105003478723981DE9163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267382, "uuid": "f7c144fb-f637-4193-ad28-8355f6d986c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267382, "uuid": "aec22620-5688-4a4e-996f-29e01bf5f4b4", "value": "6144:jr9iq3Maa3OFhMqHeZNWYvxrUilqFhF9xWruDvEcZ/YoMy1:D3MagqhMaeZNW+xIik9xguDEcZ/YoMy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637267382, "uuid": "45c1b916-4a3f-44ce-9fcb-bd1d0a786274", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637267382, "uuid": "f008b62d-c04c-4983-bf67-2c0b1116839d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267382, "uuid": "0794cb47-2df0-4088-898a-b8282f741dfc", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc758ab-4878-11ec-843c-42010a9c0014", "comment": "Malware payload (GCleaner)", "timestamp": 1637244103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637244103, "uuid": "44a49e09-218d-4d53-b73e-45f132709858", "comment": "Malware payload (GCleaner)", "value": "dc099eca424486276efa63f740e84f15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637244103, "uuid": "e230e12e-3534-489c-8154-550e5322782a", "comment": "Malware payload (GCleaner)", "value": "9eef76a0625d12521e6d0b3c46f0fcf44df56ec9cf2822c475f85297b3ee051e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637244103, "uuid": "c71f3521-2c5b-4fee-813b-c159238a9270", "comment": "Malware payload (GCleaner)", "value": "32ac2a1b5f9543ec5c393c352716ad2e690a84d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637244103, "uuid": "020ed137-121b-4875-a53f-a722195cc62a", "comment": "Malware payload (GCleaner)", "value": "e5feb34a010c17b99bb0adc821b128f13b4bcd6a48dd314844bcbb326acd658ee82fb915cd1f9f6eb7fcf5c0cb6df1fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637244103, "uuid": "cb00cc56-5834-4b8e-81da-fe74a69dda92", "value": "T19A263321F384E517C697253A4A32B1DB4F489432FB910EB75FAD7D7E0E184E19E9C228", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637244103, "uuid": "4c45006c-e936-4d7b-a9d0-b66b0aa718d2", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637244103, "uuid": "fd7be106-2185-40a1-911a-8e0d99982fa0", "value": "98304:JqhCxHNmm6nv+AviWGTC5Uf9gORzngUvn3BZz1zKW11txMp:JBz+v+AvibTJuYzn7vX1/1XxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637244103, "uuid": "b6efae0c-8b3a-44df-998d-ba7e93f07b01", "value": 4837953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637244103, "uuid": "fd5ac9d8-7011-4edd-b0cb-acf18d87b1cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637244103, "uuid": "5d60cfa9-b443-4310-ae5f-e7940c20cebc", "value": "9EEF76A0625D12521E6D0B3C46F0FCF44DF56EC9CF282.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da943592-486b-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637238860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637238860, "uuid": "0404dd70-f243-437c-a842-ff4ccf7e0b8a", "comment": "Malware payload (Formbook)", "value": "b9ba0e8e0eb70842fd7e02d0fde0fc9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637238860, "uuid": "af266425-ed6d-4310-b24b-de6959973a64", "comment": "Malware payload (Formbook)", "value": "9f06f830ae97fc53c736d738a31484514ec28e738638203417338087bd1ef5e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637238860, "uuid": "023b6fec-1df8-455b-91cc-394b287f13a1", "comment": "Malware payload (Formbook)", "value": "9fcb75326a4ac47460d02591ee34cdd5f1302715", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637238860, "uuid": "7b9f5299-2f17-4a63-b495-93ea7fc58980", "comment": "Malware payload (Formbook)", "value": "e5a853d02f522238c87fc360f6163f87e3e7621c75c83321cc82d016ff9f15a3aae946e6b4c013dffaecd4a84504f42c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637238860, "uuid": "adcbc0cf-e130-4f71-a32c-6bac20af167f", "value": "T1C074121B76A5E833EB90427427721AB9E3B9E4DC161883479BA84FFE140609F45F47B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637238860, "uuid": "2327d497-3b79-4fc4-a697-a84daaa6c8ae", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637238860, "uuid": "4ff826db-684c-439a-a031-b150ae9f9a88", "value": "6144:rGimFfqDOGZ+JxVjRrGd7jF9xIsJXb+S7tPuSh7OqqpR0oFeDDo:daGZ+JxtRry7t7tN9q09o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637238860, "uuid": "b12c8645-ccd4-42fc-8688-92d46a15a965", "value": 342107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637238860, "uuid": "4e5b13ad-da06-4360-8917-35d123a3ef82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637238860, "uuid": "eeff1189-338b-4b5a-9cd1-11f4642719b8", "value": "New Order INQ211118.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cbdc508-4854-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637228798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228798, "uuid": "3cae85d9-b00c-4e96-8ce1-45cfff7ad728", "comment": "Malware payload (AgentTesla)", "value": "ce5885392851f5664356e4077566c461", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228798, "uuid": "158f9a51-0c44-445e-aa2b-442fb405f1bb", "comment": "Malware payload (AgentTesla)", "value": "9f2af233caf3577c3a99553da60a76297fb2c69f5ab4e3080670c54687186e84", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228798, "uuid": "b1c67d1b-e15c-4e80-bca8-2489b939c8bf", "comment": "Malware payload (AgentTesla)", "value": "c3bb434ceab11b4650cb5cbd85704234566799a7", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228798, "uuid": "ad020b43-9983-4ea9-8968-e3c70f26f74c", "comment": "Malware payload (AgentTesla)", "value": "cd8867990e56dcfecdf93dab34d2cb0bcb3ffca23f0082dc437aa33c6456a117b90467d44fd4dd74bccbc81e261b7eb5", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228798, "uuid": "988bba66-d5e5-4438-aad8-70e14a708f9a", "value": "T1B4C4238F801BEB86CE4E28B7EB60A02D7BFD551C77886C27DB852257BC7409A1550F39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228798, "uuid": "b8c1b497-85b3-40e9-9e9b-297fc9ed73df", "value": "12288:tPd4nz//Qx6vYBL2Q239eKw/A+nw3JLFLMlSudRqpI6aE:Ryz//QwhQ2J85nw3JxudQIBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637228798, "uuid": "8b0e5b86-08b3-429d-bfb5-fe5465b7eb2b", "value": 547204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637228798, "uuid": "3d612f08-8078-4a30-b776-9dcd4eca4620", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228798, "uuid": "633b3c9e-0d4a-4fc7-a75b-73f2347674af", "value": "Fattura-pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18721b3c-48a2-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637262157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262157, "uuid": "2262f2c4-1cf6-49cc-ae3a-d4a60d8df928", "comment": "Malware payload (Formbook)", "value": "7379e1188815d7e39ab45b79abc3537c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262157, "uuid": "06198466-55f7-49a1-aa28-d237f9b53a74", "comment": "Malware payload (Formbook)", "value": "9f3cb1ca2dd93a951cc7a77bad6fe68fb495a8af4a28e9b9df8c1e015686ec3f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262157, "uuid": "e16dc33b-fcc1-432c-8306-31a642fb2484", "comment": "Malware payload (Formbook)", "value": "4c382a0e11cb0abc3d269ec0ebc3a5b36526ee2b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262157, "uuid": "a177a4b6-c170-4dd1-9000-0174743a7c73", "comment": "Malware payload (Formbook)", "value": "80036c2b2411753e10e41e8d31a8e59a8ea2725a1bb36ccf77085109deb30077569f329ef50b90b33d19cb270c7bea7f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262157, "uuid": "ce6b57de-2326-4e31-bd5b-2a5e8edb2e7a", "value": "T1CE5220ACD44742988F46ABB85B1B2F45014C762DF7949A33363CA7762BE2C3B502693D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262157, "uuid": "2416b9dd-c8e0-4070-bdb7-759a7526fd1f", "value": "192:irQ/2B18aZO7Dmc42u4I86by0/MymDkTZXt5ww1q/LeLtaNPYcBINuu4Inh:iK23HEuhbJUTD0JnwwgSL4BIQLInh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637262157, "uuid": "ca43f625-4c2d-47fc-85ba-9794cf23ab11", "value": 13774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637262157, "uuid": "d2562618-5a23-4935-a806-4ec7ab1e469e", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262157, "uuid": "8e1b7749-27c2-43e2-8b56-0ea6a488bba8", "value": "Shipping Documents.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "937bdfd3-4869-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637237882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637237882, "uuid": "984eba91-23b1-4762-a614-68fb5cd4e4f2", "comment": "Malware payload (Formbook)", "value": "e0814f0c4b35e7accad6e14a13277f69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637237882, "uuid": "5d92810d-d9cf-48ed-b23b-ab63780836a6", "comment": "Malware payload (Formbook)", "value": "a02e269ca2267609aec76334e4fd13703c2071ec11a991c41c4fe785c168ef1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637237882, "uuid": "bcc21062-6810-40eb-a104-4bead0eadfc7", "comment": "Malware payload (Formbook)", "value": "d24b03c702841db7e88be4f5f93d005ffc923915", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637237882, "uuid": "efa97abc-0630-4d48-83b0-ea21cad69502", "comment": "Malware payload (Formbook)", "value": "beb2f29658e3848ae084347bb8fce4ebd910335719dc92eedeb6322fd9e01d756dae10d25ab9a85cec3a8ab22d3a2cbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637237882, "uuid": "ebfdf9b2-9d6f-4e79-a378-0230500c925d", "value": "T1E2D4E0A036B8D413E370827AC6B4D3BA4BB0B16D1DD6C6427CDE2ADFB6597607C58312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637237882, "uuid": "1cf3e856-10b8-407e-84ef-c762062fe88e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637237882, "uuid": "8de521d4-e7b8-410e-a90e-3d63e3353dc9", "value": "12288:O5im31gW79ysFXXjsnHqvkSBFnDv9YuK8Q4OWE:O5im3KWZdsnHqv9D1zK8FK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637237882, "uuid": "bcccd1fa-3297-4e7a-82ec-7d525d113c6c", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637237882, "uuid": "881bd945-269b-4616-ace6-340298ef5c1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637237882, "uuid": "fee69b33-e9ec-46b8-8079-938887a708f2", "value": "Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56aa6cd5-480e-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637198696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637198696, "uuid": "953c2188-9281-4c53-b6ca-2c46a1624919", "comment": "Malware payload (Heodo)", "value": "b3af2f3e56b954c7cd9d4dc692b1e82e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637198696, "uuid": "1340fb2b-399c-4f70-9079-fd3c51e7cd2f", "comment": "Malware payload (Heodo)", "value": "a0a0d4e1bcf290ecc343f67b4c22e4cf5da557d89a461cbb0c6ce829f9ef77c9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637198696, "uuid": "d72ac4aa-0cfa-4bf0-84d6-6c796891369d", "comment": "Malware payload (Heodo)", "value": "616d606d1874a140052eb53eb43f2619b0bf0035", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637198696, "uuid": "9ff888bc-f4f1-4a0d-b632-478fef95d6fc", "comment": "Malware payload (Heodo)", "value": "dfa4de9f4076be8a0345c1bf123cae5a6a6ea13c2303aa09f6f782860ad080adf35361bcea761440ff1845c41381f1d9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637198696, "uuid": "680b6542-fe1c-4911-8a81-477c83b9ac81", "value": "T15444CF01B280A072D9FF193A85F5C66A4A6C7A500F90D9CF53D80DBE5B765C2B6309EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637198696, "uuid": "c2109ec2-9bd2-4e9e-a029-ca8654e92e7d", "value": "822ae775303d14fd9c529b33f0deaf77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637198696, "uuid": "32c2e7d3-764d-4fa3-98d5-331b8fdefd4c", "value": "6144:ndH09uYgR7OJSuwuZc2HEaYTy7beWTBdvm:dHJtlec2HEaYTXWT/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637198696, "uuid": "db85f7b8-46d6-4e6f-903c-7381b69ca2e9", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637198696, "uuid": "eec44f3a-bb6a-42de-97e6-81cce1649031", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637198696, "uuid": "374763f9-29a2-41b6-90e5-fb6256e3c6fe", "value": "hr6Lnhchhm.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91dabf06-48a9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637265367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265367, "uuid": "9382a7ed-4103-4286-bdd5-5e4548e98450", "comment": "Malware payload", "value": "8fdabb050d67f8ba79da1520df7f65b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265367, "uuid": "9c171121-6baf-41c9-8c18-90893a0f682f", "comment": "Malware payload", "value": "a127a597c69f6084d2076b1f4853404dff77dfb5a1e4f1e8d57516ab035ab0f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265367, "uuid": "0cfca631-f244-4fac-830b-04f5de9a570f", "comment": "Malware payload", "value": "24ff1979225da1651d4c2282c4df04a7f1d95383", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265367, "uuid": "f83f0ba6-b5df-4a17-9f70-346d100597b2", "comment": "Malware payload", "value": "e34d23b206b085d81d993ba2a4c8e00d6b5dc50db5cb2208b573647e18a1620d707b17d0aa308aacace009b282b8dfb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265367, "uuid": "eda5c0c6-7552-4695-b069-b2b99c0fd5f4", "value": "T17E6523BA8AD5A236D084DFB312DA276B1A3C7CD067488287D64C31F45B241D52F3DE6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265367, "uuid": "03bcd8ab-585d-4ed2-8295-c849ebf81cc3", "value": "0ebb3c09b06b1666d307952e824c8697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265367, "uuid": "a110d863-5236-4927-b581-8e26629e86ff", "value": "24576:kB7AvmG+uyFI11vqhfNNdh4Yf1xgRrorrnzmsYScJbdDphbAzTVS:y3lFI1gf7df1xuoysIRd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637265367, "uuid": "497bcb50-8a9f-40df-898f-83f582da2c3d", "value": 1409536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637265367, "uuid": "7f2432ac-679c-4303-bc26-1ba9d8efc2ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265367, "uuid": "8b276eb1-f357-4524-a0cf-f3a0f7fc550f", "value": "8fdabb050d67f8ba79da1520df7f65b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5ab408-4875-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637243133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637243133, "uuid": "0ac2a0e0-ecc6-48d3-afc7-8c60f217fffc", "comment": "Malware payload (Dridex)", "value": "f8e4a2e1b1ad28fbe221f265062c0290", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637243133, "uuid": "e4b89f26-5828-4784-a46b-d5ba4d32cb04", "comment": "Malware payload (Dridex)", "value": "a17c109e672bba80800931460f58d3c869fc81b6a191ac43abf37b13f3466210", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637243133, "uuid": "d446ba79-c4d2-49ee-8261-b02a46802669", "comment": "Malware payload (Dridex)", "value": "1a91680f19ceb45d40abe644638db80b042a5ad1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637243133, "uuid": "88851ad8-69bb-4782-9c65-f4a5761aab51", "comment": "Malware payload (Dridex)", "value": "5a18d8c20b4fde372f5e818c4c9194a20e059d233cd504e5f2ce676f2616e7780194858730354621f5fa7f08df7b8b68", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637243133, "uuid": "aed44fe7-9533-4a79-b75e-84968a386169", "value": "T1DA83025BD5D77824C1EAE8FDC5852CE69436090E004ABE2FBCED06B81B150CF9B4E56E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637243133, "uuid": "e072b30d-64c2-43a3-bdd8-4ba4c6d4cfd5", "value": "1536:1Wwl88pym5JLIPFFxgFzx5YVqHS2YzayhpSW4vHR05Q4r5UZKUbsJddHS:wwlJImfjFzIsj8aipSW4vHREQ4iZKUb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637243133, "uuid": "f9c102c3-0f0a-40e4-8084-ffad30658b8c", "value": 88454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637243133, "uuid": "93912dc9-3a2e-4161-a7c9-38d707fbc9c4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637243133, "uuid": "52acdaf7-2d9a-484c-b692-df90a2572de3", "value": "Venue_Booking 11780.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e962e5-483c-11ec-843c-42010a9c0014", "comment": "Malware payload (Neshta)", "timestamp": 1637218421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218421, "uuid": "9e494e3f-17f6-432f-9061-e4b56799160e", "comment": "Malware payload (Neshta)", "value": "9cdeb7a57e0b78f5a7b7d79e557d3dfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218421, "uuid": "36d0b2c0-6178-4c31-abae-769e61cc988f", "comment": "Malware payload (Neshta)", "value": "a1ac7e8549374b66ee31c8ce943790219ab8e70559f7cff6bcb00e658e0f56ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218421, "uuid": "d1157b75-48bd-4750-b6dc-bed3e1c4c239", "comment": "Malware payload (Neshta)", "value": "07eb1aea9e88b5edb608bc2fe66da0fc9199f3bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218421, "uuid": "ba1431cd-f889-4ad1-88db-ddc6b5c47c7e", "comment": "Malware payload (Neshta)", "value": "aeb2333a2885d2ce8929185b992b8f3b4aaca94a05442a5c7ecade2b07bf2224063b1b312bfe2adf55750641d237efd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218421, "uuid": "8ad5bb6b-c0c4-4ae8-80b2-73e5b091416e", "value": "T1D8D4D0A036B8C827E37081B5C6B0D3BA4B70716D0DE5C6427CEE6ADF7A697647C58312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218421, "uuid": "b312b80e-48f5-4360-b693-6035d7c89674", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218421, "uuid": "7bba01ad-3192-4063-9e25-6b199f2f05c7", "value": "12288:84m31gW73grFaJw1gQFK3CARY4x86PkcGL7:tm3KWWAS1gQnqLxOL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637218421, "uuid": "51fa3c34-7f97-4355-a0dc-ec6df6ce93ca", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637218421, "uuid": "68a5b4a7-e8c6-498d-bcf7-57c282bd5133", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218421, "uuid": "aa783522-122f-4717-93e0-80ae039c42db", "value": "PO#6018634905996.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62abec7f-484f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637226633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226633, "uuid": "1a8d3346-6ba4-4395-ac72-c12caea2bd69", "comment": "Malware payload (Formbook)", "value": "a27b832c7e6574804e87d090171f825b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226633, "uuid": "02c72f9f-173e-42f0-b852-47e9978ed945", "comment": "Malware payload (Formbook)", "value": "a214fdf746e69233539698d2812da10efcadd62d48680c30ba576fd0cd938c45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226633, "uuid": "d5dc491d-783d-4420-99e4-028a734d0ad2", "comment": "Malware payload (Formbook)", "value": "93363e33bc4169bde9062d9fbdf0c440e98225dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226633, "uuid": "ce4d77b0-1bd7-4a16-9476-f22480484c31", "comment": "Malware payload (Formbook)", "value": "9d422a51f019779239fd05134c3f47726f3643b0c1379f1e71a28ec95f2fe3050d6ff507911708439516f6b7ff02c546", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226633, "uuid": "c2aeafb9-4043-4e78-bdc9-8bc2a66c2197", "value": "T174C4E06A23510BA7E4843C7ADA13086C5AFDB49AE26BD3087D73D1799F9B7404B063C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226633, "uuid": "fc7bd7e3-0927-4145-9192-c2f3a261731f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226633, "uuid": "5f3e9f01-9f00-4828-a9a9-6b2248ffca29", "value": "12288:Tx3DUYsqV+PuZZzYVyEHG2B1MxwP2YMn6ut:d9R+SWVyN2B24Mx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226633, "uuid": "1dadb5f8-543b-4997-bf83-3263bd224d51", "value": 557568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226633, "uuid": "08615a26-77d8-4fa6-9d04-6bb8579e90aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226633, "uuid": "a7e7f6eb-c8db-4ac0-8e08-b42d0123e755", "value": "FedEx Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b8bdcd-4874-11ec-843c-42010a9c0014", "comment": "Malware payload (Hydra)", "timestamp": 1637242499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242499, "uuid": "913bfabc-a63f-4cdd-b3c8-72babe495eb8", "comment": "Malware payload (Hydra)", "value": "62f500d8d63a71a821f9de8932101be7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "torhydra", "colour": "#33F7B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242499, "uuid": "635f376f-e6fd-4c34-a54a-cced6649514c", "comment": "Malware payload (Hydra)", "value": "a2c91743a0834cd1fb63c6965c581e1f5a57f1d2fcb226985423894ac814c93a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "torhydra", "colour": "#33F7B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242499, "uuid": "715b9aa2-d625-419c-a539-cddbd7c28154", "comment": "Malware payload (Hydra)", "value": "219008f34810ef684dbe0f3700fedea52d197a8e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "torhydra", "colour": "#33F7B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242499, "uuid": "61f5e6c1-6d3d-4916-9b59-8a5b71feb266", "comment": "Malware payload (Hydra)", "value": "4fab6ad44e3f0fbc239a4b95cd3c01739e08f320377c4105246c2029d190585cb6a8f2fb631fae9b861f7ec337a52d61", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "torhydra", "colour": "#33F7B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242499, "uuid": "24c5936d-6eae-496d-b024-96b82b7184c3", "value": "T11BA6339BE8C01183FF6B997F104B0544631049962693C43FC1882A985BE9FDD76EBDAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242499, "uuid": "ca42ef3f-f441-4d5a-844b-22cc79f628eb", "value": "196608:vjmpFvagIUWhZu22HEJyQuzUZZyNWGsDWx0RiQdyjynFAL9Y:vj2W+2eMyQxH2WG4Wabyj40Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637242499, "uuid": "81169410-670b-43bd-9e76-a882c1b8ef47", "value": 9694264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637242499, "uuid": "758eccab-5f86-4ebb-b007-3f52a1d98c9c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242499, "uuid": "8bc19520-c56c-4b60-86c7-2014bf88ffcc", "value": "db.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f83162-48b4-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637270157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637270157, "uuid": "c8a1f349-d382-4f89-8464-9b7299f87141", "comment": "Malware payload (Heodo)", "value": "ae5951e826faa8eed7f17a8efd17a6d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637270157, "uuid": "6e0ee3a4-e4dc-4125-b026-db28055a9e88", "comment": "Malware payload (Heodo)", "value": "a2eaa2c1a6efa7ae8a3423e4eb2be9dbfd5e1e9fbe30a5434c2612690695b159", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637270157, "uuid": "7fd3bd32-fdd8-4bee-aaf6-d9bc9fe65c1d", "comment": "Malware payload (Heodo)", "value": "3e4d8d57c56c8facc4b70c2308b98bbc308504dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637270157, "uuid": "1e2b2f63-03af-456b-b7b7-3188160a8602", "comment": "Malware payload (Heodo)", "value": "4df1372ec63572fbc10fd292912610690e07648d6402fa33f9c4d17eae486615a2808838bfdb1d949b14861d251aa359", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637270157, "uuid": "37c65698-59a6-454e-83a6-11e90f467523", "value": "T18BA4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637270157, "uuid": "5dcf5228-db95-4c57-b00d-397421bc721d", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637270157, "uuid": "3606d2cd-3942-4be2-b34a-da840728f744", "value": "12288:bdv8jkvzqZvv2wLBRmTi12yD88kYwZ1h1:b2Zvv2cgTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637270157, "uuid": "18749f25-4be3-41b2-ae18-b6aa8fe4eaac", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637270157, "uuid": "2fea3fc1-0feb-4f3e-ba0e-d87b2a543a60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637270157, "uuid": "f9c4a4ff-6e6b-42dd-8b31-9be4f3b92e31", "value": "ae5951e826faa8eed7f17a8efd17a6d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74fb32f-48a1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637261994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261994, "uuid": "fb785c11-7e4a-4ee2-8e10-172188e22e55", "comment": "Malware payload", "value": "0696ade244a9970fd1b6aa59273e0f5d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261994, "uuid": "afdb2e3f-4cc7-4b10-a3c8-b0fcbaf2e63e", "comment": "Malware payload", "value": "a333828d3a62732e0af44a15c756b3342a98cf4e375423904051f3b6733622ee", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261994, "uuid": "97fda722-928e-479f-845b-6702d2afd7d9", "comment": "Malware payload", "value": "1a0dd11868493fd8a79107f19bf70b9ee7564daf", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261994, "uuid": "0ff95f05-541e-468e-be33-64764bf9831a", "comment": "Malware payload", "value": "4307182402c1e4f0802a84f190948e0ed8c5e8ee1200bc4ca6dc907a5fc8df53df190c692b64553a8b1378be0a03c5d3", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261994, "uuid": "ee49f752-5bff-46bb-b2d4-0855ffb81446", "value": "T17A753912B2BD44F7C1A736F75DDB53A4B825BD3029249C4A2BE83D48DF35E813926293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261994, "uuid": "818dbc63-7984-4312-a851-34dab99738ac", "value": "24576:2d9e5AW1RNfp/9VW5AoiZNbCUactkplPa3a8mTU+iLGYjASA:2dQh1aiHyctkpTPiLGYj3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637261994, "uuid": "e866db70-7daf-4c02-af83-1e0cd0fc6c0a", "value": 1587200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637261994, "uuid": "8aee0c6a-2c08-478c-ac03-2aa827d098a9", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261994, "uuid": "b34e06d2-8c6e-451b-8ccf-8cd72652c5ae", "value": "Factura15062021_(977KB).PDF_office.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c930fa9f-48a2-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637262453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262453, "uuid": "8f780081-00b8-4c5d-ba83-2aefb895ce1c", "comment": "Malware payload (Heodo)", "value": "18be37fa91a979e2866a52f11d3eae4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262453, "uuid": "e72ec395-dd72-49e6-bd5b-b6233bfaa59c", "comment": "Malware payload (Heodo)", "value": "a3fd7dcca1a249bb4b5842883148956d7b2085463220b3f8fe54e84d5a803368", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262453, "uuid": "0317d598-dfdd-4a90-b581-9c70e9e9d123", "comment": "Malware payload (Heodo)", "value": "69946d7003f94e0011cb9dcad3f2f9e242c7570b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262453, "uuid": "624d8e30-3091-4124-9196-0c9c70906735", "comment": "Malware payload (Heodo)", "value": "852d0a84a570460c802f922c4cff3e58b582591d7fbf4db4af84d11b14361f147550366d8acd0681fca98db4ebc0eb05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262453, "uuid": "231201f6-2413-41d2-a5b6-d80e1b3a7142", "value": "T18044CF01B280A072D9FF193A85F5C66A4A6C7A500F90D9CF53D80DBE5B765C2B6309EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262453, "uuid": "3ce70e13-f133-4c66-896c-9c36f4ebf8bb", "value": "822ae775303d14fd9c529b33f0deaf77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262453, "uuid": "d8d45a16-e913-47ca-9b59-c9f9a52bea51", "value": "6144:ndH09uYgR7OJSuwuZc2HEaYTy7beWTBd/m:dHJtlec2HEaYTXWT/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637262453, "uuid": "0795f335-f023-4f2d-9fe1-6fc8281f561b", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637262453, "uuid": "1ddb42cc-caf0-455c-a483-22d7a030fbd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262453, "uuid": "0a6023b0-7372-4db9-8a3a-2d0467eeb9cd", "value": "18be37fa91a979e2866a52f11d3eae4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde5f293-4818-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637203271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637203271, "uuid": "b1e2bd3f-493b-4ccd-9af1-99bd536b08fd", "comment": "Malware payload (Heodo)", "value": "58788b54d43e1d51fdcbfa5bd5fca70d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637203271, "uuid": "c741e8b7-f217-481f-946e-38e896aa2a63", "comment": "Malware payload (Heodo)", "value": "a45fe9377ea0be70bf1b348a5be45d109e57987a243fadcb317955650d930f43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637203271, "uuid": "f054d3e1-2802-4b59-acc6-6f94db9b5f63", "comment": "Malware payload (Heodo)", "value": "3fb483115e065a1fc917f70985ee1cab5bb2a073", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637203271, "uuid": "97a4fa4e-d091-4d10-a0e9-acd381af9de9", "comment": "Malware payload (Heodo)", "value": "f5dcefa8a53971cf45c896b978c85f64518851e562e53892b77f80429f26b5f6d29b2c362765463334b5f31322cd16a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637203271, "uuid": "dadbdfcf-4f98-4ec5-a960-db8218c406aa", "value": "T12444BF10B1809032E8BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637203271, "uuid": "dbf94e9a-7144-42d9-91ff-c9ee7bae04a2", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637203271, "uuid": "cf30d948-ec02-4ecf-a1ba-efc4a8888819", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBB6asb:prf+WPVXNcwUKaWT8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637203271, "uuid": "75103e70-7079-48d9-a37e-4ae1336e2dae", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637203271, "uuid": "44067315-2961-4e4b-a300-29e69080159a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637203271, "uuid": "3b45fd6f-97e2-45c7-806d-fd7ec6639308", "value": "58788b54d43e1d51fdcbfa5bd5fca70d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d4ed773-4873-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1637242193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242193, "uuid": "8263dff8-d881-4014-96f1-3b58d438eab3", "comment": "Malware payload (Gozi)", "value": "c00b19a1262d6e3b5b994cc069b37b89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242193, "uuid": "84031f29-ce3c-4230-9470-1bce5ef96172", "comment": "Malware payload (Gozi)", "value": "a51feba2ae85a3ca8b15ebb0f458fe4a7ba135c6ace77d560769a7eb3bf02243", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242193, "uuid": "5458e15c-2540-459e-a391-22c53e2327f6", "comment": "Malware payload (Gozi)", "value": "10e249e848a49ff0bf899ede2f2540f537899ff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242193, "uuid": "ec6ce3d9-0595-4392-98dd-5cb1d7e6c5c4", "comment": "Malware payload (Gozi)", "value": "3f7f417e9f23b62edee88e1369b76a71fd3f88e92ab804606d9432f0f88c92d080eeb17641190815e4a5df9134618fcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242193, "uuid": "115ae4ee-d909-4257-bd3e-f41d3b2859a6", "value": "T12A244A6AA3E40595ED6BC6B6C953D65BE7F274092B14D30F43B0CAA66F07732B21C342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242193, "uuid": "2ed7cbb8-7593-4e24-8566-bea7aaa2c0b4", "value": "6144:/HExb7VwvtKNbnvSxYNiyf+D3Lu3y5PH:cxb5wvtKRvSxY0G+D7u3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637242193, "uuid": "5ee22cfc-3a8b-41c7-829b-0a4d266e9903", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637242193, "uuid": "9373597a-174e-4c25-b732-d67b1973048c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242193, "uuid": "d37884c8-f1ed-48a2-86f0-879d164879fa", "value": "1d909b40000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83307307-4851-11ec-843c-42010a9c0014", "comment": "Malware payload (Neshta)", "timestamp": 1637227547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227547, "uuid": "2c6e4aca-2489-43f2-8c51-7c60fa3615b5", "comment": "Malware payload (Neshta)", "value": "f8906462bfd37551085272bb77ff8eac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227547, "uuid": "faec44bc-fc56-45cd-991f-c7695eb4b1ec", "comment": "Malware payload (Neshta)", "value": "a56201e88978eee0be785d68c9f510b25dc8d5e702af0b9d17dec5e507fc3626", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227547, "uuid": "69ecf604-ce89-44ee-b9ee-a784c511c069", "comment": "Malware payload (Neshta)", "value": "faa366615778213d0969743eba215b957fbec235", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227547, "uuid": "285c11f7-9ced-4a93-8ec3-c0c43a58d049", "comment": "Malware payload (Neshta)", "value": "89683813065e04fbaa43e637e6084e851309c00765707d04164b112512a6ea863178daa049bb455ec68f61e6589508ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227547, "uuid": "68e8b924-972e-467f-95cd-5a584646bc6b", "value": "T131D4E0A03AB8C817E37081B6C5B0D3BA4FB0756D1DE1C6427DDD6ADF7618B64BC68212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227547, "uuid": "affe99e1-2a21-47bd-9090-ba3f5fe8bbad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227547, "uuid": "f37410c0-ba34-457b-8953-35148908e20f", "value": "6144:99dHUa3HXkh22hlECn/KqS15VIFI7M5IBOyVZsPl+34OQ61cODNm8jN/7oQj2hCe:94m31gW7wRjONm+N/sOJl6Bq2s6LT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637227547, "uuid": "4fda9e2c-20f2-40cc-a650-58e99abf4ec3", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637227547, "uuid": "1c8885fd-6dca-4daf-8cbb-67ca04ed8b94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227547, "uuid": "03d3f2cf-8609-4134-bedb-f9a19be83fa6", "value": "f8906462bfd37551085272bb77ff8eac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d054e395-48c1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637275780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275780, "uuid": "8129aea2-f34a-43b3-be13-27ab41e9064b", "comment": "Malware payload", "value": "fda6368c08e22aa3a3a4a71b5270cd95", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275780, "uuid": "479679bd-6a20-4d61-9bf4-32bfb67919e1", "comment": "Malware payload", "value": "a63466d09c3a6a2596a98de36083b6d268f393a27f7b781e52eeb98ae055af97", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275780, "uuid": "1686b8d0-0042-41aa-a27e-d90a2dac9311", "comment": "Malware payload", "value": "c4511ad16564eabb2c179d2e36f3f1e59a3f1346", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275780, "uuid": "a03883ee-28fb-445e-981f-8f9a2539c0c3", "comment": "Malware payload", "value": "0afd5467fd60607e1e7b6a2fd709ae755ebb222634f6b2d78437c52c0072ba206d016979f44069fcc8783e80ea739b68", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275780, "uuid": "a22b7252-f974-4a79-a88c-d43da7c94e5c", "value": "T1DAB2F026820CC81CF697C1BDAEDD0AC282C9F1660A7962FF1DDC481E29F765D15E538B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275780, "uuid": "fb880dff-6555-49fa-9020-f63251d29377", "value": "192:eAtUZTSfjSj/1OcDMLgpMwQ/MfAuosCDC0snDCgsqHDrmsDDiEvox3DrztKrjJcK:eAtUZOfjbV98Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637275780, "uuid": "34795bc2-c48f-40fa-a5ba-104f98864c1e", "value": 24228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637275780, "uuid": "aa589d80-7627-4ea2-9a99-31184fd2e9d2", "value": "application/x-mach-binary", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275780, "uuid": "4e89e405-6c7c-4464-b122-0c3bcb53d48e", "value": "a63466d09c3a6a2596a98de36083b6d268f393a27f7b781e52eeb98ae055af97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5146746-4802-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637193673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193673, "uuid": "f2e714b3-0c84-44f6-b8db-b9ed693798b2", "comment": "Malware payload (Heodo)", "value": "a923c6bdffedbfac254e9e941673d3fd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193673, "uuid": "93732f1b-920d-41e0-a92d-b29c826136bb", "comment": "Malware payload (Heodo)", "value": "a63c6f274d0e6cbadd2d12a46d01e32a86aa9931d62e516c3e30527b6847019d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193673, "uuid": "0795ae89-6d8a-4a6d-a044-bd0b28ae85e4", "comment": "Malware payload (Heodo)", "value": "a84e00e6566cb1747915f62fe34271a9fd1aadd8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193673, "uuid": "5ef83a8f-f01b-4f6c-b0d8-1382afbade03", "comment": "Malware payload (Heodo)", "value": "4cdc880caae62ea4c5d8fbad0840217999f1070def11c7a9827f66b9a1399fb851b99c8d9b6ddafc0ddd473b43ea2eef", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193673, "uuid": "64bdc4f4-03b4-4291-9cb5-371316502911", "value": "T1A644BF10B1809032E9BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193673, "uuid": "4846b02b-1701-4986-85aa-52dbc8e5d7d3", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193673, "uuid": "e18c42ce-208d-469e-8189-81e8e27cd4be", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBS6asb:prf+WPVXNcwUKaWTHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193673, "uuid": "077647d6-02b1-4f86-a872-9c5204fc5b66", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193673, "uuid": "6537fd65-f804-494f-b0ba-9d87fe260b9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193673, "uuid": "e1d124bd-43f2-45c5-ac01-589217e6a583", "value": "emotet_exe_e5_a63c6f274d0e6cbadd2d12a46d01e32a86aa9931d62e516c3e30527b6847019d_2021-11-18__000109.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d874a1-4860-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637234000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234000, "uuid": "a5094bfd-5914-4e5c-8979-94a764e808f1", "comment": "Malware payload (Heodo)", "value": "c5cd8f1dc089611b709c85a4c1306534", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234000, "uuid": "c1094041-5733-4db6-a414-a70de585c60b", "comment": "Malware payload (Heodo)", "value": "a7343086d72f81f91cedc05d88b11cf44ba5da9ac6c25983870f3a77f854f4e9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234000, "uuid": "d8a7e84e-e349-4b6b-a622-c6ddf7a5e104", "comment": "Malware payload (Heodo)", "value": "988de68afd8a122a8fbe3828fa60649876fe6315", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234000, "uuid": "dbec0c8c-674d-421b-be6b-9aedbbebe821", "comment": "Malware payload (Heodo)", "value": "60d914cfaa2cf8a7ffdf6bb35345d4cb3feceab31e59097a603a882be85cbfd6c538a18597af783de66584b115ffb1cf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234000, "uuid": "aaf81cfe-6b2d-4ad7-b9ea-c3af17d2c001", "value": "T1B4D4D0112843606FEC9C153C049977BD8FED6B55C2F4E8A7CF80E9E4AAC5CC185B6A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234000, "uuid": "b6afcc48-53e2-460c-a8ae-1a688926952a", "value": "9147e5ab6cd2dcc785393175990a85b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234000, "uuid": "d01e7803-5927-4468-beaa-cd795b2c77e6", "value": "12288:uOyVoxITHISr3VYRJ0QvcaqNqMWMeWXm6QrXmZ5YTsp4:ZkVYPZ9169Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637234000, "uuid": "ec8083f3-9fb8-4058-8b5b-1fb00751d389", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637234000, "uuid": "579ba9d4-b738-4105-9da1-f9d6d853a37c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234000, "uuid": "c71031f6-1480-4435-ba85-0c00fe09d35e", "value": "emotet_exe_e5_a7343086d72f81f91cedc05d88b11cf44ba5da9ac6c25983870f3a77f854f4e9_2021-11-18__111314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4be2dd4-4852-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637228059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228059, "uuid": "39733adf-9ef3-4d0b-96b0-606818cbd046", "comment": "Malware payload (Loki)", "value": "4cd25bd80f29bef67282d4cd8bb6c611", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228059, "uuid": "4f029fd3-7f1a-4cc1-8d12-198091da799d", "comment": "Malware payload (Loki)", "value": "a8b0638abab2074b1714dbc6c1d2d07825b4902a413de36b62543937dd12d620", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228059, "uuid": "eb13a87f-cb83-417c-bf7d-d91451032659", "comment": "Malware payload (Loki)", "value": "d53e73e36550726137d6edaa21778a914b2ce482", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228059, "uuid": "b50ea029-04ca-4f7c-ba60-343f55633187", "comment": "Malware payload (Loki)", "value": "d87a5424723153c2112dc2576cbc06894bc6f801eec072bfe3506fc96e168266497c79a55a37979316a0b4e5816108ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228059, "uuid": "2605f3b5-c8be-4552-b3e9-41acf6b23719", "value": "T158B4DFA03AB8D413E770457AD5B0D2BA8E70712D1DD6C7027CDE2ADF7A697A07C58312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228059, "uuid": "f653c1be-98d9-4b91-ac3e-18e454a4f268", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228059, "uuid": "0e973953-06c5-4091-87d3-266e6bdad6b1", "value": "6144:OqbKEUa3HXkh22hlECn/KqS15VIFI7M5IBOyVZsPl+30MxF2Q4nQyC9AlLWevyRB:OCKTm31gW7d2uyOKLsaFC+FXUzEtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637228059, "uuid": "5424cfe1-2a2f-4237-b794-13b0ad11d1bb", "value": 525312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637228059, "uuid": "fa2288b0-92b9-43fa-900c-285228eb9707", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228059, "uuid": "ca3ee4a9-f530-4086-8935-9edabfaf99a2", "value": "Revised proforma invoice_pdf__________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88824572-4802-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637193625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193625, "uuid": "df25e10d-e593-444c-a236-096f496b9631", "comment": "Malware payload (Dridex)", "value": "2fcc29183da93b5e25c9090446ec2131", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193625, "uuid": "6be62de5-7eee-4f6b-98c2-25509370e4ef", "comment": "Malware payload (Dridex)", "value": "aa1ba09faa7eefbea5b40859053920fcbdcd46c0d7db69da0510156a8049993c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193625, "uuid": "eceb6e3e-d1e4-4747-aa96-210de68a2c68", "comment": "Malware payload (Dridex)", "value": "f6ea8a34338e44b6bdb8a4bcf09a4804e0adf6ba", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193625, "uuid": "748bd1a0-d623-4df0-8b93-8ad0947bc5d8", "comment": "Malware payload (Dridex)", "value": "15e29b105ff7772e3b4eaf426692c8516acd850dd8c1f95b07de90b81fab1c07265102f3a7f755d85e45e8c7e1ec090f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193625, "uuid": "8c24946f-f966-435c-8e03-d4fe9bc44e05", "value": "T1D4E4AFEAEA45BC3DD25E14B4A529A4133D8BF98C009ACBC1D971BD16E0FC94E7A1F407", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193625, "uuid": "284fbf6f-3a70-424e-a861-866a18c7fef1", "value": "02156850f54cd7e0fd2be68227189293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193625, "uuid": "a7d43755-9c04-4cee-961b-a248803d4c17", "value": "6144:JKooH1bTj5/vvrldK+FrWYtvhkMV3LqQ8JaiwKwmw6wicMdXbsZ:JKooS+NpV3eQ8JaObi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193625, "uuid": "c15223dd-e0e3-480e-b066-afcadcda8756", "value": 668520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193625, "uuid": "55c635ab-7873-468a-801d-45bd91ef0728", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193625, "uuid": "00889360-64e4-4378-9f89-773e50ccfaba", "value": "SecuriteInfo.com.Trojan.Dridex.777.12530.26731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d47a3c-48b2-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637269004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637269004, "uuid": "cb23acd9-ed79-42b6-88d2-eb3628d5278f", "comment": "Malware payload (RaccoonStealer)", "value": "2d52e263d2bb152ab5a00c623430e0d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637269004, "uuid": "902addc5-7dcb-4e46-8216-fe55b66eb831", "comment": "Malware payload (RaccoonStealer)", "value": "aa3aa63b275a536306afe03d1c38c242186fd46f6d554b3b24fd60484a2f4a27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637269004, "uuid": "664108d8-0e19-43db-820a-2941067ec69b", "comment": "Malware payload (RaccoonStealer)", "value": "62fef17901ac7b25f5acbc513e71b59545ebfe61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637269004, "uuid": "f626606f-a9e9-46f1-916f-a7a57e648f72", "comment": "Malware payload (RaccoonStealer)", "value": "14493a6478a3af357f523f46d33cdc0e64fdb954aef4c376337e0d443e99892f905775bcac4957283efd3043477d0877", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637269004, "uuid": "cc967cf2-67a5-41df-aab4-3fad87995bf8", "value": "T10C45D06677DACC17C3612AFDC6C1E3288373E2C0683BCB076DF1249AB6987951E49356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637269004, "uuid": "78be844f-f0af-47c6-969c-b4139f50ab23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637269004, "uuid": "080ca06a-ca24-4399-b563-7a2f364bd074", "value": "12288:3wiMObUYucgq8NC5jczZj1fWAMajEJ98xxWrMxnVzugyyRdgVuky:lycgqvlofWAM48WxxW8FUyRwuky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637269004, "uuid": "7419b498-0510-46ae-bd59-f3289bbb608c", "value": 1228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637269004, "uuid": "275a721f-bc55-4400-b8e9-c8f0ddf59246", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637269004, "uuid": "2467a3d7-9ab2-41a8-918e-1e4221de6634", "value": "2d52e263d2bb152ab5a00c623430e0d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef956c8-4873-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637242089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242089, "uuid": "f64c8ee3-e0f4-426c-9764-0cc5a60dbdde", "comment": "Malware payload (AgentTesla)", "value": "b3be9b90c6ca5337fccf951ac1df3190", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242089, "uuid": "64adc8cd-cca7-4442-81cf-90ca59a7b109", "comment": "Malware payload (AgentTesla)", "value": "ab6789e19108843f78d420655f3ae2f22e8b95bc383c72784c99b98098ef0522", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242089, "uuid": "74c00867-6666-465e-9d21-dbf979ef7f1c", "comment": "Malware payload (AgentTesla)", "value": "7b270d097d47abb67e6be4975002d82b7f9a5717", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242089, "uuid": "db704fc0-6ffb-463d-a463-7d1297754b6a", "comment": "Malware payload (AgentTesla)", "value": "d6437ac2910b18d4c96d6f415781edcc28d1ce44ceb79bfdd0b3ee0b86b2c81ba4221bacc597be221d8243cfae05dadb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242089, "uuid": "a00bdc95-1293-4d9f-ad32-814c73c0c923", "value": "T11CD4CF2072569AE3D66D79714F9B822C0AF22C7DD5E0C31DFE88714A17B3791620A2DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242089, "uuid": "81cddb7c-ec70-4c28-bf87-1de7b9671bc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242089, "uuid": "5ed44f00-346c-4447-8c3f-631f60e9df7c", "value": "12288:qJF5SDwtZ38PlFSXf1jPR/GHtGurdQVYJUEKl75jQWmcq:SNtZsPlFmNTBGHp2VYJUEKlCWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637242089, "uuid": "457c85f8-e523-4ce4-beb6-3076f8dd42bb", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637242089, "uuid": "890c636c-b6c8-471e-a578-778e8b23bf8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242089, "uuid": "6a31cd84-15c1-4ae2-a1d6-e7b34d2e341d", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99435583-48ca-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637279553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279553, "uuid": "a924028b-fc5f-409f-ad61-5821e3421225", "comment": "Malware payload", "value": "5396135926f3d561823702e15191897a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279553, "uuid": "877adafc-39e7-4795-b6e1-245e5a609f17", "comment": "Malware payload", "value": "ac0c7a80d4eaf440526bd4b902e31bac13c09c94ca946dbd5591fd7c09d668f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279553, "uuid": "870d7c50-db2f-4f59-94cc-4da5137a8e64", "comment": "Malware payload", "value": "d69e5939a0fdac94d31fb7c782727e9e8bced2a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279553, "uuid": "1001f404-6c89-4f89-956e-b05addee883a", "comment": "Malware payload", "value": "00cdefd742c7b9107e6c96f1b11ed2d2113483a9a81d5f36eeeafd73d8b3f14e71635813938dd3cd76d213c6d2dd45e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279553, "uuid": "08ffcd74-d2bc-4ffd-8424-82740d4e6938", "value": "T170A4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279553, "uuid": "9ce980c2-dfa9-4049-af9d-9f2a91a9e9e4", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279553, "uuid": "0fa18756-8406-4039-92c1-fa5d15e9cf12", "value": "12288:bdv8jkvzqZvv2wLBgmTi12yD88kYwZ1h1:b2Zvv2crTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637279553, "uuid": "ceb42db6-88e6-4fac-b96d-81961dd22a8a", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637279553, "uuid": "4796bbd2-7872-4f4e-b8ff-44101989baff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279553, "uuid": "7b720695-a982-47d5-b2ae-14df0fc02930", "value": "5396135926f3d561823702e15191897a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa26d76e-487a-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637245356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "19c9a29e-44df-418d-a1a3-992594345bb8", "comment": "Malware payload (Heodo)", "value": "1ea7691731b12a66a682b26f809b0092", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "f204ea5b-2a31-4feb-9d8b-6f120deb7618", "comment": "Malware payload (Heodo)", "value": "accb13a42721d2a173ce26fd35522bf28a8013050394f59fc6dfd496f87f0afe", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "74f2fcc2-a600-4f29-9202-ed0ef5c01b42", "comment": "Malware payload (Heodo)", "value": "8cb4d5f28d99e05a54f0af4e2eb3d30a69f899bb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "bd63d325-c1f6-4227-8be6-569c94501867", "comment": "Malware payload (Heodo)", "value": "be37717c3edf608dec327d9437c2616fa901d27a3b22ea1f7e9c0ef2800f5613e28517dce1a4964fcb27390216cce43a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "7d2d6f04-3468-4b9d-baca-baf98ae4a14a", "value": "T18CA4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "1edfd325-5850-4d1c-9f54-6528ed9c3f5f", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "d411faa1-c720-4117-8db4-033723f074f8", "value": "12288:bdv8jkvzqZvv2wLB2mTi12yD88kYwZ1h1:b2Zvv2chTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637245356, "uuid": "96be3e36-0f6e-43ef-bb36-418b94d50403", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637245356, "uuid": "1efdd58e-2556-470b-9528-cbfbadde8c0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "f426e737-40d5-4e7e-a22d-885b49e43e98", "value": "emotet_exe_e5_accb13a42721d2a173ce26fd35522bf28a8013050394f59fc6dfd496f87f0afe_2021-11-18__142229.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b10a517-48a3-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1637262725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262725, "uuid": "49a4f9d3-c68f-4af7-8fa3-dbfb3b80531c", "comment": "Malware payload (GuLoader)", "value": "0bfdb27b939f11547ce43057ed3400ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262725, "uuid": "df4d7189-fa54-4891-8687-d986d0570742", "comment": "Malware payload (GuLoader)", "value": "acd06b2169ef183cd1ce229f54d7212fa54b490d09b1ad33ecc34ec6120dea7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262725, "uuid": "fcffc0c6-cf17-4039-8edb-8ed50ad1e704", "comment": "Malware payload (GuLoader)", "value": "5bb42239fe8c26e148bb603a126fe175323a3901", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262725, "uuid": "1bde656e-326f-42a8-bbb0-806211eaba57", "comment": "Malware payload (GuLoader)", "value": "36c28c01488e257b44aa609865346077b430563a0e119d3b3d7d7c50b7ed67be2c8daf6c7b0e15277513ead9c2affc7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262725, "uuid": "4a44f7ca-1bce-48c8-ab3a-40f3f96fc875", "value": "T1DBF309AA7156A432CC3BC17D9B32C9986160FC35B8D945930BC23A9D3F765E3BBB4502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262725, "uuid": "0fcf387b-dd35-4a0e-9a0a-f0023b705438", "value": "13f98f6eee90f7218ee1cf45d67476ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262725, "uuid": "6fa47293-1a16-4027-bfd5-18264347396f", "value": "1536:tawSKdL+M+L6MQViUE0VE1yBD9mugvOXHL+ds+DM:tMKdL+Mi6MQVn5ScD9mugsR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637262725, "uuid": "cc42dd09-e1b7-4170-9811-a9af0b84603b", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637262725, "uuid": "522f998b-7e2f-46f3-8f10-4de00397c264", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262725, "uuid": "ee45ea0d-5cc4-42dd-b736-ef9b3de43409", "value": "Ticari Hesap \u00d6zetiniz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba40eada-480b-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637197574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197574, "uuid": "1caa7102-128c-4d5e-86e9-d63e318ce134", "comment": "Malware payload (Heodo)", "value": "b5427f1253ab38eac6f3430106776360", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197574, "uuid": "cd848bdb-4a85-4b94-b682-e9a161a416a3", "comment": "Malware payload (Heodo)", "value": "acd73e8256ef6c04b8ee734eb6429bd33d186bb1162d292fb0b9ff0607dad344", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197574, "uuid": "0dfba0b4-4866-446b-b389-08c63b4268fb", "comment": "Malware payload (Heodo)", "value": "daf90dbeb536bc2ffa1e3970ba65ac3f2f4e1663", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197574, "uuid": "401ec0ae-e222-400b-853c-17641f0781e1", "comment": "Malware payload (Heodo)", "value": "b145f199a2db4cae0329e5d9694c0cc30155f5687cde78a332997a6b2d6aec36126f14baa8de93b7da786de35fd5d8f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197574, "uuid": "8469fbcc-b519-4f4d-afe3-e97ce03efc8c", "value": "T10C44CF01B280A072D9FF193A85F5C66A4A6C7A500F90D9CF53D80DBE5B765C2B6309EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197574, "uuid": "2bd1587c-1e2c-4012-9725-4053e9f88ee1", "value": "822ae775303d14fd9c529b33f0deaf77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197574, "uuid": "1aefcf0a-8246-46e9-8de5-b56ca47cf1c5", "value": "6144:ndH09uYgR7OJSuwuZc2HEaYTy7beWTBd4m:dHJtlec2HEaYTXWT/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637197574, "uuid": "1e6f407d-df1c-4340-99f3-990edf454ea3", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637197574, "uuid": "0b738bb3-0913-473f-b7b9-1e69fe7ed8db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197574, "uuid": "97fdf211-ecf9-4126-a11f-32ac3d4923a6", "value": "b5427f1253ab38eac6f3430106776360", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e609cae7-4823-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637207956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207956, "uuid": "7a13caa4-9685-42b6-a412-17077ef0c082", "comment": "Malware payload (Dridex)", "value": "205bd4c7add67585dafb8bc9e4a64595", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207956, "uuid": "634f3cc3-fbc6-4e18-95c3-397543d03cbd", "comment": "Malware payload (Dridex)", "value": "ad0a37a84fe23aa26337b1519c1208f5b2ada3d0ce4e0a6cbcceedf84f1222dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207956, "uuid": "248fb96e-20ee-4da3-85d8-ece5ab38d492", "comment": "Malware payload (Dridex)", "value": "53c1e8f6f81aefdf17e6a0b27a8e1a1fdbac81c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207956, "uuid": "70f9e694-74d3-40ad-bbd6-4f50be2a9b4c", "comment": "Malware payload (Dridex)", "value": "db004d7594959b83941ce6a6b39b14422db9b592d06650c9075e6769e549642574cc4eec48e60b52d415a9acc7a01af6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207956, "uuid": "97c07ab4-b924-4dfe-ba03-f97a7c7e8fbe", "value": "T13FE48E0250D512FCFA898ABF155A67C1C6B310824ED1CB9E25CD07EADF64A03EE6D1B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207956, "uuid": "049b90da-17c3-4814-827f-9fabbffffa70", "value": "fe16443ce39f2fcea9c5accdb27a9eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207956, "uuid": "728762a8-27a4-4659-ac13-47ae9020be26", "value": "12288:AuTlJzJzJBJZn/JH3lJxJLJZJdPgA1VKBUA1rlldgJw:AuJtpDv/lVbdT3IA1wBUA1rlldgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637207956, "uuid": "217b32ba-cb52-4269-811f-6affe3779b5a", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637207956, "uuid": "1d8c9fa9-1a79-4137-9947-7903b4602f79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207956, "uuid": "256df91f-0176-4871-8c41-140d488825db", "value": "205bd4c7add67585dafb8bc9e4a64595", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f7805c-4883-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637249181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637249181, "uuid": "799bf26c-bedc-491f-bebf-a4c87de2eb00", "comment": "Malware payload (RedLineStealer)", "value": "dc518757bd8f1eac0afc9bdf2cc7ec5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637249181, "uuid": "f7f148bb-d248-437b-86af-45645dc4306b", "comment": "Malware payload (RedLineStealer)", "value": "ae3b30ad18aed8960e127553bddcf1dce053d018f8d5785d24d56898c8869e60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637249181, "uuid": "0b03872d-baa6-436f-be14-fe3f18bd1a09", "comment": "Malware payload (RedLineStealer)", "value": "b7e91a8deeafa42d0ccd043d264a32e78ed78d20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637249181, "uuid": "352ca85e-98b7-4584-ace2-2be5ca1b16dc", "comment": "Malware payload (RedLineStealer)", "value": "2665acd87b6a6ec22bad9a425276252f9adc09bb234a2978032e2a4b7c10ac62b007215a3f891fee147e7e3f04d226c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637249181, "uuid": "a3eb63fb-a134-47b9-871c-d5ee08832a88", "value": "T177766A2E2D9D11B7D1FFBEF186857867A6FD755639009C8E38C3036525922C2FAC063A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637249181, "uuid": "2ba366d0-2f29-4c27-b283-a328301594c6", "value": "49152:9+w35H7ObUTIPn3NzJXt/J8PTdlYrM5zBH2:tLIPndzl8JlYrM5zB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637249181, "uuid": "3b9b8f3f-afab-4317-818b-99794ade010d", "value": 7319040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637249181, "uuid": "42a80d76-3175-4a5c-9452-230a4e8dfa1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637249181, "uuid": "836b31e0-fa27-426f-85aa-17da7fbe7e92", "value": "ae3b30ad18aed8960e127553bddcf1dce053d018f8d57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47bcc7f6-48a2-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637262236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262236, "uuid": "0333c94e-fd71-44f3-b7bf-b59f1b316adb", "comment": "Malware payload (NanoCore)", "value": "29180c7964c492fff7b04a7eb4ffd6ff", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262236, "uuid": "f0e10bdf-57c0-4899-b524-d6b986edcffc", "comment": "Malware payload (NanoCore)", "value": "b0517ac0a2ee3ca196410802e3992ec974d3654c8777e6d8ea2e040237d23545", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262236, "uuid": "0231173c-c7a5-4700-9b23-05bacc2cd6b3", "comment": "Malware payload (NanoCore)", "value": "0b7506991ed01333765c293e833e635ad3f1172a", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262236, "uuid": "58d9de78-f48f-4ed1-9f2b-e089fb7850e7", "comment": "Malware payload (NanoCore)", "value": "0bda3588c8b69eba4bc207d865335fae73aaedc6a874bede828446c1c843709838793e263c5268a6a16ee06104af8483", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262236, "uuid": "7f2d0620-ddaf-4d51-bd7f-dab305210ebd", "value": "T11434129333807C15F569CFB12B254B56CE0DEF0B9A68BB816C39FE0987366D1AD27142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262236, "uuid": "cdbe614e-a86f-4b1b-9703-5e63f95b7290", "value": "3072:+jiPxHRvDGx9EcYTZGzNCh/l2hLcct7q0qx1CR2O2OXdME48Z2XJ+zjAuutnEB2X:rfv6zdo9oect7t600ONMEsXJNuutz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637262236, "uuid": "92a4086d-a574-424e-a3a1-55b809acc06b", "value": 234216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637262236, "uuid": "9e7e2500-db38-4a8a-8b36-d67582e1a5ac", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262236, "uuid": "11e7451b-d7ac-489d-847b-c237554a5147", "value": "18-11-21 Statement.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd64bb56-48b6-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637271050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637271050, "uuid": "34bd60bf-5d8a-43f9-a42d-31f854504f1b", "comment": "Malware payload (Heodo)", "value": "e9407ae80926eb205cedbea8155322d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637271050, "uuid": "5d07db5e-8ad3-4d17-9082-0e8aee990131", "comment": "Malware payload (Heodo)", "value": "b09e0b97870d5e73bf71ede110e7393bf3922046f036b8d942918ff70c937e89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637271050, "uuid": "03e41e56-c109-4900-8310-7ff2107955a2", "comment": "Malware payload (Heodo)", "value": "8f2d3ec628dd844cc5d1f9d4aca1f00c5bd4ab35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637271050, "uuid": "863c90ba-56ac-4f7d-89a6-cf0495fee0ba", "comment": "Malware payload (Heodo)", "value": "539e6f200805c74c123824f870773a5701c296bb40a717c32817128065a4ec6052eb034990c787aa23120b296e11b85d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637271050, "uuid": "81d57d2a-8981-49f5-b940-e92c62ac4034", "value": "T1F1A4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637271050, "uuid": "4b02d7bd-0d55-40db-b10d-b743e6407279", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637271050, "uuid": "a518a0db-bad2-4a44-b66f-be9d6ca6d70f", "value": "12288:bdv8jkvzqZvv2wLBKmTi12yD88kYwZ1h1:b2Zvv2c9Ti1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637271050, "uuid": "286e4fd0-ec44-440e-ab5a-0620e33fb6a1", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637271050, "uuid": "db39d22b-2b27-4fd4-a62a-8a4004cfb6c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637271050, "uuid": "1df3046d-e756-403d-b9a8-a0d9b09325fe", "value": "e9407ae80926eb205cedbea8155322d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf4fc4f-48a2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637262163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262163, "uuid": "93388dec-51ed-4f14-8e1e-afa9b713018f", "comment": "Malware payload", "value": "224b7fd3e54cd48044dec38820f00255", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262163, "uuid": "824df9bf-6a88-4bc7-93e5-bda09728365c", "comment": "Malware payload", "value": "b19b3e53f1f3f963765ba427cd4e6e13a3aab7ab0b1999421eb14afca7e0818f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262163, "uuid": "9bc29d79-9931-4ab0-9b00-f4ee08259141", "comment": "Malware payload", "value": "dbf29aa0675edf2ffca6da50a6067d82d281d975", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262163, "uuid": "573d33f2-b380-4250-a00a-ca3d5a5be902", "comment": "Malware payload", "value": "68f22f26ecbfe608a6f5cdfdda9f6485a6e44577ff739e738cf86a4920dd99d40dbace6735fea30f5d76b97d7cc7e3d0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262163, "uuid": "1fa38f13-19a9-45de-b5a7-a1b432fa6570", "value": "T10E812AF894686897FE6F41CAF497FDB856E8324381D740D2306DEAE61341331AD2B821", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262163, "uuid": "b7a81fbd-9914-4932-841d-562e5666aab8", "value": "96:Y+fWPYyq7pRZEYYAQ+uKFMR3ztaDSCv7A+:Y+fWPYPQPRxa78+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637262163, "uuid": "643a031a-eb62-43cd-9194-d6144d8b82a1", "value": 3985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637262163, "uuid": "6f6135e7-ba8f-4627-b295-28568e500d99", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262163, "uuid": "5be33a9d-ee1d-4613-97ed-3252e14a5996", "value": "PO 26663S.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181c9df6-4803-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637193866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193866, "uuid": "4e43c11b-d187-438c-9cdb-2e7a07827552", "comment": "Malware payload (Heodo)", "value": "f2cf09beb8bbb62e397dbcf06f3acaa5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193866, "uuid": "577b487e-c34f-4870-b733-4a97c63c23bf", "comment": "Malware payload (Heodo)", "value": "b2562b0805dd701621f661a43986f9ab207503d4788b655a659b61b2aa095fce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193866, "uuid": "3a45d8ee-9923-40e0-b4a9-646c280d45b0", "comment": "Malware payload (Heodo)", "value": "375231d8d103757f134adbc513a87f4b63080e30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193866, "uuid": "37fc33e2-97d9-4b66-a799-787db7579954", "comment": "Malware payload (Heodo)", "value": "41d6aaad0602d0ad7677f37ba1399d950fce75ebc589dfb93ba6275935c01bf1c1555e282930b47d3b35564ccbcf4505", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193866, "uuid": "9dba74fd-51b8-47a7-b586-1bf840ecdc20", "value": "T10344CF01B280A072D9FF193A85F5C66A4A6C7A500F90D9CF53D80DBE5B765C2B6309EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193866, "uuid": "064010f0-55a4-438b-8d44-407555b76875", "value": "822ae775303d14fd9c529b33f0deaf77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193866, "uuid": "fd4770ad-7d91-438d-963f-33c19018bf3e", "value": "6144:ndH09uYgR7OJSuwuZc2HEaYTy7beWTBdrm:dHJtlec2HEaYTXWT/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193866, "uuid": "8f67b289-13ab-484e-b59a-1e577be45ca3", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193866, "uuid": "d0e972cf-cdb1-4211-a4bb-34deecfc2ec2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193866, "uuid": "6519dd70-878f-48d1-a88a-037727a5b272", "value": "f2cf09beb8bbb62e397dbcf06f3acaa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200d3289-4805-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637194739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194739, "uuid": "73cf2d35-9417-4db2-bef5-84dae065faa4", "comment": "Malware payload (Heodo)", "value": "65f6217ab793057fe297151b7b24ebc5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194739, "uuid": "8a199fae-39f0-4726-9ffd-44f7430f36de", "comment": "Malware payload (Heodo)", "value": "b2565f55e5ceafaac0a7185bfb24b50650f067f5cc5f86b6a52edc1765cf705a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194739, "uuid": "0443586c-8bae-403e-8faa-7ca91ab01c7a", "comment": "Malware payload (Heodo)", "value": "a64a9d73e1d94a30d65e588ce3d26ff086907c21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194739, "uuid": "84b039af-1202-4f4f-824e-02297067fb0a", "comment": "Malware payload (Heodo)", "value": "ae73aebc902e3a0c79bcd3c728ab313ab436124db48c73cc8880f68c57d19aebf9bc0fcc86247639c69ad86f1bcca1b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194739, "uuid": "a3bc5092-5b89-4eb8-aa32-134f4fc374ea", "value": "T17F44CF01B280A072D9FF193A85F5C66A4A6C7A500F90D9CF53D80DBE5B765C2B6309EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194739, "uuid": "c97ce5a0-9feb-4c7d-9ed7-481fc6df5fbd", "value": "822ae775303d14fd9c529b33f0deaf77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194739, "uuid": "72c6a3ab-45ab-4781-9a89-71c279f6a507", "value": "6144:ndH09uYgR7OJSuwuZc2HEaYTy7beWTBdim:dHJtlec2HEaYTXWT/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637194739, "uuid": "69122b57-f5d7-4d1f-9b5e-52de816ba6b4", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637194739, "uuid": "8f9a7b70-3ffa-4284-9ee2-3fc8cb75f797", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194739, "uuid": "fe9c9f91-1f36-4284-86ee-d63d06070941", "value": "65f6217ab793057fe297151b7b24ebc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6bc9ab-487a-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637245356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "4921acb0-b138-4244-83bd-e849089bdb82", "comment": "Malware payload (Heodo)", "value": "cbd27728d8aa2ab7c76a36c2b3a39da3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "7c7d6000-08da-4d7d-994c-9c417251796f", "comment": "Malware payload (Heodo)", "value": "b2c742b65f3b834fe85876bb25ba84e975032e2c779733924ff743245c4d8dc5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "abe4fcf6-3814-4e4e-9582-3669fbdd17ab", "comment": "Malware payload (Heodo)", "value": "3574ea7006ba84d1af2ab20df20adcc1c8b27d1c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "11d43b74-68c3-46c4-8164-9632a552872d", "comment": "Malware payload (Heodo)", "value": "cbe1522f99eee2665a223f3b0eaee0ddfc2037b78b55c7f8eb9f5e918a5c48b8a1c1a34708d16022620cb09e1fb4778f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "a72f3ddd-741a-49fa-8570-3fb68eb5266a", "value": "T124A4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "92c6208d-4685-45ac-a3e0-bf045a40284f", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "27b10e8f-5212-42eb-a8dc-99ca4476d281", "value": "12288:bdv8jkvzqZvv2wLBjmTi12yD88kYwZ1h1:b2Zvv2cKTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637245356, "uuid": "22b6b2bb-0dcc-4b92-8092-b3d206e55d5a", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637245356, "uuid": "fabbb183-23a2-4a0c-ba35-eb173835f394", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "d8c77a92-5bbb-49ee-afa2-08891d77a226", "value": "emotet_exe_e5_b2c742b65f3b834fe85876bb25ba84e975032e2c779733924ff743245c4d8dc5_2021-11-18__142230.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23a7162-48a5-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1637263703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263703, "uuid": "e4522aa4-b6e5-435f-bfad-268ee132fb9e", "comment": "Malware payload (DanaBot)", "value": "7af87ecbb9fb9dc675723aac44874702", "object_relation": "md5", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263703, "uuid": "457fe721-cb0c-4c89-b9e1-07c3fc5b1953", "comment": "Malware payload (DanaBot)", "value": "b3fb774ad00425fa7c9a217b90bf9413a2106474cf6eeb06680bbe09b017a2c7", "object_relation": "sha256", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263703, "uuid": "b8e94f48-210f-4815-a373-ff80d058bc82", "comment": "Malware payload (DanaBot)", "value": "2dc98fcd14c1c3d84f55ddbd6eff5d6cbdfdaa85", "object_relation": "sha1", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263703, "uuid": "1bf42f41-185f-461f-8011-173b2ffd4283", "comment": "Malware payload (DanaBot)", "value": "fe6a025b3903f27be3df18edce64e8f96592270d2f7df9350e5502d9a5aa2112595bba929c6ee1d93cf3ef81a80b3a15", "object_relation": "sha3-384", "Tag": [ { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263703, "uuid": "edb9f66e-7e08-42d7-8c83-fdfa93bba8fb", "value": "T1E536F7E0F92ABEE7F326D03C6434B658D6E95093EB16D079B067EA6461B6380101DF1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263703, "uuid": "3a8f5c04-bd98-4731-b65e-0ccc8a4a9bf1", "value": "08a4717e804aa7f129d0a5b4fdc41783", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263703, "uuid": "dac57d8f-68e9-4034-8da5-0970b51e7f66", "value": "49152:IBwYxsLTHJueD5882/i9wlOSCJ+1sXEDV72tdfLxlWqN20qK60ZAqTSRCzV68n:IKYxsLXDBjq0knF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637263703, "uuid": "eb4bf7b8-26e0-4fcb-a136-a67404a19d56", "value": 5188224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637263703, "uuid": "9f598d5a-0a04-4a4c-8e5d-d3beb2e58c64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263703, "uuid": "fd60d294-6417-47d7-aecd-874988de619c", "value": "data.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf6ea09-4803-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637193846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193846, "uuid": "8bdaca19-d51a-4878-aa7d-8ab01633a20c", "comment": "Malware payload (Heodo)", "value": "8c5d68d8080fff28bdc7785e22e8155f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193846, "uuid": "0e2de20c-92cf-4fcd-a37b-c2ba03330429", "comment": "Malware payload (Heodo)", "value": "b41cadbef93cb7c90503700b8a8292eae04e61b87aa01f96b5858528d362c945", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193846, "uuid": "cc08071d-dc06-41b2-88d4-d77b2c3e46f2", "comment": "Malware payload (Heodo)", "value": "c25f4bcfcc8ee79eb7b5b7475fcee095c3ff1872", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193846, "uuid": "fd7e1523-69ef-42c7-86d9-35d35bed4c82", "comment": "Malware payload (Heodo)", "value": "67bc4f006a22532c998f574b2eb253f206f90459cd574a018aa979c74a443161f7827f0a31495bf8f3f22682afe50e52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193846, "uuid": "9b588d06-1dca-4acb-a8d9-a3cb16bb3d89", "value": "T10C44BF10B1809032E8BE593645FAC56A4A7D7A600B94DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193846, "uuid": "5dbd7a71-91bd-41b8-95dd-4a11cd58bbd1", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193846, "uuid": "de27d5e5-174d-4895-bab8-be47eac2631a", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBw6asb:prf+WPVXNcwUKaWTtb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193846, "uuid": "1092cfa1-5a12-44f0-b407-01a9cf9e5701", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193846, "uuid": "e7f86a9e-1aef-4ab6-82ee-f44754a56010", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193846, "uuid": "eb9fc753-e4f3-41d8-8ee1-ed2d78e88a6b", "value": "8c5d68d8080fff28bdc7785e22e8155f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b1aadf-480c-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637197892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197892, "uuid": "e5c10542-4d98-477a-a271-90906e0a0b88", "comment": "Malware payload (Heodo)", "value": "c5c1579c90cbd900d23c7f9360a6dc2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197892, "uuid": "e03a7e8b-90f4-4417-afea-b219267f6d5e", "comment": "Malware payload (Heodo)", "value": "b4677fd1abda9602ca41861ffec9a6b2e7415e2174b995d662f7d7a9c787cbec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197892, "uuid": "f504a541-dd22-4001-a766-f3bea35f7c0d", "comment": "Malware payload (Heodo)", "value": "5b353608d41055dc6029586d69756a5d033d9cf1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197892, "uuid": "44f7823d-686b-4ee9-b9c5-768a7016a68e", "comment": "Malware payload (Heodo)", "value": "b243619efdf3e66e420d9a4680355ee21bd2b60889ea62e9c04e274202b6a2e74f906479255d1cb09048083d3185c5c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197892, "uuid": "4b300d49-59c5-426c-9015-ebfaebc69475", "value": "T13544BF10B1809032E9BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197892, "uuid": "32661864-2aa8-4b31-89e6-272851cde2b6", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197892, "uuid": "c3b9fda6-68de-498f-a8e2-8f8d356e765b", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTB16asb:prf+WPVXNcwUKaWTkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637197892, "uuid": "f4813544-7531-4e09-96af-5f052c32ae76", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637197892, "uuid": "ee0f5a12-1659-4c6c-bc87-f00b0dccc595", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197892, "uuid": "e30de318-f343-49be-8747-e44909ee1a5b", "value": "c5c1579c90cbd900d23c7f9360a6dc2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b755b0f3-48a9-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637265430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265430, "uuid": "09f65a9c-8ef4-42aa-810f-c4250afccc25", "comment": "Malware payload (Heodo)", "value": "696e5bfe78999005ae36b9e2d2b426bf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265430, "uuid": "ba573f2c-d488-493d-bcb5-f05ced5616ee", "comment": "Malware payload (Heodo)", "value": "b4c37dde6546566bb11ff568d9a930b4fee72556d8e6221ccf97a41c0be654e1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265430, "uuid": "3ebcfc31-5973-48b4-adc2-1a56958a0e6d", "comment": "Malware payload (Heodo)", "value": "be9525dd3c11e033562fa339a111fbde20790cd3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637265430, "uuid": "48bd3a72-339f-499f-ac4c-f173cce726a1", "comment": "Malware payload (Heodo)", "value": "324d2566bdb6c269f79e5be46fb383ac4eea8787d423159c80e0ccceaebd565c53f581c6c73c49f53eec83168e61a75d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265430, "uuid": "2acbf8ed-eaa5-4bde-9197-62fec5847e9e", "value": "T1B444BF10B1809032E9BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265430, "uuid": "241afe4e-7b38-4808-b05d-e6c4e3252e06", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265430, "uuid": "e80a19c5-3aec-4b3e-b9c4-0fccb8786d5b", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBM6asb:prf+WPVXNcwUKaWT5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637265430, "uuid": "429c0fe9-2584-4e4d-ba9d-35f3ebe0eefa", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637265430, "uuid": "70bc6331-b189-47a5-8fdf-46e0e90058c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637265430, "uuid": "5dc14d23-1723-4e0f-b449-7167802380b3", "value": "696e5bfe78999005ae36b9e2d2b426bf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f63fe0-484f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637226580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226580, "uuid": "b71f5ddd-193f-4438-959d-bb4fb0e08991", "comment": "Malware payload (AgentTesla)", "value": "51f232e23594509dcaf2d775808818f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226580, "uuid": "947b5aa8-b5bd-4c74-ac8e-aa84914282dd", "comment": "Malware payload (AgentTesla)", "value": "b51398363fc42ec0df464fd25edb9d9d45c970624c5f68932be6f6b428431841", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226580, "uuid": "ffa2da38-1595-4a6f-9c09-2b4d65a5fd76", "comment": "Malware payload (AgentTesla)", "value": "1dbf3260f8bd6f9c4211aeabce0f7071a7ff2d84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226580, "uuid": "52cb495f-d90b-402e-a812-5329af1e6293", "comment": "Malware payload (AgentTesla)", "value": "dc339490411823372e7ff4057c72c06425ed459359e88bd3cb75053cf6d614bcea04d0551b230b243674fda9fc69de22", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226580, "uuid": "fcbc3211-8a70-443e-b9e2-70afc0b8221b", "value": "T139E4E0A03AB8C417E7B081B5C1B5C3BA4BB0B15D1DE1C642BDDA6ADFF6597607C28312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226580, "uuid": "1a1776d2-ce64-4d84-bb04-949154b221a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226580, "uuid": "c7f25c56-34be-4918-986f-15aef3491d9f", "value": "12288:JBm31gW7YPlN5ljxjCMdswmbL3xTQRth1qFUF:Xm3KWUPvXjkcmHWRz1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226580, "uuid": "d211cf46-971c-46c9-8642-6c2b58106f09", "value": 717824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226580, "uuid": "482f4996-5e73-4a11-b9e3-df9de4e200a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226580, "uuid": "233143b1-4571-427d-9032-c985904e8a48", "value": "DHL Delivery Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19382636-4805-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637194727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194727, "uuid": "1e4f5dd9-9689-490a-b06e-8f0300f3dcd1", "comment": "Malware payload (Heodo)", "value": "309fbb69a86334a77634ad6413bc3f18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194727, "uuid": "5c0e3d1d-20f8-471e-8682-76cfca00480c", "comment": "Malware payload (Heodo)", "value": "b5874da5334c79084a16e7e289d52bb78e03e044260308fe05895d1d085d9e9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194727, "uuid": "d2cf9c3f-f011-4a10-a36d-71f9d529434f", "comment": "Malware payload (Heodo)", "value": "e76ab96a1c0656aeab54dc54ebc283ef70505f3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637194727, "uuid": "5873a421-d41a-43eb-a67a-91ed26ae86f1", "comment": "Malware payload (Heodo)", "value": "0b3c8c2edafea3553ac187c82ae6a9b7c810f4c47d415ad12cbd9b69b1b12d8c86cba58fe9c403f5fb10368e80ffb498", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194727, "uuid": "82f9f5e7-b91a-43a9-be39-72e8b05d15ca", "value": "T11044BF10B1809032E8BE593645FAC56A8A7D7A600B90DDDFA3980D7E4F775C1FA3089F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194727, "uuid": "88e25730-43b4-4f05-b96f-0396868f093d", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194727, "uuid": "65486d32-c3b7-4863-9e8b-6c43364e29c3", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBg6asb:prf+WPVXNcwUKaWTdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637194727, "uuid": "9ab66484-5efc-419d-b177-5b1e029b7c32", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637194727, "uuid": "70f2534f-5aaa-4ec7-b23b-f5c7a04fa82c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637194727, "uuid": "8b1aa7ce-24b8-4e76-b297-e3fd8398fedd", "value": "309fbb69a86334a77634ad6413bc3f18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b618cef-4887-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637250565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637250565, "uuid": "755b4f73-ee5d-4849-8cbe-7e31e2d7f4c3", "comment": "Malware payload", "value": "724a0b06b2fae74ee5ccacd28674dbab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637250565, "uuid": "be01db36-9490-4b50-8645-a5625c3d265b", "comment": "Malware payload", "value": "b775832957f6535ee0fe49e560cb0edef197c30dce187c5b34363b595e0f7011", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637250565, "uuid": "eab6d4d0-25d9-4371-9810-c6b22831e5c2", "comment": "Malware payload", "value": "9cc97071b4d4abe0ddcc268a34b1fc283e221ebb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637250565, "uuid": "ec1affe0-207d-4fae-97bc-f8e17c824dd6", "comment": "Malware payload", "value": "6094c2dab5747cabf47a2df44df215c9fc50e5b46f59e98ce6e5789d3707834703bf5e7adbaf79747d293e09ae23115f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637250565, "uuid": "eead0e69-b503-4190-8b68-39d4f27d5fe1", "value": "T152073393EB51C17AE9732B72F46ACC3A1C7579780439342EB5C7196012F7FD2A87092A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637250565, "uuid": "e9d9efd9-423f-4edc-92c7-a5dd409bd792", "value": "332197ba5fd76061827e542a2853acf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637250565, "uuid": "7c0ea178-4967-43d1-9dd3-be2ec2f145d8", "value": "393216:+oUCl+paT87q8pVYbIas1/AbMCyZRhrKn+If/KFcNVBdP5Di76mR:+9paT87XpV3OlecNV87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637250565, "uuid": "a6f2ad21-d173-40d9-b218-2f3145d35ecd", "value": 17688692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637250565, "uuid": "3fc278b9-8884-460c-a618-a1e3a197c30b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637250565, "uuid": "09182458-2372-47e7-a6b1-1ebcc245da9d", "value": "SecuriteInfo.com.Trojan.Win32.Pyfatget.ac.27736.17056", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4440c308-4823-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637207684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207684, "uuid": "1d74d28a-f81f-4369-a0a1-846fb8ebd302", "comment": "Malware payload (Dridex)", "value": "25556d4ec050f98c761321c94b25f203", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207684, "uuid": "c428738a-f0d0-4c93-b149-4e7f8e8cd976", "comment": "Malware payload (Dridex)", "value": "b856b7bf0644dedaadccdc0c6b6c17edffb8d82abfac2db29e6107ecb8ae2912", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207684, "uuid": "95ba74b9-282a-43d1-a2b0-cee2f8b5e0dd", "comment": "Malware payload (Dridex)", "value": "f0ece10a5026096c3e6e5259bc74d8c88485bdd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207684, "uuid": "4d764f4e-4bd3-47d4-85dd-417d107e8eb0", "comment": "Malware payload (Dridex)", "value": "88501bd04e77edd225238ced3d902a53df74f2170683a43c68434da991b2b7a19ea906ccbfbc36cf11def66e59a58c79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207684, "uuid": "2b86555d-4b1f-400c-916a-4d00e643bd40", "value": "T1E9E48E0250D512FCFA898ABF155A67C1C6B310824ED1CB9E25CD07EADF64A03EE6D1B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207684, "uuid": "7bc8b52e-f4c0-429f-879c-76a53afe30d4", "value": "fe16443ce39f2fcea9c5accdb27a9eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207684, "uuid": "7b02c6ac-2b80-4d4d-8987-1d1366f04d63", "value": "12288:qYTlJzJzJBJZn/JH3lJxJLJZJdPgA1VKBUA1rlldRJw:qYJtpDv/lVbdT3IA1wBUA1rlldRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637207684, "uuid": "930b73da-5f3f-458c-8519-4c40c83aa384", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637207684, "uuid": "9ad5aaf5-a9c3-46c3-a3b8-9dcabd97a032", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207684, "uuid": "23234693-dbac-46b8-8034-e5974d8dcee2", "value": "25556d4ec050f98c761321c94b25f203", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8efcb0-487a-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637245356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "9c5f3a40-ffa5-4f09-89c5-aacabe903881", "comment": "Malware payload (Heodo)", "value": "2b970147f6f584236e9def7e160799b5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "df59e5b0-157f-4b7f-ab5a-9430dcee152e", "comment": "Malware payload (Heodo)", "value": "b88a527526ba86a42a4c068d5761dc620f35358283a04262735a8b884e8df9e3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "7fc39bd1-e180-4ee1-b6f5-38d0ed95112b", "comment": "Malware payload (Heodo)", "value": "5ab14145f294ac5dd8595629a438911626822e9e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245356, "uuid": "a5ff1b48-bf80-4f57-bf42-d21a71e38a9f", "comment": "Malware payload (Heodo)", "value": "f51f283d421e5da647b0f8f69d222e21a450efd3fe9e844356482fc39ec4bc1c275d62cde2a5c53613b2f626da72f117", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "98bbd9c6-dbb6-4739-9625-02f7323844c4", "value": "T14BA4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "85253ae0-4c50-41c3-9364-0890ebd8ce9a", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "0875768d-2725-4df6-811c-7b7048b6db5f", "value": "12288:bdv8jkvzqZvv2wLB7mTi12yD88kYwZ1h1:b2Zvv2cyTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637245356, "uuid": "2a708b01-168b-4308-92b4-331aff6b9b7a", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637245356, "uuid": "13a35016-8228-4799-b20e-de26511ab74a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245356, "uuid": "acc8b5ea-c74c-433f-8d4f-d353d4a6d10a", "value": "emotet_exe_e5_b88a527526ba86a42a4c068d5761dc620f35358283a04262735a8b884e8df9e3_2021-11-18__142231.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b82207e-485f-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637233439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233439, "uuid": "3303dbb7-e066-4fa8-8fdf-075ffdc44a61", "comment": "Malware payload (RaccoonStealer)", "value": "3e593991e66bde17a7b833654498cfae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233439, "uuid": "c5e23f89-96c1-4659-af7b-5cd77d5e2fc8", "comment": "Malware payload (RaccoonStealer)", "value": "ba1169062882f29333a0f90aeadd537f71877782a4e95ce739c55c04b9265f11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233439, "uuid": "cdd5195b-5a94-4892-9acf-9e6bef918568", "comment": "Malware payload (RaccoonStealer)", "value": "d0392e94d8e58381472ff02ffd0c91fb77cd731c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233439, "uuid": "846660cf-4249-4544-8a3c-1a1f1ba32c4d", "comment": "Malware payload (RaccoonStealer)", "value": "287939308d98d61be5d7be84061baa7a5b1b01e27163d3f3afacddd97623822c3baaa317e82fadd1ae6ac534629b4492", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233439, "uuid": "e6ee5a82-7edd-4f6b-96ef-34c05175f549", "value": "T1C1548D10A7F0C035F1B756F849BA93A9B93F7AA1AB3490CF52D116EA5635AD0EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233439, "uuid": "8f2c1c2f-af66-4332-8225-208478be4036", "value": "ff6439958bc7d1b926a3ea41188420fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233439, "uuid": "cee398d1-edf1-4bee-91f2-fdab0ce9ef18", "value": "3072:k40ZpP7ytbrhcIXjK+NlT0OoviL4CB541vksW2QP/evkMRdYby4RhFhWfWb9zVtY:JHlND0i0CA1x+/eLRGrrF0C7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637233439, "uuid": "398d1747-cf95-4650-a7cd-7bea993198d2", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637233439, "uuid": "869ddbf7-c94b-4ccc-a03e-53887855b113", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233439, "uuid": "641e72e5-dcc9-4252-a524-2ed28f7099b5", "value": "SecuriteInfo.com.Variant.Babar.29261.23453.9477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aae9ca0-4860-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637234002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234002, "uuid": "97dcea63-0a4a-4983-8835-fc93e29f6d24", "comment": "Malware payload (Heodo)", "value": "bedede8c697aa544b8f641b86fa2a9e2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234002, "uuid": "b2b20eed-2b56-4b57-8cc3-7720614a196a", "comment": "Malware payload (Heodo)", "value": "ba86896bccbfa72650f269410014c05b1316c64599f0f39561dd286350eeb43c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234002, "uuid": "6b36eaa9-5911-48c2-903f-bc788d8657c9", "comment": "Malware payload (Heodo)", "value": "ea3ef10c900581722c054cc9264b449261e782a4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234002, "uuid": "3fcc42c0-8713-45ff-b312-e0ad9c1b6bb8", "comment": "Malware payload (Heodo)", "value": "0ea1ae6cb67c7da1608d13208d06e5ca11449ca7bd889756f5626e6e813b55c2aefcf5cd256686cadfc5caf32284f31e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234002, "uuid": "a1391fd6-ba84-47db-9224-61258a170727", "value": "T1A3D4D0112843606FEC9C153C049977BD8FED6B55C2F4E8A7CF80E9E4AAC5CC185B6A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234002, "uuid": "7a41d7d8-78f9-470c-bc76-b0ee93d16947", "value": "9147e5ab6cd2dcc785393175990a85b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234002, "uuid": "42b2bdbe-c278-4e4e-8bc4-ee36cf38e07d", "value": "12288:uOyVoxITHISr3VYRJ0QvcaqNqMWMeWXm6QrXmZ5Yzsp4:ZkVYPZ9169Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637234002, "uuid": "b5dcdb56-2717-464b-9055-b4044bbc7bf2", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637234002, "uuid": "5a928c81-b4b9-4ab7-8987-0cd92ae83ba0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234002, "uuid": "a7258991-3a97-4b78-9cd1-fd19b06ce079", "value": "emotet_exe_e5_ba86896bccbfa72650f269410014c05b1316c64599f0f39561dd286350eeb43c_2021-11-18__111317.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98685f3-487a-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637245355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245355, "uuid": "4e53cf8f-23f5-4028-b01e-e7fec26eb60c", "comment": "Malware payload (Heodo)", "value": "e19d5062be3c12c8154126878f36b886", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245355, "uuid": "0656d812-9715-4be2-b1ad-8c91605a48e2", "comment": "Malware payload (Heodo)", "value": "bbc028226f42e61995c4eb3b1ad74e6add76326776ba4e4d2de60bc5f592952f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245355, "uuid": "8f21ec19-f587-4733-907f-c3721ee6c42f", "comment": "Malware payload (Heodo)", "value": "0b5f8238b0093e4b768313160688b72ebc035b1d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245355, "uuid": "a51a35c9-0473-40e6-aabc-03c381c5ecbb", "comment": "Malware payload (Heodo)", "value": "eda280dcdd592b6cdb6de335c439d48f789d2043acd8c915aa2dd7855703d024a977bb9bc2663fd2b2b389f6dad0727e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245355, "uuid": "a2f6f95e-0cf3-439e-94e6-6d011e2c5654", "value": "T161A4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245355, "uuid": "1270e5d9-8b38-4aa0-99ea-4c37b26f1c70", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245355, "uuid": "01a13b7b-9b28-402a-ae40-dec485079674", "value": "12288:bdv8jkvzqZvv2wLB3mTi12yD88kYwZ1h1:b2Zvv2cWTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637245355, "uuid": "215c612a-1d5b-403f-8c3f-cf7a85ee7abe", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637245355, "uuid": "8262c8f6-4458-405c-a9d6-3419aa6a4638", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245355, "uuid": "290d0735-1bac-466d-aa53-4d92c29f0d5f", "value": "emotet_exe_e5_bbc028226f42e61995c4eb3b1ad74e6add76326776ba4e4d2de60bc5f592952f_2021-11-18__142229.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e319d52-484f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637226518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226518, "uuid": "4969d610-1365-4364-a259-0385730067e6", "comment": "Malware payload (AgentTesla)", "value": "939a24b07508b90dab5b166f8c387182", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226518, "uuid": "90d28f03-e8ff-48f5-b090-ffbbc112907c", "comment": "Malware payload (AgentTesla)", "value": "bcb412b50fca64e65a7db2b8a55fb86f340aae17e3b894042ab2a56ce743ad01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226518, "uuid": "7ba370b6-6374-4158-8e03-652dc1aa5767", "comment": "Malware payload (AgentTesla)", "value": "33bc0e63fd347925965d78e3991035b031811830", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226518, "uuid": "215bbe13-fe34-4ab9-b46e-700204364a98", "comment": "Malware payload (AgentTesla)", "value": "5b084a169c077048d56ebc38a2cea6594d4239023356ef81ababe03d790e5e92f8d8d7471ae36fa6f93cbabba7223440", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226518, "uuid": "784440b1-8b3c-48fb-8ad2-fc18ae861171", "value": "T1DD31BE6D2918B3E0A3DEAFD73417E08ED2588CD96D995002E111FDC83C4252BDEE5E71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226518, "uuid": "a042b2cb-5fac-46b9-9a20-8646851bbeff", "value": "48:/lXglYdxlAHAO0wUSWRtJ03J0eTJZJLBZe4Rj4V8WI4SGxJItP8ffYtZEkP2WTpO:/lQlNstJCJrZR87EtPsYtSkuWVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226518, "uuid": "de9dece0-39d5-4465-94f5-353c9b842312", "value": 1814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226518, "uuid": "3bbc58ee-8f0b-4d1c-9604-15db0ffa92b2", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226518, "uuid": "251c762e-0e46-4dca-ace9-8f82fc22baf1", "value": "LISTA DE EMPAQUE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30bd27e7-487a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637245018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245018, "uuid": "35c3d0ae-7d96-476b-a063-65b368606ecf", "comment": "Malware payload (RedLineStealer)", "value": "0de30ea57acbd74692f46a4280bb6f40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245018, "uuid": "c81ba887-c316-4e84-b55c-3335fd3755cb", "comment": "Malware payload (RedLineStealer)", "value": "bd9a2b4f311d6e0985ea25837aaf3ce2f8a76769edfa01f19e8f6491425e55dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245018, "uuid": "0ce0d1a1-5f16-4a62-88b9-a32f645c7451", "comment": "Malware payload (RedLineStealer)", "value": "895792dca97e412e6613dbd78105f134bd302ff6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245018, "uuid": "948d7cfd-0e14-42c3-a6f8-18b1ecb24ef8", "comment": "Malware payload (RedLineStealer)", "value": "2790e574ced9df97dcc4ad5477fb06bb528cfa0e30218eae3d3cc3dfe8c09118f11e96d4d01d2a21c0ba682620e5e7c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245018, "uuid": "2f7b1937-bc76-4fab-a201-a40b3abe06cf", "value": "T16EA35D30679C9F19EAFD1B74B4B2012043F1E08A9091FB4A4DC194E71FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245018, "uuid": "cb9d6d37-71ea-4118-91f8-23ed0f26d984", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245018, "uuid": "9a1a09ef-d78d-4a4d-8b8d-11fad3efd62b", "value": "1536:NqsGiqeHlbG6jejoigIH43Ywzi0Zb78ivombfexv0ujXyyed2uteulgS6pIl:79pVYH+zi0ZbYe1g0ujyzd+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637245018, "uuid": "2b584b75-ced8-4cc2-95db-cba20790e4b8", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637245018, "uuid": "b1dd50af-437f-424f-8674-32ecd0e120a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245018, "uuid": "d4b7a648-824b-4a5e-a35b-1de68f2572a0", "value": "0de30ea57acbd74692f46a4280bb6f40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae78de6-485d-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1637232579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232579, "uuid": "407a4133-9682-46fa-8516-7d2643a9b738", "comment": "Malware payload (GuLoader)", "value": "f055af037e44f824044c39aacf2d3c76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232579, "uuid": "6e15ae50-2069-4217-be11-2f1bf4ecd05b", "comment": "Malware payload (GuLoader)", "value": "bde5dec57e6619d37695079c999869ab90374912279032b5aff1f6640eca0529", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232579, "uuid": "2f044058-7241-46ea-9c1d-0eef42f6b52e", "comment": "Malware payload (GuLoader)", "value": "fc2da43fd9ea61d1198bd0e3e469977006e3680a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232579, "uuid": "08041a4e-3b06-4ac0-ad1f-fa5dcf5527d6", "comment": "Malware payload (GuLoader)", "value": "61de62f960620dd94812022644b444e263bcfe20a43ed69036e1a7c8af29a3ef9df0862687ea82b35e3548cd803a0a10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232579, "uuid": "2b9d7e26-6c9f-420b-9018-32a74be147b1", "value": "T1E724B6561764BD37E3AA7DB0682CEA871EC92810BB05117F7094FFBC37605E12994F8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232579, "uuid": "4388db31-d895-4387-b15e-613979e36d72", "value": "734da01b023fcd5cd63cd0178c14ccbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232579, "uuid": "51c18e32-305d-43d7-a72d-1d47021b6055", "value": "3072:JmZgSjcvPS8zDqSck5FkGPb8VpLCmMhEW2yCKbv62vEY3juyUiSNJe3tO:cD268Ak5yhCmkYY3K6SPEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637232579, "uuid": "aaa0be90-6e14-4a81-88c8-dbd5bc3ce885", "value": 222552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637232579, "uuid": "579c69c3-4176-4208-9ab0-d6a81384ca5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232579, "uuid": "c2f534b8-7d22-4202-882a-db1d7af1f0e3", "value": "f055af037e44f824044c39aacf2d3c76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043eb397-486b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637238501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637238501, "uuid": "272fda21-1217-4663-8f23-32a8a5cef2ab", "comment": "Malware payload (Dridex)", "value": "3e98c1cbaa19c87ff8354b9fcf8b05e8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637238501, "uuid": "7ea88594-3bcb-4ea1-b36b-a796ee41e4ab", "comment": "Malware payload (Dridex)", "value": "be37b4480c4aac0a6a367d9673427ce790c073c721bcef0db01570f0ff0365a5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637238501, "uuid": "e501e285-2754-435e-93da-db182265cdbd", "comment": "Malware payload (Dridex)", "value": "1a02f9d98694f6408c21aeef50f9d711111a0470", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637238501, "uuid": "4177e2ba-7bbb-41c0-9c9d-ae61f2021d83", "comment": "Malware payload (Dridex)", "value": "8b58290fa83217414e78086e4bde1f7a65032f39abbf287a5c3ae6eea93ac4d34a2265270ecc05e0c4c90bb7063eefa8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637238501, "uuid": "ac2012bb-09d6-4d3c-b8de-105ccc0d970d", "value": "T1AF33E10B4BA7741BC116BF7A0F0988F12C4D34FA5841D55628667B9B02D62C79BFD23B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637238501, "uuid": "1bf4d69d-3532-4557-a2fe-d5303d897345", "value": "1536:1W1fWifj8mzz3uKPIbZ853SAJbpZ8ix1KRwL:w1ei4mzObC9GMuwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637238501, "uuid": "a9711ee2-a3ef-4104-beb3-9d821cb2b270", "value": 50836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637238501, "uuid": "24ff76a2-31c7-43f5-b305-db44158190b4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637238501, "uuid": "10b782c9-e1c3-49df-8a1f-787f6c841398", "value": "Rooms_requirement.17446.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493c4583-4823-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637207693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207693, "uuid": "4281b458-2398-47ea-86cf-94968a1f3089", "comment": "Malware payload (Dridex)", "value": "b04446e8c3b7ff393c5d5d75248d8b8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207693, "uuid": "06f27b37-80c5-4b5e-8abf-098ce932dc58", "comment": "Malware payload (Dridex)", "value": "be3eb491dd9953d6d06879a99357613f2a837f8a79a2ac3b67dfe7e6ce2bfdec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207693, "uuid": "a8360a8f-d563-4479-8365-5cc60c1c92af", "comment": "Malware payload (Dridex)", "value": "062249b1a47ba13363f99b00d667dde77ef68d03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207693, "uuid": "03441581-1de8-4317-8161-791590969e82", "comment": "Malware payload (Dridex)", "value": "8815fe77b5e41951eff0a8bb6a3db740f2a8a7b2e60cf30fd946468bc0104e808f1e8a73f64247b2455bbe125af3d254", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207693, "uuid": "f40c8146-de50-4bc3-a8ff-8f2210288c26", "value": "T1DDE48E0250D512FCFA898ABF155A67C1C6B310824ED1CB9E25CD07EADF64A03EE6D1B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207693, "uuid": "1bc53240-898b-4eb4-b410-f018f8ceccaf", "value": "fe16443ce39f2fcea9c5accdb27a9eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207693, "uuid": "300b676c-a68d-4c1d-b35b-30e3675e71bc", "value": "12288:HjTlJzJzJBJZn/JH3lJxJLJZJdPgA1VKBUA1rlldNJw:HjJtpDv/lVbdT3IA1wBUA1rlldNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637207693, "uuid": "59b31846-e4a6-44ff-8ad6-27c8bc373c3b", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637207693, "uuid": "6b78b7c3-36ac-4ff3-8bb6-ffe45d13546b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207693, "uuid": "bdd1b929-065e-4c5f-8057-af8e57a582c8", "value": "b04446e8c3b7ff393c5d5d75248d8b8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37390f6-484c-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637225534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225534, "uuid": "dbd2af2d-a8da-4729-b582-7562421a8e99", "comment": "Malware payload (SnakeKeylogger)", "value": "afc4fcc172d253eba4610dead0023cf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225534, "uuid": "f8fa3b23-f193-4baa-b263-e8476779ed88", "comment": "Malware payload (SnakeKeylogger)", "value": "be860d21f413184e93cb3f44901c0d3a36449d57f394c5ee69cbdecbdba00a81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225534, "uuid": "54fe8a67-f860-47d1-838c-2a8525423a3a", "comment": "Malware payload (SnakeKeylogger)", "value": "534ebaeb225043b6b4e890295ecbc1e7e94d05c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225534, "uuid": "41ee837c-88cf-411a-a2f1-ce1afc602fa6", "comment": "Malware payload (SnakeKeylogger)", "value": "6ca3ed3e75e45d38ba05fde59c442717dbb3c0616e7a0c1eb4bc48291c687e25e84cff70fc48133d8d4975696ffdf9d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225534, "uuid": "85759d68-abdf-4054-807f-98ac607d7512", "value": "T11CB49C2722E0F4CDD0A189F01AB294F29211645A117475538F7F5A6AC36FCDFA62C2FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225534, "uuid": "31b25cb2-7305-400b-be25-ee5f78029a12", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225534, "uuid": "82d52fe3-23c4-4221-b913-b4bfb1b4f9bf", "value": "6144:KGicDi+wztILX0uoMjnQqPfMxaWkw1fm+yUlpeIy6dNtTiV:Zi+wBI4u5QI0xdP1fm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637225534, "uuid": "bf9bd0ac-2181-4a4e-9694-573f92722d5d", "value": 517403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637225534, "uuid": "97acd432-5340-4146-92c6-b5dd9ac42db9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225534, "uuid": "408df114-02d0-44d2-bbc4-9bb3fbffaafd", "value": "4098765234567890987660.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d5a42b-4843-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637221434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221434, "uuid": "a68d9f9b-f840-489d-860a-afbda0e392ce", "comment": "Malware payload (SnakeKeylogger)", "value": "0172e2caec489cd2ab2fb4a8d4e3053d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221434, "uuid": "b92f2e98-946d-4675-a0a7-6552bd7471a7", "comment": "Malware payload (SnakeKeylogger)", "value": "be9fc7be3448583e629f7a9d0c2d02be0c444b28b1ccb54d9f74db50c1c9710e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221434, "uuid": "2a6679f5-2146-4344-823a-d4e737b79157", "comment": "Malware payload (SnakeKeylogger)", "value": "79f600e46d6a6b79e3a91be3c900bdc3da34a448", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221434, "uuid": "ed4599ac-307b-4946-8ab5-c0c368ad88a9", "comment": "Malware payload (SnakeKeylogger)", "value": "253cb8afa259540f29a16726069794d82adb4ab13a74a7bd2d1009165b8f63ec2c05fac7e4c131e68c53966dc0dba500", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221434, "uuid": "d323a785-4f8c-4863-af30-872a1d3c639c", "value": "T1FC726D3AA282867BE87E87779C42108447F57A037853EF1ECEC5608D59B338D61A16BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221434, "uuid": "d72e0e7d-902b-4782-b909-f5e75b62170a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221434, "uuid": "d77f36ca-0080-4063-9900-93aede2016d4", "value": "384:2ubgNBLuhcNFLfz3yfr3Jj4oxLK7gk+ErKlgjgovgyggugcgiRGWwZQotqHIMzZ/:BAn+1ax+0FZtqHIMzZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637221434, "uuid": "3d6062e2-a5ae-43b2-8e48-eb095cef5f7f", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637221434, "uuid": "441f86e4-609b-4044-bc07-2c96631abd00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221434, "uuid": "e5a03841-e14a-483f-b040-d0d314d33172", "value": "Order catalog.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11014c56-4884-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637249259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637249259, "uuid": "7cdac4b7-397b-4e71-a8b3-cee5babbe1b7", "comment": "Malware payload (Dridex)", "value": "4531ee53b9380de8159f672166ba15d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637249259, "uuid": "2020b42c-6287-4bf6-9bd9-e69d8c1f35d2", "comment": "Malware payload (Dridex)", "value": "c06e84c106ca78b1189aa03a7269ea76efd7879e3ef28a78ef9dcd5303328411", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637249259, "uuid": "ee41bffb-48b4-451a-8375-e9dc5439f1f1", "comment": "Malware payload (Dridex)", "value": "d3ecc29564c9bf482e6f2371dfd2219621f8781a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637249259, "uuid": "b1b613db-8377-4d5d-9c1b-488b2ce0674b", "comment": "Malware payload (Dridex)", "value": "28f75adce7a9d14ba4c7135f1e2f7195e21f13524dd4d819d812079310e184777b81debba47a412a11634bc77c996eb1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637249259, "uuid": "2ec26cc6-fe2f-40ad-b406-b825e72605cb", "value": "T105E48E0250D512FCFA898ABF155A67C1C6B310824ED1CB9E25CD07EADF64A03EE6D1B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637249259, "uuid": "7e43cf84-76d5-486e-b7b8-c92967d42edf", "value": "fe16443ce39f2fcea9c5accdb27a9eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637249259, "uuid": "560e4192-d932-49de-8d80-989c126bac79", "value": "12288:pbTlJzJzJBJZn/JH3lJxJLJZJdPgA1VKBUA1rlldVJw:pbJtpDv/lVbdT3IA1wBUA1rlldVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637249259, "uuid": "81ec27ff-a131-48fd-9a3f-1d1d6ab1f1e1", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637249259, "uuid": "d0aca623-07d9-4536-957d-b7eb5e104477", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637249259, "uuid": "88e2b580-90c6-4aba-afc3-7159dd9521e7", "value": "4531ee53b9380de8159f672166ba15d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f76a09-48bd-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637274011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637274011, "uuid": "b86379a2-9db3-4b4c-ab3b-7b16c29f89e3", "comment": "Malware payload", "value": "815b29a0b53ae90b9324d37c281c5bbb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637274011, "uuid": "51262f1c-0187-4fb3-9f56-99b58dcff158", "comment": "Malware payload", "value": "c06f2db62a134f8d9231669f11b06a08040a6a67a026b9f29133d02541843e16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637274011, "uuid": "56ce469e-410b-42f4-ab49-b7ed6eedceac", "comment": "Malware payload", "value": "f5b3b78effb61a5e612b21de696049a5a6f8ec53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637274011, "uuid": "c6e1ac2e-c887-472a-b548-8f69ca768793", "comment": "Malware payload", "value": "887e63450eff539aee7bf9f69983852939d0d967fb33311504abb1a806e47c2787a93bec92309f939e96b41c0514e1f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637274011, "uuid": "6b67d495-3e7d-42bd-a839-072325c72429", "value": "T19EA4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637274011, "uuid": "3a395602-8e86-4f38-8cd8-4ad6a5a97044", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637274011, "uuid": "e9f9885e-abbf-4059-8708-8a77e53ac165", "value": "12288:bdv8jkvzqZvv2wLBXmTi12yD88kYwZ1h1:b2Zvv2c2Ti1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637274011, "uuid": "536c10e1-bd97-4e9e-b9b4-83d3d38071b1", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637274011, "uuid": "60c0e3c2-efb5-4ead-984e-e992f553ba31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637274011, "uuid": "0e14b8df-6c5b-4e47-bb1d-eda2e2c557b4", "value": "815b29a0b53ae90b9324d37c281c5bbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e6dbc4-4859-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637230823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637230823, "uuid": "d1ad1d02-f4a7-4a57-bc6c-38c97b1cb033", "comment": "Malware payload (AgentTesla)", "value": "70e010269bd28ca988a5c968d474806a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637230823, "uuid": "cf885f1f-2f2b-4ec7-a58b-0a14738ae488", "comment": "Malware payload (AgentTesla)", "value": "c119dc3c848133d3c3d348512a022503c88f524a0f6a8f617fa4c8e15235e9c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637230823, "uuid": "fbed9ce5-648a-410f-a57a-5c78f9cb5eab", "comment": "Malware payload (AgentTesla)", "value": "8e204e2c03c625927dc5500195650456c1df5ce7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637230823, "uuid": "af654726-57a5-40cd-8ecd-d68af873555e", "comment": "Malware payload (AgentTesla)", "value": "7a8e629937d3ed9dfacc5df1cb33d218a9b60b3babe0ca19651f3d20f3e8d9ddd9581632deb1b6fc5f449e14edd7f271", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637230823, "uuid": "e5d2a152-157a-4a37-a619-c5c1ec782c87", "value": "T1443422AB7554F732E8D81E382B89B5A08FB9ECAF3D10B92CE5E4741816750E0F091793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637230823, "uuid": "3d7fc53a-7334-4e62-8ea4-22a068b5cf4c", "value": "6144:v8jSe7lq/jDmnxR7LsOwQc0OJh5JoUDqwAaV898klxh2TrDO/:+J7l4ORvNh9OJFoYAXxITrDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637230823, "uuid": "434bbd54-5f11-47fa-89a1-a577e40d290f", "value": 234424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637230823, "uuid": "5c07269c-a1d5-4018-a78a-9eb55630d6bc", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637230823, "uuid": "082737ce-d2e4-4144-94df-82f47f385fd3", "value": "devis.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab7b91e-484b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637224956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637224956, "uuid": "ea1416c6-d87b-447c-b74e-510126feb881", "comment": "Malware payload (AgentTesla)", "value": "228bc35b7f4c5e2356596fdb63041dff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637224956, "uuid": "66758453-f794-4ae5-ae44-407cba08edaf", "comment": "Malware payload (AgentTesla)", "value": "c296be3aa9f69f5332d4ae6fa557972a306c563f62e5f3367a089966d988db8d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637224956, "uuid": "1d72b12c-1fb1-45ab-8ba5-513dc17b39b8", "comment": "Malware payload (AgentTesla)", "value": "9b5acb45fc8a57eb907b0a880fb3bfab6793f4cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637224956, "uuid": "8407c727-1d8d-4291-a1ec-fea37bdd27e9", "comment": "Malware payload (AgentTesla)", "value": "de3760a97638dd7e0dac5ab177b602ad827141f519f75048c5192693e598a73f6160b7927c2b9cbcc280b29d0f076fa8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637224956, "uuid": "7f2fb8b3-030f-4747-88e2-e83b87cee6ef", "value": "T1F8D49DE2D1842ED5E41A367A0C376C1C11A7BE6DD934D50DACA9B12A6BB33C32127D4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637224956, "uuid": "d15aac50-d1fd-410d-8848-b1c8bbad9a3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637224956, "uuid": "79bef0db-18cb-4c61-b181-0f616c2e9881", "value": "12288:4+JBW3WinG8nTR5rq1rCox5CUft8uZtKe:r5GG8150r9ttKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637224956, "uuid": "605ce571-53d2-49aa-b225-90abc8cdf797", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637224956, "uuid": "57496abf-c390-4d79-ab3e-a0f4b70b5d7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637224956, "uuid": "6ff52d61-8aab-4bcc-8b60-60003fd5cd74", "value": "228bc35b7f4c5e2356596fdb63041dff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e25d6d-4844-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637221750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221750, "uuid": "be5c6e67-0d20-4af5-b65e-ba582b66c596", "comment": "Malware payload", "value": "6fe4070f94f6a6bc2fc5b1c9a4562dd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221750, "uuid": "6e6d1854-0047-45c7-bc11-5ca28ea08263", "comment": "Malware payload", "value": "c2a67ffefece5df760b9a1a54552efda6d79a48719be4a6509934543ff35a109", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221750, "uuid": "f4f32e80-f8ec-4b45-b70c-5a1f3a76aa15", "comment": "Malware payload", "value": "2b528c4da51a332957342ff6db8246e744e913a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221750, "uuid": "b0e64f27-79b4-4c69-81bc-f5b002b04be0", "comment": "Malware payload", "value": "5da5f5d5ac702dd29feadb1a0f3cb50d039abd6f27685915850950a8afcaf136449004e2ab45b3c403fdd824b13c7152", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221750, "uuid": "37ea9cc6-a4aa-4119-858f-7f2e066d685c", "value": "T11306335059C012CEF694DD1E57DC7A25023FEECF6878BEE3869283F1040EE49D97266A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221750, "uuid": "abedcc04-f85f-4f33-a412-b482403caf29", "value": "98304:G1wwAjzIQOMK2GNKslgus10Y1/UJ7BdlRbTBAlY0:G1wwAYBr21uQsJ7vTBAlY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637221750, "uuid": "d5b5b49c-e883-4ba3-99bc-77dee6d25a75", "value": 3928064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637221750, "uuid": "f5d16fa8-a457-4422-b387-d53e04f1d359", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221750, "uuid": "373f0425-86f7-4304-a859-d9459e542a60", "value": "c2a67ffefece5df760b9a1a54552efda6d79a48719be4a6509934543ff35a109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab82aca-487a-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637245357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245357, "uuid": "3587d8f6-9a00-4407-a7dc-a5ea9a5ae6f1", "comment": "Malware payload (Heodo)", "value": "e175eb62fdc4cf5542a2f4df2b704e51", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245357, "uuid": "5f25fe82-bc15-4b0a-974c-81154de07047", "comment": "Malware payload (Heodo)", "value": "c2c1c417abbc432ad4a4cbb48f0fb32e79cfdf59c40d5a690a818e817035bc88", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245357, "uuid": "fff754ad-9302-4b3f-bab7-5d26c8617e11", "comment": "Malware payload (Heodo)", "value": "3d5c6d03f901a502221f80bc4b928fd19ffdf6ee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245357, "uuid": "87740cda-24ff-42c0-9ed1-eea26cff6802", "comment": "Malware payload (Heodo)", "value": "51ad5db9611a6e4514eef3f2d3d9e88723169ded803b196ac220071c3a997de541bb654e3028d8fd0d707ec2136f4d37", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245357, "uuid": "39122e15-2904-4d83-95ac-9a659c57ecad", "value": "T184A4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245357, "uuid": "a46a22a8-cd92-4fce-952f-1fe8735bc164", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245357, "uuid": "155252c3-f440-4014-9b85-40dd211f9ef9", "value": "12288:bdv8jkvzqZvv2wLBMmTi12yD88kYwZ1h1:b2Zvv2cPTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637245357, "uuid": "16edaf02-652a-4aff-9456-784e1999945b", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637245357, "uuid": "27f26d4f-1572-49dd-93e6-d9cbf09242f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245357, "uuid": "66966324-b9ad-4aca-bb1f-548c7e208f4b", "value": "emotet_exe_e5_c2c1c417abbc432ad4a4cbb48f0fb32e79cfdf59c40d5a690a818e817035bc88_2021-11-18__142230.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048eaa64-4894-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637256111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637256111, "uuid": "843347c1-67f9-4674-8ef9-091b46841f81", "comment": "Malware payload (RedLineStealer)", "value": "6c0c449942113645b0d136302838f028", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637256111, "uuid": "32d7107a-1550-4f49-971e-e59ebe9fa051", "comment": "Malware payload (RedLineStealer)", "value": "c325d98c7689964cadb138bf351b863372ee464a350f3d1fc11fe0906c8a1cb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637256111, "uuid": "d35a5049-2119-411a-9ae3-8f439bc61b23", "comment": "Malware payload (RedLineStealer)", "value": "01a8326a28c73848507a251c5f61071490aa46eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637256111, "uuid": "66bf404a-a41d-450b-88fb-260ff648f3b9", "comment": "Malware payload (RedLineStealer)", "value": "79398f5df1eee9bb7f16a8a629f6df51baa2f491fe418c46e9565247babf7ca05dcdde81cea3c70004606c1eed2dcc24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637256111, "uuid": "22c25ebe-7d5c-4bb7-ae68-198fa151c1d8", "value": "T11384CF14A7E0C034F1B756B45A7A9278B93F79A16B7890CF62E516EE4734AE0EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637256111, "uuid": "31b57408-6c47-463f-9340-1e3d66bd4007", "value": "323504891562b22c6999415c44b3f208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637256111, "uuid": "c62ec694-507a-4759-a2bf-cb1d05d9184f", "value": "6144:BtLPYyaWxItw3w3zVVHr+ynCgLKEk0uIyukjCeZigiiws/aTTh:jIteAVpr+qLKRhZukjCeZas/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637256111, "uuid": "7330e32f-5dec-4214-a7a9-3fd99fd31d53", "value": 395776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637256111, "uuid": "5188301e-d780-4ea4-a492-d760f32b4b36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637256111, "uuid": "f3a1de51-9204-4e2b-a543-3491b1d60de1", "value": "c325d98c7689964cadb138bf351b863372ee464a350f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89293fad-4860-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637233999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233999, "uuid": "fcda8ad8-f836-4bae-96c0-f859c221362a", "comment": "Malware payload (Heodo)", "value": "a0fc51fb9ece092823aa2937d79fd71b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233999, "uuid": "5288dcc8-d3fd-458d-abb6-3eb2c67ffc92", "comment": "Malware payload (Heodo)", "value": "c360f3d22b53da4a7d9b7bf061867c2a3f95120035b946cfe709b3a3743258d8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233999, "uuid": "4b3676c8-ddb4-4336-8ea9-cbd1d2c96ad7", "comment": "Malware payload (Heodo)", "value": "be82874e684bacaf50920297aa20d5031f57c779", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637233999, "uuid": "0ed93b16-eeee-43b2-b585-55df35940dd7", "comment": "Malware payload (Heodo)", "value": "bda8392b47b6f9fefd56d86531c44080405394795ed1255bfc3c3f613aeaa2fdf0133281e6ca263b6f7d43484165bf4b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233999, "uuid": "fbb33b51-6c39-4858-afa8-839461cdb423", "value": "T1DCD4D0112843606FEC9C153C049977BD8FED6B55C2F4E8A7CF80E9E4AAC5CC185B6A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233999, "uuid": "9e6959fd-a246-41a6-a61b-f750c405c12b", "value": "9147e5ab6cd2dcc785393175990a85b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233999, "uuid": "8cf9db7c-bb28-4b59-a9ff-ac2b125194c1", "value": "12288:uOyVoxITHISr3VYRJ0QvcaqNqMWMeWXm6QrXmZ5YJsp4:ZkVYPZ9169Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637233999, "uuid": "c22fc106-380e-429a-a94c-2827b630da64", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637233999, "uuid": "d16cc7e4-defb-41e1-9680-207acc2068ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637233999, "uuid": "d8426c10-17cb-4307-a2bc-7754a8c9a0ba", "value": "emotet_exe_e5_c360f3d22b53da4a7d9b7bf061867c2a3f95120035b946cfe709b3a3743258d8_2021-11-18__111314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9e5c5f-48ac-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637266752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266752, "uuid": "cc0d6fe1-7567-40d4-8112-18baf6e1c2b4", "comment": "Malware payload", "value": "e33471aca4f7ba9761cfbf41b091c9da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266752, "uuid": "4c77fc00-3990-4740-9219-db5350db1300", "comment": "Malware payload", "value": "c36c4e9b60d516ae00051b635624267123056adbbd874b7b9f67920dcb71aada", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266752, "uuid": "20a8e306-3701-48bf-a9c7-e97f7832e933", "comment": "Malware payload", "value": "a3b8444a7367eec1b5fe10f11d653b29a27c3b73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266752, "uuid": "1d637d01-f461-4983-9215-fc41c4d65ab8", "comment": "Malware payload", "value": "9eb2ec701b73beaa881aa104af60c2e7eeb01dad8cea57812834204238d8856200b797f07922e90c94967cec36c3e0dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266752, "uuid": "21034da0-eb76-4824-913e-ba702263cd7d", "value": "T158A4F16952A8872BD1B917F85078FB380BB55EA17C29D308ADC178EF3F713414469B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266752, "uuid": "b37d6a1a-92d2-413d-bdfc-bb372721ec82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266752, "uuid": "0a331592-005e-43ac-9e20-77794fa46159", "value": "12288:fj9wWWilDRPxzQ6UjloRIYh3enOOuy8289:r9waVpzQ6UjkonzH82E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637266752, "uuid": "a801a33e-f6c2-43d2-91ee-d478a2d45e17", "value": 470528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637266752, "uuid": "ff788f93-b776-4db1-93aa-39c11647dd45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266752, "uuid": "afb17d1c-adab-4164-aba3-2bad294db3ac", "value": "Payment_Authorization Issue_swift MT105TT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6b9cc9-4860-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637234001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234001, "uuid": "c7342caf-baf0-409d-8cfe-d04952099c1e", "comment": "Malware payload (Heodo)", "value": "a88d35a929a1c4fada5ccc456408e9d6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234001, "uuid": "1397deb8-030b-4558-8d58-28ee5f5b531b", "comment": "Malware payload (Heodo)", "value": "c3895b6c3c964ba758a478b0d6d84c5c4205bd18372b0cd055f07f90116d6342", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234001, "uuid": "4bad5070-4e89-4d21-afe0-4ef890276304", "comment": "Malware payload (Heodo)", "value": "927eb1bbb29086d0408c65bc7ef12fd38b5203ed", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234001, "uuid": "873d4779-659c-4cba-890f-779b88488a6b", "comment": "Malware payload (Heodo)", "value": "8311e4b80956292c51d87b35520d81f058e7d2b1bcba01f9029e9ef3ebedfff530f0a10b8fe081a9f427635c9511ba1e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234001, "uuid": "2fb4d70b-ed65-4270-9799-9c9ab9fcf866", "value": "T113D4D0112843606FEC9C153C049977BD8FED6B55C2F4E8A7CF80E9F4AAC58C185B6A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234001, "uuid": "5c17f613-c3e5-477c-b80a-676a16383422", "value": "9147e5ab6cd2dcc785393175990a85b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234001, "uuid": "57ea250e-3a28-4075-b80a-84e43e56c2c1", "value": "12288:uOyVoxITHISr3VYRJ0QvcaqNqMWMeWXm6QrXmZ5YNsp4:ZkVYPZ9169Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637234001, "uuid": "bcd527fa-6b0a-4de3-8657-77be016f9edd", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637234001, "uuid": "d7792e79-0db2-495b-9b9c-54f201870d3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234001, "uuid": "330d75b4-489a-4cd0-adc3-b60a4988e1ff", "value": "emotet_exe_e5_c3895b6c3c964ba758a478b0d6d84c5c4205bd18372b0cd055f07f90116d6342_2021-11-18__111316.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149f68d5-482f-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1637212758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637212758, "uuid": "ca8a250f-629d-4d45-8381-de636e29c770", "comment": "Malware payload (AsyncRAT)", "value": "20c359688c0a7c3b4ac655dbe938a2b4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637212758, "uuid": "a22adbf5-1d86-442b-a0c0-877ce5287f07", "comment": "Malware payload (AsyncRAT)", "value": "c47a7ce63f19a6a80e1347b661a6fca4d259e3fe057fb572f45fbc4095f0fa9b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637212758, "uuid": "7dddc9e0-bf68-47f2-a423-5a0f376d347a", "comment": "Malware payload (AsyncRAT)", "value": "44bea74042d9f51b588c2db2a8d02a5dab1d4e12", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637212758, "uuid": "92d138bf-b2a0-4c94-b9d1-126020d7dd2b", "comment": "Malware payload (AsyncRAT)", "value": "d64e08777d97fcf17cd9b4ed4264a4dd62ba59fa893e0e206982bf7fd81ae58f4db515ffa7905707b5383048043784c7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637212758, "uuid": "3c099bf8-79d7-4f3b-a177-2811b5e3de15", "value": "T104D1FF6A4255C27EEE15263C79E064538681CF9B304CF58A37B4EA3DD7E2089F54CCB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637212758, "uuid": "6cd02068-5cbe-431f-b253-2729be1cdb84", "value": "96:S5IV6f4rW/ogcKRKfOOfuN3SVFVCDNZyRxGHIBtEY9:SyIfebJF0ZyRkIBD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637212758, "uuid": "b24b489f-b847-43db-94db-ad66fe5145c4", "value": 6275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637212758, "uuid": "41021079-2bd1-4b31-8f76-c6705c9839a7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637212758, "uuid": "f98dc829-ddff-4523-870f-9ac9ab5dbf04", "value": "Reasons-of-suspension.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad64596-48a2-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637262161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262161, "uuid": "f0a85abf-1b85-4acd-9c17-9fab3ab02299", "comment": "Malware payload (Formbook)", "value": "8c314e6677496a7211922466672b7ae5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262161, "uuid": "cf27ce69-433c-4f40-bef6-73e2c3e6ad98", "comment": "Malware payload (Formbook)", "value": "c48887aca214261f9a61eea0d89a12e25de3f0819b3570c2c3bcb7da002631ea", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262161, "uuid": "8837f994-ea29-4cb7-adc8-5fb5759d1cea", "comment": "Malware payload (Formbook)", "value": "00e1c8c22984061fc4973ba5e0469369dbc23fb1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262161, "uuid": "63fd6769-5114-4424-841c-4fb67e7d9193", "comment": "Malware payload (Formbook)", "value": "53799267bec75a4eaa2af2f8528da1d07ad1a526e7e0b76362b991f4e0d7b00a77de661072c7d063f444831b15fbf7af", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262161, "uuid": "350eab67-55ad-4d87-9b82-a589be4c4e07", "value": "T136621DACD45B45998F856BB8670B1F85110CBA2DF788A533367CAB746BE2C7B401383C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262161, "uuid": "74a67adc-c4dd-4247-84a8-6f9bed0808fb", "value": "384:uPBWQdP3EcUsm7ncoxfIjV79NGSdeq2Kf5M:wd8zVgo+jLZH5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637262161, "uuid": "17b28b67-cf59-49e4-829b-86d966099c3e", "value": 15407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637262161, "uuid": "383f3d14-66fc-4d88-bb1d-46b27bdd670c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262161, "uuid": "d10e4826-eb18-488f-ad34-5687cf180c87", "value": "20148579.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5470c184-48a2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637262258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262258, "uuid": "63e5ea44-24a2-4181-9166-753d41ca04a5", "comment": "Malware payload", "value": "f695e9185d7b21c32c4c1f887383f134", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262258, "uuid": "68137fa4-cff6-4ca3-b9b4-a08a612f094f", "comment": "Malware payload", "value": "c57c5b687abb3d402468fd8b0fdc0e9c1dae0c5ebe510d39ee25ce8fb8eb2760", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262258, "uuid": "f21f51c1-7578-417e-b5cd-59f249279059", "comment": "Malware payload", "value": "377754c65ebb0d88fdb8305afe740453fa086362", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262258, "uuid": "fa78bbc6-92b7-4426-8993-59109cb324eb", "comment": "Malware payload", "value": "b4939103b2759c8f1adb6e1ffffde260e4c2de41ca2276761fb97a410f33d728cf277766bd1fec1169cbda6f3ca5567f", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262258, "uuid": "de13256c-0e66-4e0e-ac58-5c98b973b6eb", "value": "T1D4341214F76EA706DB9E863E51EDD8C8B2A3DE640F253A7D2001B93A0771DC06DB3589", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262258, "uuid": "cf18dc7e-16f1-41d8-a372-4a5f6de33daf", "value": "6144:yyLYN5f+DdJ/hK5dFiO0O502sMvZWfz7Um0sG2B9aFe9xTQH:yyLYNkHqFiO0IBWXUmw2TZ9xTQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637262258, "uuid": "2e984d98-7508-49e5-af64-a151b6494b19", "value": 234168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637262258, "uuid": "34a972d7-a33e-4a87-bc53-9507b525f580", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262258, "uuid": "6687fff5-7a11-4846-853b-6a1068b81123", "value": "new order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b1e6de-4873-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1637242202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242202, "uuid": "5c9a2453-a3ab-4d41-a971-bbb19e414735", "comment": "Malware payload (Gozi)", "value": "45d602c1878edac953ecfae4c1e059fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242202, "uuid": "79ac4ca2-ec41-434f-97ec-d1e10cffa56a", "comment": "Malware payload (Gozi)", "value": "c621297f4361a727f803ad31bfb7388f45af5a9e5c7b6237d1492c23e1f8991f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242202, "uuid": "5e563a65-fb18-4f57-a8f9-bbf049defaa0", "comment": "Malware payload (Gozi)", "value": "2f9606697894ee86d605cd4abafb74b60fed676b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242202, "uuid": "73982d89-a4fb-4524-9c81-d30527ceaee6", "comment": "Malware payload (Gozi)", "value": "9150cdc1b3f1367c192f0ac816632ea9dd4fcd62a70bc089b9d3f9addd259622fc1d99c0a86e1f8d355d55adb5c80c9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242202, "uuid": "d3526f63-cef0-4e43-b9e9-2ef2b2943f7b", "value": "T1B4346D6AA2F51A95EDBBD5B9CD83C617D7F334051A64D34F13B0CA9A6F03321B218386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242202, "uuid": "98a56dc1-2128-4055-9476-efd863701fe6", "value": "6144:MW/TYr/Pbqk2ZFOY/ybb00h2ETEzIwtaWtBk4S+Uh:MW/TYLPbqRul5dQzPtaWtBC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637242202, "uuid": "aed0b179-f827-4f0b-80e5-5f222bdd0d93", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637242202, "uuid": "86629086-f53e-4f32-ae85-8368c94467d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242202, "uuid": "e6bbe81e-6298-4392-8f97-e16a95216b7c", "value": "28b452d0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a201cd1-48a4-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1637263019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263019, "uuid": "15d42bd3-3c50-4df2-b821-64e4e34bc3a9", "comment": "Malware payload (njrat)", "value": "a19d14dd9f9fc40dcee050f211075042", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263019, "uuid": "c1067795-893b-4179-8dbc-1635a1d69452", "comment": "Malware payload (njrat)", "value": "c793569980c9bf4b3d296903da942e9a11f4c6e2fb0023517a037fc3d56c1b36", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263019, "uuid": "69d702c5-46c8-42dd-afa1-4fab5d98e3c7", "comment": "Malware payload (njrat)", "value": "2ee3f12297514b90e5c38045f52b3593c4439317", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637263019, "uuid": "bc2ac478-9940-424c-9379-34017a6bf41d", "comment": "Malware payload (njrat)", "value": "cbbd31584c93911567e9a114e385cd69d8bc6b26aa20115cccf9363ce69b63fc96de386671a95ef2b4700d1bffeed5c5", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263019, "uuid": "5a7897d6-4e69-47af-af03-509f22cda292", "value": "T10A414B39FD1BBB864821F97661E78DD5CEEC1017DB543C3C21124C7949918BD6A9C0BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263019, "uuid": "af9ad036-0b47-44d8-963b-b6ae700b166b", "value": "24:JVkNGJYuIoviVLF5FFOY9NFMffNxVPvyJCCKaV7A9F0ZTFkFo9bFQZpFOyoQeFiT:bXgHpUfLVPaEqnIoTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637263019, "uuid": "265d165c-6409-4c7c-8562-90c5db6466a7", "value": 2282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637263019, "uuid": "c5839496-019f-419b-a3c1-0417b3114af2", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637263019, "uuid": "3c9b6475-a00e-4751-b5e3-f5133cf1333e", "value": "928272_Payment_Receipt.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3cf7ce6-48a3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637262928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262928, "uuid": "8564aac8-a9c2-4c09-a7cd-78ed95b528e4", "comment": "Malware payload (AgentTesla)", "value": "45fd961e435975a8a5bee1a5ff2e03d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262928, "uuid": "98ea04a9-38f1-465d-b26c-2da3cb9b5aa1", "comment": "Malware payload (AgentTesla)", "value": "c7a14d6475b58ba96618ff0d54d28ec4b1e03325030e873ebc7a2c0a7692c51a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262928, "uuid": "cbbe3e7f-5e25-40e9-8640-d3578c4ff7a7", "comment": "Malware payload (AgentTesla)", "value": "cb4af2516afa6c5bc76e271e67964ef043ec1cb1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262928, "uuid": "6d0059a4-bc3b-438d-8b82-165099b994ae", "comment": "Malware payload (AgentTesla)", "value": "cb70262c492c770ec2b93df2a1dcef72132bca0cbc0bd994d7a890c68422492b712c2d7eae4ec4a07606d1516a28a9e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262928, "uuid": "6509901f-7ec4-4825-9dbe-7f7f04becdb2", "value": "T1B7E4E1A036B8C413E77081BAC9A0D2FA4E70B16D1DD6C7467CEE2ADF76697647C58302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262928, "uuid": "603b38fc-8e19-46eb-8446-3efecbf5138c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262928, "uuid": "fddf68d9-ac60-40be-a9f9-d5826c8176f9", "value": "12288:Yv9m31gW7bq1nNcRrFYfCkIm6uLjKZmhwxAyRZNlX9qP7:Yv9m3KWPq1Ne/FufBO/7zts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637262928, "uuid": "2d8523a8-df94-4a5e-8350-edb9615d866e", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637262928, "uuid": "7286c7ff-19cf-458f-87d1-f34c715f2e36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262928, "uuid": "1c436462-f4ee-4e70-9932-c13ded68eb6f", "value": "DHL Shipment Invoice NO-INV8425487-80228.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e926137-4849-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637223996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637223996, "uuid": "eb0a443a-3f3c-4146-bd02-e6808c998738", "comment": "Malware payload (AgentTesla)", "value": "1833da03aa0cd7b1b9dbe3e33a814d4d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637223996, "uuid": "db83037c-57db-4496-a968-e941f012dfbf", "comment": "Malware payload (AgentTesla)", "value": "c89e2c3ac42fc0bf22cb8e63ec8cc152750b8e2165fd83a82a63943702e7124f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637223996, "uuid": "210e76fe-33de-420b-9d01-fff0b607964d", "comment": "Malware payload (AgentTesla)", "value": "8701ea7abfd9be3a075e4f77fbcfa013db831183", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637223996, "uuid": "c77fc756-f87a-46d9-8a00-b820abb3dd74", "comment": "Malware payload (AgentTesla)", "value": "8d109dd88f2525532bf144096243d2e1dad767061b382f79443352074d18a75edb2d3c8edd9406037694127d7e54413e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637223996, "uuid": "add807fc-cd9d-4b2d-ace6-11c66de234e2", "value": "T108E4D0903AB8C813E33085BAC6B0D2BE4E71B16D1DE6C6427DDE6ADF76197647C58302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637223996, "uuid": "2de9fbcd-5dfe-4573-a6a4-26bf012bfa84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637223996, "uuid": "78f23c1f-d9ff-4c7f-a25d-555ea8bbd8a8", "value": "12288:/d1m31gW7BH/tng3EO6huylua1uliQ/chgj75PnErNRj6r:/d1m3KWNi3EOLycaktugJ2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637223996, "uuid": "aa3c7bf9-31fe-41b9-b4c6-32759c89a8a0", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637223996, "uuid": "3d90f90e-28ab-446d-8508-36f9244a199a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637223996, "uuid": "2401d619-3d76-42c9-8c5f-cb6c09811bcb", "value": "Veq6xWdWAkiIGbs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09892b38-4844-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637221759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221759, "uuid": "6a9245ea-4ebe-40af-9e5c-fd6b03d76d6d", "comment": "Malware payload", "value": "c28951a5b5dbc6c78c3e7aca7d0bdbc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221759, "uuid": "6ae03fbd-c9ef-4f5e-8736-fa5da7b81cf9", "comment": "Malware payload", "value": "c8c34b23422779e32c4dbf896c3bfc3f2ff88937e37992b3c67ae3bb3146ea1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221759, "uuid": "edf25046-429e-4cf1-a08c-c7430ba96ce7", "comment": "Malware payload", "value": "77471056952c8cc030ece2f4915b5a15f0f25b5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221759, "uuid": "cfe61bfb-64e0-46e8-898d-7a1d6497606a", "comment": "Malware payload", "value": "058799543cf2594d6bfb57362f12bf65bb792cda180d022c324f8853a036a2d1e10682ff4d55f9b18e2abc1940830b00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221759, "uuid": "9d11a706-b564-4aa8-876d-dfa760911813", "value": "T11416331055D112CAF6D4ED0E5BDC2A71423FEECE28BCADE3DA9383F5000EE899672556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221759, "uuid": "53fdb100-fc76-4235-8bf8-32c219179345", "value": "98304:G1wwAjzIQOMK2GNKslgus10Y1/UJ7BdlRbTBAlYVM:G1wwAYBr21uQsJ7vTBAlYVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637221759, "uuid": "0e748e6f-beb6-41fa-9673-e4746c6a2cde", "value": 4165632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637221759, "uuid": "fbbe1306-bb59-4ae3-9c21-d8d226e75192", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221759, "uuid": "3a25910a-800f-46f4-b385-d38503291bf0", "value": "c8c34b23422779e32c4dbf896c3bfc3f2ff88937e37992b3c67ae3bb3146ea1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb0d393e-487a-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637245357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245357, "uuid": "cb1bac9c-fc1b-4ac4-b20d-dda37151595f", "comment": "Malware payload (Heodo)", "value": "a5c55b676ba81f7f4c8aba6be587ff4b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245357, "uuid": "16a09c0e-6ebe-4550-bef4-7d5704646413", "comment": "Malware payload (Heodo)", "value": "c92141993b2f348b768a2cfb1b38a3b9f0bc059a3f7514754fa77df484268f04", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245357, "uuid": "2ce767f6-5a71-444b-bd16-011f109545af", "comment": "Malware payload (Heodo)", "value": "ee36b199ed2fd3e26aa38c7d007827ecf1a781ef", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637245357, "uuid": "f07879e6-13a3-4da5-b797-77e8aefb9268", "comment": "Malware payload (Heodo)", "value": "a3e8ca49fed90d616d0ee4de49af91c6660e215823cfa2e45aaec6c21b8b41af4c39407244e44ec815198233e33d731b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245357, "uuid": "4c55533a-b5b5-4b86-a862-10fec71c17ec", "value": "T1F0A4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245357, "uuid": "da4f1665-2d55-48a3-8d62-61149dab519a", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245357, "uuid": "c4a9c662-3a36-4d5f-b29b-0f053caa0936", "value": "12288:bdv8jkvzqZvv2wLBimTi12yD88kYwZ1h1:b2Zvv2cFTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637245357, "uuid": "119524da-a779-44bd-a714-bde13b72b39c", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637245357, "uuid": "40d2078c-20e2-4ad6-950d-d0fd4dc9de0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637245357, "uuid": "a0b796d0-9599-4f2a-bb6c-b2aafac86893", "value": "emotet_exe_e5_c92141993b2f348b768a2cfb1b38a3b9f0bc059a3f7514754fa77df484268f04_2021-11-18__142231.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68275882-4851-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637227501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227501, "uuid": "f3dcfa19-7683-4bcc-96e0-2c24d4130ed4", "comment": "Malware payload (Smoke Loader)", "value": "743f8fec87ebf7c5d6b392261ec3988f", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227501, "uuid": "6242d9a9-572e-4cea-a799-d6275e9ed06c", "comment": "Malware payload (Smoke Loader)", "value": "c9f18cc71c7a1fa61d43a32dfb858f9aa247324a188f8182981b853266d3b1c7", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227501, "uuid": "03c218f6-d8b8-4d26-a182-e0c57730da4f", "comment": "Malware payload (Smoke Loader)", "value": "1bc862eecde55f2c1de69bc9e3fdd7468de373d0", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227501, "uuid": "0975c4f1-379f-4ce2-9fa4-f218f706a564", "comment": "Malware payload (Smoke Loader)", "value": "b95671068dde4a654ed1a6101e41af83a585492f0b490ec5a9f75cf00202bd3cbf78df2ee5979be1a55f434d9503f668", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227501, "uuid": "2f45afbc-aaad-49f4-9145-a87347141a92", "value": "T179748D10ABA0C035F5F713FC99B9A368A53E7A916B2494CF52D516EE4A34AE0FC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227501, "uuid": "14cd2313-1396-477f-af24-b7cbf936d35a", "value": "b2e29795cf26e2405a95e142d139ea34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227501, "uuid": "7587890c-912e-4d01-b840-9b547f5fb6c2", "value": "6144:B9LMytcasE/LEUZ/TPrMXiT1B18x93KX:ztcasE/L1jrMmH18x96X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637227501, "uuid": "bbe1dbe9-3f85-483c-ad01-60af8bd77600", "value": 342528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637227501, "uuid": "1752000d-3965-4c7b-aec3-5bcf0e6748ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227501, "uuid": "8d8280fc-e118-4944-964f-4f29de631d6f", "value": "743f8fec87ebf7c5d6b392261ec3988f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167d4f68-48a2-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637262154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262154, "uuid": "97031014-b277-41d4-8c94-03ba2fef145e", "comment": "Malware payload (Formbook)", "value": "acad67945f54e3e365574bad44eb3f62", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262154, "uuid": "bc3779d1-f5dd-43b8-b80b-d5e102c784a7", "comment": "Malware payload (Formbook)", "value": "ca9148d581a92e33b1405e2a4d63bb4e603bd4036720d17153cc3d6adba1e74a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262154, "uuid": "a6fb954c-edf0-42fa-bf36-d245ad03e112", "comment": "Malware payload (Formbook)", "value": "9ac4cae11526a0c63ef210e18d6c2bef2d3312cf", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262154, "uuid": "62c52726-d6f8-48f3-8543-02057f760442", "comment": "Malware payload (Formbook)", "value": "7e7bd96bc69ebc3f89800c0f3269c0321454d31ab94426a04c4d3dbec101527c552275abcd0952768680e1b3bb15007c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262154, "uuid": "345b46bc-d842-4904-8047-f81cc82e282c", "value": "T197823DACC4970299CF8A6BB86B1F6F85014C762EF7989532317CA7301BE2D7E501693C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262154, "uuid": "3059a744-f131-4fe5-95a1-095db82f5ff9", "value": "384:Ls5Nu16aJRj/xJgkaUmAvrDsjR6vNLpjUKl:LEu162ngkaUmAvrojR2L9UKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637262154, "uuid": "6a816674-629c-42cc-a748-bd5a1bc6a88f", "value": 17892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637262154, "uuid": "e6e9e11e-706d-44ae-92c7-71c30d1778d6", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262154, "uuid": "44bea14d-6ae2-4e83-83a9-bb5e020b6cb8", "value": "LPO- 1965.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d036c18e-484c-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637225528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225528, "uuid": "c8729534-beaf-453f-92e8-4ea07b4753b9", "comment": "Malware payload (SnakeKeylogger)", "value": "bbbf28c148eb325812183d91d8e8a239", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225528, "uuid": "c2e6d294-569d-4644-a15e-2deed67dde56", "comment": "Malware payload (SnakeKeylogger)", "value": "caa0fa101c0ee313ae591239f18dcd8fc37cb235af7dfb2e9de350d7f448d34b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225528, "uuid": "7b4000e2-35da-4c33-8eb1-b88642edbcc2", "comment": "Malware payload (SnakeKeylogger)", "value": "ba7612abff608b6dd038acfb43a31741329e007c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225528, "uuid": "aa1e1b8d-acb3-4176-8aeb-10dc1bfd7aa8", "comment": "Malware payload (SnakeKeylogger)", "value": "fbb978a704e71e5a1fd581daf9351f49412766f3f0d297744ffd16a7e89c92420e0155ce526bcc5266f7d84e17191ce8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225528, "uuid": "2bfadc96-57cc-4896-b35c-a6b341e3184a", "value": "T14CF4AE90307D8383F47B99B15FDB99307DA16A9C60CC534E20F59B2A63D3359286EB9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225528, "uuid": "ac0823e3-6f0a-4f49-b5a0-e7f248f094fe", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225528, "uuid": "11292698-af99-482a-b81c-69f6a45e67bc", "value": "12288:2AGkA38+LvrknmEx0ppf7VUbq9uRAxouWQYg+vUTWaeY9C61VS:Q1LImExUDy+OM4rcxA6/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637225528, "uuid": "2821bca4-fc3b-4308-af08-7bb6998d22af", "value": 777463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637225528, "uuid": "6f3a48bd-9068-4e56-9ead-256aabcf773f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225528, "uuid": "4fd5b240-4a2b-4ec4-a628-d4d448ea337e", "value": "2098765234567890987660.E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa6f150-4858-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637230628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637230628, "uuid": "b175bc68-0d3b-4346-9629-8d13cb1e264a", "comment": "Malware payload (Formbook)", "value": "09a4ad2cf919c461511ad95965b0dd1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637230628, "uuid": "e968c16c-f171-470d-a02f-7abb1f770a30", "comment": "Malware payload (Formbook)", "value": "cae28876b4d13e974995f686d84fdb7e48b4eb583e76cdd53f393dc8921faa63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637230628, "uuid": "78fe4605-1a3d-4fe0-8814-6a787da28a69", "comment": "Malware payload (Formbook)", "value": "b1b85111dd9327aae5a56a247881243565c20fbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637230628, "uuid": "8bea305a-a25d-453c-97e6-a81e0668c586", "comment": "Malware payload (Formbook)", "value": "44bfef50bd8f2e38361ce1fbc8eacb63ed68f0aa4c9268105b06d142927e1eb3d97e7b0a8fcb571fdc08396571da96cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637230628, "uuid": "c88148f7-1e1d-4255-bc14-12f5df2342ed", "value": "T196D4BEA039B4C417E7A0B1F985B0D2BA4A707D690DD0C246BCB97A9F7635723FC5821E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637230628, "uuid": "ab68a915-5087-46ff-87c8-692b8cec4f70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637230628, "uuid": "6a2a74c7-0d30-4a8d-bb07-05ab16ee554e", "value": "6144:Z170Ua3HXkh22hlECn/KqS15VIFI7M5IBOyVZsPl+30EC0IqT9k9JlK0aircK2nD:Z1m31gW7vC010aSH2ObeIL6sC5Avrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637230628, "uuid": "7273a227-a65e-4054-9d6a-b92b10c6d576", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637230628, "uuid": "b2cef645-1be6-4ea3-90e3-3fa380657c9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637230628, "uuid": "a634044a-e1b2-4afc-9aa5-b08a32343cd9", "value": "Consignment Notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86561c7d-4802-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637193622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193622, "uuid": "767bb844-4991-4dc2-b2bc-2828002829eb", "comment": "Malware payload (Dridex)", "value": "8d5edb4b3546cab8b0b856d52f93ea2a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193622, "uuid": "14801145-bd1c-488e-94d9-a03780b13c1c", "comment": "Malware payload (Dridex)", "value": "cb0d58ec795029107106febc29d6dae1f28566306a3cad4c8e93927819dc481e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193622, "uuid": "0bed8b98-159e-4a82-9dc2-06683f6490fd", "comment": "Malware payload (Dridex)", "value": "acd2297def5291506821d93dc879d2aa4971d441", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193622, "uuid": "22d181e9-f62b-4df7-90c9-d76e24047f70", "comment": "Malware payload (Dridex)", "value": "0ad92f6664b3ff464a64fb41506238674727bd74b60cb65d636d6cd6bdf689d9959c2503f8a434d87ae815eb51a1b258", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193622, "uuid": "acd9f9d1-2515-41d4-8321-2fe6ff3600a1", "value": "T125E4AFEAEA45BC3DD29E14B4A529A4133D8BF98C009ACBC1D971BD16E0FC94E761F407", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193622, "uuid": "73ac5ec5-f5e8-43bb-adfd-79d258f43369", "value": "02156850f54cd7e0fd2be68227189293", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193622, "uuid": "54adc398-b661-4ab3-9c11-ab749c755817", "value": "6144:chooH1bTj5/vvrldK+FrWYtvhkMV3LqQ8JaiwKwmw6wicwdXbza:chooS+NpV3eQ8Ja2b2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193622, "uuid": "d4b76769-c8cb-4d18-b7d7-fd4be6e7b254", "value": 668520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193622, "uuid": "d8640c46-7985-4c2c-991d-cd7611db8fa6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193622, "uuid": "f592ccef-5bd6-4e96-bb45-2e9b464dd591", "value": "SecuriteInfo.com.Trojan.Dridex.777.8417.10391", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0f3799-4860-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637234001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234001, "uuid": "1d051fb4-9cd8-46e9-adab-05089c3f7032", "comment": "Malware payload (Heodo)", "value": "3d5b03fb70aaf806b9eecc60d5b9247b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234001, "uuid": "279e5b19-5bf4-4cc9-a65b-c5a7c002788e", "comment": "Malware payload (Heodo)", "value": "cd56e26da71e89243b2bfe42b71c0b139f53508067c5796885104a8d287d0c7b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234001, "uuid": "4e1db6c9-4f9c-412e-9a14-a4f502850211", "comment": "Malware payload (Heodo)", "value": "12a3deb1a849d2f327808cb37203313abb04b9af", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234001, "uuid": "8c3f7af9-cefe-4974-865a-24c4f3473c62", "comment": "Malware payload (Heodo)", "value": "4ea3ff27bd1a8cb58a9021dfe8927750cc4ee526193c9825364698a77bf6b0b0e447a7bdd180db5ba1ba0ecfc61cd5d2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234001, "uuid": "90976ae1-2024-4e70-942f-d140d4e889e3", "value": "T144D4D0112843606FEC9C153C049977BD8FED6B55C2F4E8A7CF80E9E4AAC5CC185B6A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234001, "uuid": "5e44c698-dd8b-4da9-9f73-3cddb15c249f", "value": "9147e5ab6cd2dcc785393175990a85b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234001, "uuid": "175cfa7b-2d27-4b98-97a9-0881f186e228", "value": "12288:uOyVoxITHISr3VYRJ0QvcaqNqMWMeWXm6QrXmZ5Yfsp4:ZkVYPZ9169Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637234001, "uuid": "d79dfd23-03f6-4d59-b419-89d5392acecb", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637234001, "uuid": "5ceb2dd4-3044-46f3-a348-a0f18958714e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234001, "uuid": "bd574ea9-a6af-48ed-8382-a5105bdbff01", "value": "emotet_exe_e5_cd56e26da71e89243b2bfe42b71c0b139f53508067c5796885104a8d287d0c7b_2021-11-18__111314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06139155-4819-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637203285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637203285, "uuid": "bea4acbd-6633-4b2a-b862-0c2a6e64e03c", "comment": "Malware payload (Heodo)", "value": "0530bc5dce928e9904bf5c76187bf576", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637203285, "uuid": "04cb71e8-3854-44a5-afd6-460885021145", "comment": "Malware payload (Heodo)", "value": "cd6366e49986e3c92c6fdc05a676795ea62eca585c4d70806541fc766daa9976", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637203285, "uuid": "34c3dfd8-be52-4905-8ea1-8e4ff5f9e6de", "comment": "Malware payload (Heodo)", "value": "8823dc0a5c632dd0427767fe68fdc83b420559ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637203285, "uuid": "44343aca-b475-4873-9b98-3f9d1da0c24c", "comment": "Malware payload (Heodo)", "value": "8620b6b932ff2fb076a04a6d6c5da0e6d6a2eaabec50215d2ba3d977d1c0c4cc43ad64a79e0d582a4cd3e0f9ecd58e51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637203285, "uuid": "bee347ec-413e-49ae-b443-7441138153b9", "value": "T1C444BF10B1809032E9BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637203285, "uuid": "75ced97e-2f06-4b6c-856a-419205f5199c", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637203285, "uuid": "cce7aca4-0177-46f2-bfbb-35b7342b235d", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBM6asb:prf+WPVXNcwUKaWT1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637203285, "uuid": "75a589da-8f18-4584-8988-ba03dc003a39", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637203285, "uuid": "57bcdbae-e7eb-441b-9375-6c1f258029e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637203285, "uuid": "75c439d7-b17b-480e-9fe7-e60be679f295", "value": "0530bc5dce928e9904bf5c76187bf576", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76609bb7-488c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637252866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637252866, "uuid": "eb6996b9-d6ae-4ebe-8bfd-95f22c91d5eb", "comment": "Malware payload (AgentTesla)", "value": "5d1e132e0d7ca009b9c8be50a80d0cac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637252866, "uuid": "46a4427d-e52d-412d-b28c-f441694942cf", "comment": "Malware payload (AgentTesla)", "value": "cd89cce27d83a661289b05a9b27f57acb5878b9b7cec3859f4a63c779994e3e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637252866, "uuid": "3862c911-db52-44e2-8475-5ab7f3ea0fe8", "comment": "Malware payload (AgentTesla)", "value": "0b5b8a3bfaa14773532dbde68390e85ddf9ed556", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637252866, "uuid": "1cb21f56-5fe1-4fef-b16a-64af000c7f86", "comment": "Malware payload (AgentTesla)", "value": "f8beb03500ef266951e509421297f343c8fba83a64ae905bea72f4b7ff6ae2b498711df1223cc132cf9ec26b001e0a82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637252866, "uuid": "755b9ecc-2606-4778-ab94-ae373624bc9d", "value": "T198B4016463688727D1B927F8A465F73D07796EE0B824D70DADC074EB3E727420829B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637252866, "uuid": "9f752733-b40e-4063-bfb2-fd0106bf8fd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637252866, "uuid": "bcce5a98-62bb-41ed-987e-582e7ea4f204", "value": "12288:Ay9ZLWWJH3QxOiOTtLwKp9fxjXyIRRdZ:l9ZrA3kVwABCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637252866, "uuid": "91091d39-6f89-4cc6-bb1e-44fcfd9b5a52", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637252866, "uuid": "b856b2b8-048f-454a-a9c8-8ce6b84900d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637252866, "uuid": "bf8b12c3-3f1d-47c0-889c-ec65d88425cb", "value": "vYeUxRnIbLKDudo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04726b85-484f-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1637226475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226475, "uuid": "01331d77-6908-45f6-899e-4443feddaeac", "comment": "Malware payload (Vjw0rm)", "value": "3bceb7305acd9582c4b95ca64178cb99", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226475, "uuid": "fd5062a8-65e4-49a1-a37e-6d70b5e8e7bf", "comment": "Malware payload (Vjw0rm)", "value": "ce20e99e8c7ba7c6c3656a07f21e6581286bf5b8e6b6da87b26f8ea632135dbf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226475, "uuid": "745a7190-0194-456a-b59e-7ccb03dfd172", "comment": "Malware payload (Vjw0rm)", "value": "1d45fdc83a1bef69c9af0f87f85608f809e09454", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226475, "uuid": "95ffda6f-a433-463a-82ee-824ff416d832", "comment": "Malware payload (Vjw0rm)", "value": "d21062d9c6e4ca92f84061af336969accf8d29451a3d83fd0423a6ebafbc3c1d9571827b3852305432317b4902f3e2ca", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226475, "uuid": "97189829-2474-4ff6-8f3e-8beae63c5770", "value": "T1A4C27D847EC9F8165781965782AFDF6C07B883C6A5B4C00F7553BAC4A60268CDB2F78D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226475, "uuid": "d931f13c-c1ec-4741-aaee-3670fd06b606", "value": "768:eC1kTgdhziVwJgqLLqwrfHAj1fWKUFDomIZD9:efgdZaqnquHS1+KUFDomI59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226475, "uuid": "42134165-0a5e-4b96-b3df-917e8acd55d4", "value": 27043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226475, "uuid": "5a493060-2d8c-41f6-8392-c553ab1f360a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226475, "uuid": "149c712c-4487-4576-81f7-a52dd265ffcb", "value": "IMG-1100210.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f55a8ad-4844-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637221769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221769, "uuid": "cfb4a893-0deb-4fd3-b5c2-00d24893a08f", "comment": "Malware payload", "value": "7d61bc9b077029a0a0d325a2be4f15aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221769, "uuid": "5e51f41b-63a9-4cd5-95ce-2f92929fc78b", "comment": "Malware payload", "value": "cee0d8f940cac29ed7a8b48a622771184a71dd0ba0268620e59f16ee1c5a03df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221769, "uuid": "6dc46ce5-32f2-4a6c-aaa5-dd3a21fee08f", "comment": "Malware payload", "value": "014c63ba6ada90471a3db181dbff212b452921b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221769, "uuid": "93a1aab5-3f01-4b4c-9d5f-1e934a87bf93", "comment": "Malware payload", "value": "3da79da169412cf1a1791bac29b723fbb9aa5fc50819a2a6f5652945ef15ccde888889a816b638df8c3eb21f9bc64be1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221769, "uuid": "8aaf3964-f5dc-4c00-992a-f72964eb7d23", "value": "T10F16331054D112CAF6D4ED1E1BDC3725523FEECE28B8ADE3D69283F1040EE89DA72656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221769, "uuid": "65571494-baa4-49c4-abec-7694089e120e", "value": "98304:G1wwAjzIQOMK2GNKslgus10Y1/UJ7BdlRbTBAlYVK:G1wwAYBr21uQsJ7vTBAlYVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637221769, "uuid": "e2c8a3e2-a541-4989-9a3f-ff8a12beca0c", "value": 4141056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637221769, "uuid": "f1169fc5-0eb6-4854-8dd5-4d95ff2685fe", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221769, "uuid": "64ba3f92-e4f7-49c1-9005-ea79949e78f3", "value": "cee0d8f940cac29ed7a8b48a622771184a71dd0ba0268620e59f16ee1c5a03df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5cde737-48c1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637275816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275816, "uuid": "fd264961-bb4b-40a5-9faa-c3d5fa5d4556", "comment": "Malware payload", "value": "1daba393eee9d8bdaf645157dae83990", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275816, "uuid": "0215d8ac-f339-4b2c-a8cb-d6b8b5fe72ed", "comment": "Malware payload", "value": "cf5edcff4053e29cb236d3ed1fe06ca93ae6f64f26e25117d68ee130b9bc60c8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275816, "uuid": "3c537e16-febb-442a-b2e1-c8105b92e927", "comment": "Malware payload", "value": "2303a9c0092f9b0ccac8536419ee48626a253f94", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275816, "uuid": "98e7bb47-0705-442c-9915-35b2e43f69b6", "comment": "Malware payload", "value": "8be4086182efc83c2b5b607bf464fd710cc609af6ada7a43117f8ea25293a5cf2fdbc199d171e6d7c8008750c004f55e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275816, "uuid": "76bb74a4-8b10-4279-8e9d-dc61d96e1e24", "value": "T1F4C597339368F48DE087C074A7CA87F1D61074391976226FBB65DB272EB1DD896A8703", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275816, "uuid": "baa5768d-8004-4c89-b3c7-79d581114fe1", "value": "49152:h1GZzr0vfu08/T6Iv9VuCGV+qC1EFTe8mHzU3HqBP:OZzr0vfu00eIv9VJGLEEF0TU3HqBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637275816, "uuid": "6d3254af-1f7f-4d66-9349-a2ed414f768b", "value": 2575107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637275816, "uuid": "dcc8fee1-eac1-4bc0-9217-3e12cae96a1d", "value": "application/x-mach-binary", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275816, "uuid": "2efd9014-524b-42be-ada4-f24f321a22cd", "value": "cf5edcff4053e29cb236d3ed1fe06ca93ae6f64f26e25117d68ee130b9bc60c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6408cff1-48a2-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637262284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262284, "uuid": "9f12e12b-ae5b-4bb5-a74f-27264b302f71", "comment": "Malware payload (Loki)", "value": "06b756c49f18bd309cb14e5ebcaf9374", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262284, "uuid": "ab73b30b-a0f8-4969-b743-5843e55710d6", "comment": "Malware payload (Loki)", "value": "cf69b29ee0cea1cb92f2d1c52189a5cc9a529b9221c5048cee527ae39c11bb07", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262284, "uuid": "7a3a77a5-ff93-40a2-985d-a9f751ecb8c5", "comment": "Malware payload (Loki)", "value": "a04447144a80b02ed56b6a4657c9b634c3a78656", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262284, "uuid": "d4c59b93-f358-4903-a4fa-d79228a9c023", "comment": "Malware payload (Loki)", "value": "165def2128ebe4349e1133ff427cc6e9c605dac1e2495a2eae46a7dbed17b2f342c0d2a9643238e43bfbd1df1cc380ad", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262284, "uuid": "f005cb3d-5649-493d-99c7-64fce6ecc42e", "value": "T1E734122773D8063EE0764578E61695B482B6FC4D6D0240332E7EB64E7F34A73CE19A24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262284, "uuid": "0a0dfa5a-26e2-48c9-aaae-94db6ab7cb11", "value": "6144:xmTJ2NysPb4HDPP7Ep8TBVTCUT9r/adHdXS:H7juzmsnTCURmd9XS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637262284, "uuid": "a1213ca8-ba57-450f-816b-e363663c7edd", "value": 234056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637262284, "uuid": "231b29c0-7e10-4370-a594-e9a2464e2d9a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262284, "uuid": "f72899c1-9489-40ba-a755-cd8ea476259f", "value": "Inv 10455 JKK.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9024842c-48a3-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1637262787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262787, "uuid": "6dcf6865-21d6-4079-89ae-949f74ca39da", "comment": "Malware payload (BitRAT)", "value": "796849b8113212defde0ab285acfc225", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262787, "uuid": "968abf5f-835f-41d6-8a5e-add9ab20f085", "comment": "Malware payload (BitRAT)", "value": "d022bbc1f478e3302c250cc39e727f11621304736c0c1dfb607110e28d5824e4", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262787, "uuid": "282fe3f4-fb46-4398-b44b-607eae512b08", "comment": "Malware payload (BitRAT)", "value": "9e057274af44bac9c0d212df838a15629d99f4d3", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262787, "uuid": "38aec9cb-da2e-4ffe-9f9e-ce5f9d584789", "comment": "Malware payload (BitRAT)", "value": "eda005cb66a6bd6186a9ebc6815b2742616e2341eacd66053dd66856e76bacfa98c9a5fa3d54f848e6545cc566b72b70", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262787, "uuid": "b0e4de7b-4973-4b09-a38e-594499127c42", "value": "T1A8C5D0A1B7E59B5CF43C9372A8A2D84087B53D39486CE66A2DA167CF1D62F424D03F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262787, "uuid": "200c2d26-1eac-4043-accb-4439d301b5c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262787, "uuid": "10ece043-e7c2-4af5-a063-c527f18604f0", "value": "12288:CQcN1UdY5Zxh5AFAd4PRHZ2LK+Eu6Kfnum9odHZkDW/7UcWQj91JU9EBCrFbPZZ3:CQcN1UdYuQ4PvCfn3azUD6PJU9EB0Fr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637262787, "uuid": "d314e59f-68ab-4de0-a909-ca1e8a37d97b", "value": 2737664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637262787, "uuid": "8212e742-2b3a-4dd8-8023-52f4619b646a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262787, "uuid": "b183d9b5-75ff-4af9-8275-6ea1477603a3", "value": "DHL_846641.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c09956-484c-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637225536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225536, "uuid": "c4d03faf-9714-440a-8069-ef30f82d7275", "comment": "Malware payload (SnakeKeylogger)", "value": "0296deb94c23ea6652f24fbf88962d5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225536, "uuid": "ec44eff7-a7c1-4fc3-91ee-4d6995662170", "comment": "Malware payload (SnakeKeylogger)", "value": "d02ef4b2bebd9eb4e2420fb473eb526249487aa5d86983aac417dd670019583f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225536, "uuid": "446b2a9a-02de-4441-a01b-231c861115ce", "comment": "Malware payload (SnakeKeylogger)", "value": "c2e22dd0bf60e00ff2fb8ed0a38a7950a239339c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225536, "uuid": "9d794eb2-25e9-476e-87cc-d77dde4219f5", "comment": "Malware payload (SnakeKeylogger)", "value": "1fe214a50eed8a5ec1601c9c3542c1598689ededfa8ffd722a8a835775a6dfe3213c173fe9d3cbbe35ccac756eeb3ccb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225536, "uuid": "235b4e35-4955-4107-a02c-8394ced025ad", "value": "T172A24C3787980A33EC7ACB32A5D040404B75B743B953ED2F9DD9A1899EC738162A06BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225536, "uuid": "fbc7e3d4-dd9b-4844-881a-4c24d3a9c926", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225536, "uuid": "e6dc7a4b-c9f3-4aab-9dee-c8dbab9d15aa", "value": "384:24bgNBLuhcNFXfFN3Z4oxLK7g90pvU+fHDWDlgjgovgyggugcgiOWwZQoupJ6gh/:/AtyI0p8sHDpFZuDh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637225536, "uuid": "f20f6c7a-cb1a-4125-bf3d-3321d54ec034", "value": 21432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637225536, "uuid": "754f47fa-a798-4417-b3dc-64b363ab46ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225536, "uuid": "535588e1-cff0-40d1-a544-b1a9c5cf2f7f", "value": "Payment Advice..pdf...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6835a0-4854-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637228802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228802, "uuid": "284e1eec-cc75-46c8-91ea-9996eed56f2a", "comment": "Malware payload (AgentTesla)", "value": "59bf36c575c8806d269aba2f1e01aae6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228802, "uuid": "43a7bf77-57e5-4741-b547-aa4ee2c58f10", "comment": "Malware payload (AgentTesla)", "value": "d1306ffb2401059e154d928d4d50f37897d1855772d449c48d910282740a7857", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228802, "uuid": "a01cf79f-5695-47cf-b573-d1c6bf4daace", "comment": "Malware payload (AgentTesla)", "value": "0c3aefa7ad996fa84d07ad3b91ec2d30aea27ced", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637228802, "uuid": "d432fef5-fdeb-49e0-882e-40b367d27969", "comment": "Malware payload (AgentTesla)", "value": "a8bf3f76dd6ed176d564a66c95779ff25d21b67e664b2a2fccd47344109c6f0d1aea51756f73a233b9608509f10083ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228802, "uuid": "97982d20-aa4b-4352-b463-68517bd24cb4", "value": "T1A5E4DF903AB8C453E3344676C9B0D2BA4AB07D6D1DE5C6063CEE7ADF76793A07C59202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228802, "uuid": "403b3154-6a75-4035-bb6e-40e4fcf23883", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228802, "uuid": "f0b3503b-55fa-43e7-a909-4c99b43a2de0", "value": "12288:vlHcm31gW7MVaTlMSFWmT56uLinc/BWW4:vlHcm3KWuaTlMkBHIGBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637228802, "uuid": "6e7bc2b3-b580-4010-8b30-02b246635771", "value": 691200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637228802, "uuid": "c6bd0e4a-2ccf-4a5d-9974-52c1b5926795", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637228802, "uuid": "5bb14739-3bb2-43c5-9da1-b0984a794f0e", "value": "Fattura-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57362477-48a2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637262262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262262, "uuid": "8dab7d3d-2f7b-4c3b-ae1a-8a352ba1eb76", "comment": "Malware payload", "value": "e3bffc237c66c02274867c3111865dc9", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262262, "uuid": "e1e6f5af-ae65-4043-a059-186045e0b6e0", "comment": "Malware payload", "value": "d23c56081ea7876e1c55c8aba2d639abad70628ae795807168984fa2d85da15f", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262262, "uuid": "7250ee66-3243-45a3-ab44-beb49d69b77b", "comment": "Malware payload", "value": "ae5c2517ccb795bee60b51783cc56e7dc3f29dae", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262262, "uuid": "6a9dd0ab-5015-4184-925d-d0b292d60088", "comment": "Malware payload", "value": "8ea69a76939aad2cd6717f3b27d94db44c5bf8f7745914939a440bf82da45968dde45dcb544482cd15ca9e882deab36d", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262262, "uuid": "9c1d089d-e26e-43ae-a992-a767adb52d14", "value": "T1B43412BDBBD04183D8AA83F968617244E033FC931E5CD019E94C395BD9F8F0692677A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262262, "uuid": "0d23cdfd-af2e-4357-9b9e-fd9b31d97b8b", "value": "6144:oB00eo9zCQd9EHopJ5eHcxDFTdQ2JjvRCO3NjMOG:u00x0+J5e8xDFTdQsoO3NjBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637262262, "uuid": "eac1662c-6c7f-48a4-8450-b844f84bcb99", "value": 234584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637262262, "uuid": "fa80052e-3480-44f0-9427-f3c205558e54", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262262, "uuid": "94be36d0-ee1f-4d01-8ff6-1bae245bd1f2", "value": "Order Quantity.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4a53f8-48a7-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1637264334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264334, "uuid": "4393f113-a864-4695-bfab-70535b6f6a70", "comment": "Malware payload (DanaBot)", "value": "a767c1b417241b83b4ce08f2ccdd93c4", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264334, "uuid": "2d1bfada-3d79-4c3b-a2cc-f7fc8dda0f75", "comment": "Malware payload (DanaBot)", "value": "d25a0431bbf834e845cd7dea3fab2c09b0d116ccd2aa7f58f21ffb7ad81fb470", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264334, "uuid": "8a645c58-52eb-43a8-b482-66a6bc23e10f", "comment": "Malware payload (DanaBot)", "value": "2a82b1fd2ceda7fbc9f31fe1ac90997222a7a71e", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264334, "uuid": "ff68b779-d803-41f7-9301-c836ab4a2db8", "comment": "Malware payload (DanaBot)", "value": "1ac59034cf83097f5801b7555018db84ce161880ddd15cfbd904d9a7c48bf72a4db3f3807136551fc5204b39bd2f2d4e", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264334, "uuid": "a065d447-f9a6-4333-ba6d-a40039ff402e", "value": "T137958C51B602E726D6A86CB8FC00C5EF14F0BD49FE44D267F6C17F9FA932241A82519B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264334, "uuid": "17fefca1-0f97-4f22-8944-1642d8bb1f1f", "value": "54ce3a5b38a47ce9089fc65e50786851", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264334, "uuid": "07605108-ccbd-4d22-a07a-b1f872540593", "value": "49152:QQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4BWeCqfn8+nFFQCxEsJwKQj:QfaNQh+NUABO/c0Y9AdDCqf8+gqJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637264334, "uuid": "4980ab5c-3c14-4274-a491-9b797859fb5e", "value": 1945600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637264334, "uuid": "cf94e882-40cf-4275-a88b-d9fa8511db43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264334, "uuid": "7eed6402-a012-4458-9bd7-12109115543f", "value": "a767c1b417241b83b4ce08f2ccdd93c4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44f2643-4839-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637217321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637217321, "uuid": "1d5cc6f5-49ec-41fe-ae17-244305a01fd9", "comment": "Malware payload (Dridex)", "value": "a24a6fe26eeca112cc1b39a1cb710d8b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637217321, "uuid": "ba16cb28-4c59-4400-8029-3cef27e23453", "comment": "Malware payload (Dridex)", "value": "d2ebc46ddc391d821fdec1b108fa63fbb02130c9965fd03059842af503822c9f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637217321, "uuid": "ad8643e9-a82b-425e-8e79-f123e7e80d1e", "comment": "Malware payload (Dridex)", "value": "5216e55a1ba1238d8ec394cf65ba567509ab872b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637217321, "uuid": "03822e39-74ee-48dc-9dee-f7797ff9adc8", "comment": "Malware payload (Dridex)", "value": "bcb419f5fa3325bc9e3b0a7c22fc7945545d82c0c12d049b1b5f5d08cc5e6d5cb5e01683b391b9dffb9d0568c03b5253", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637217321, "uuid": "6d6d97a6-d0e9-473f-a3a3-d27e4333c216", "value": "T1A683023FC6A96869C0FA54FB87C50CF2D539064E0585FA2BB98E526C17A104E5B4F11F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637217321, "uuid": "259d579c-dc97-4554-9a6e-a38cddfd3f48", "value": "1536:1WP8i+QySDEEfPFFxgFzx5YVqHS2YzayhpSW4vHR05Q4r5UZKUbHahR44I:wKQydE6FzIsj8aipSW4vHREQ4iZKUb6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637217321, "uuid": "b37e5278-7453-426f-a6a6-8466d7b77c06", "value": 88365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637217321, "uuid": "2f130105-4a5d-4ad8-8c22-256ba5fe3783", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637217321, "uuid": "4b122caf-e0fd-4345-b8e5-5fa98169a259", "value": "Venue_BookingX31697.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29761386-4849-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1637223960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637223960, "uuid": "5d18ce9f-1626-4c56-955a-317666605ef1", "comment": "Malware payload (Vjw0rm)", "value": "88a5bdc0097f42d43f60fbfb76ce29b5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637223960, "uuid": "08d8a652-b44d-4550-9e94-0a4a496ddcb4", "comment": "Malware payload (Vjw0rm)", "value": "d307911d432a9b5302823bddabd793c3f17d72446471b0a69d6a7bb48adc9d76", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637223960, "uuid": "b1e5ac8e-881d-47db-bdb0-0ae3c880193f", "comment": "Malware payload (Vjw0rm)", "value": "5f74a6116d48cb0237e698ad7cc0dcf1cde310be", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637223960, "uuid": "3195d74b-aca0-4f3d-ad73-1ae12f5ff7c3", "comment": "Malware payload (Vjw0rm)", "value": "a009b8e74ba2f40d4daad0c49c79b9298e3753a7a7e07413adccf1a3ca5916a888424c2ace61fef7ab0be17acd2acc2d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637223960, "uuid": "798c1859-10ae-429f-a88f-caa62290414d", "value": "T16BA29ED8BDA9F9209B81799581FE9F0D17F88247BC28C14F3512B280A1269DDD12F75E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637223960, "uuid": "3209622d-b454-451c-bd16-303c00e25d5f", "value": "384:eyMk55KjsOiaXRgI3QQ1sRKEPvUJP+hHMx4PAy3p1WDnAp004BE4O2RJ7SvPXhm9:eFk5mijA1XECP+tM6wnG4c2rsPXs9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637223960, "uuid": "a742fff0-01d9-42c3-af26-a7cfcbdd0b84", "value": 23325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637223960, "uuid": "e9657a0e-8cde-4ffa-acef-a578aad4d0a3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637223960, "uuid": "4072246f-3e14-4990-9232-4fad27efc185", "value": "PO202104-114 - VIDREMOT S.A.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e02df5-48a0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637261513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261513, "uuid": "b27b7e81-065e-4b5f-92a7-3a4d1d6c0357", "comment": "Malware payload", "value": "58bf7e6a9610cd419ea46c1490cd7742", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261513, "uuid": "f055a2ed-fa09-450f-8ed0-097bc57c53a1", "comment": "Malware payload", "value": "d36766cbc149d7f79654d2810ffe2fd3b1a6487fe3aff6ff010e664b60493cf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261513, "uuid": "5fdcdc38-6bca-47fc-a372-4b72d9900b87", "comment": "Malware payload", "value": "08ca48c0f25d8f27dec0008c53fc96d63cb37799", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261513, "uuid": "9fcf8fab-cca2-4432-aea9-0c5f93869ada", "comment": "Malware payload", "value": "cfd8851f8103d1b8e54df22fbf7d86b150f45235288ee4f27036d5500b267c61d3c6b5fba64dfc3271871fcd217adea1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261513, "uuid": "7a14c2ab-e7cc-4f4f-a3be-579ab14bdc1a", "value": "T1EE34F644F2E894A5F4B72EB46FF9C675C62DF8B21F1E56AF2B00161B4D20681D670A33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261513, "uuid": "dc61328b-4ff3-4f81-b937-b49157c35bf4", "value": "2d897334e5a0b92447a2b50caea5e0a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261513, "uuid": "01436be2-e87a-4457-b0fc-ca20b9c15bca", "value": "6144:zpjedkDkjYkSQkKq5CecUgNLvvkauWRwM:1jedsP5Cwg15RwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637261513, "uuid": "77522ec2-5945-4de0-8f4b-e7b5ba85f479", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637261513, "uuid": "ff199d3e-9cd4-4e0d-a4ad-d9268aa460db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261513, "uuid": "a492c155-dbd8-40cc-8312-3a8c0a2305a3", "value": "d36766cbc149d7f79654d2810ffe2fd3b1a6487fe3aff6ff010e664b60493cf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aeaf1f9-4850-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1637227050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227050, "uuid": "edfd8766-1de7-4bc9-bcc6-d9dd0214d362", "comment": "Malware payload (GuLoader)", "value": "64fc3c4f59ee7e4a17981bc8e1e1b881", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227050, "uuid": "2dc2caf1-78a9-4954-b44b-94724747fff3", "comment": "Malware payload (GuLoader)", "value": "d3c38fa820a51db6ca5176313710f106af62613ba15bbce95d31ee0018b7648f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227050, "uuid": "c9de915f-f67a-4c89-9b72-d3d5e95115f5", "comment": "Malware payload (GuLoader)", "value": "6ba0fe5add3c25e3fd52cc004e3b4e6f797c47e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227050, "uuid": "e4f15f60-dfa9-409f-98d7-f3d9691f7833", "comment": "Malware payload (GuLoader)", "value": "0489c18bf0f4e13d009da665ec456f22547c3ddf08f09a66f5cb5bec66110027c778b186938cca7c13d45608a0120347", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227050, "uuid": "5bf7bf4d-13e5-4fb6-b746-fcf4aa17e043", "value": "T1B383294776A48FD1D88005F12C76C3F987BBFE6129510F17B1643B6DCA7BE90ACA1682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227050, "uuid": "5c97d2d9-60cd-490d-8887-0e233f659c7c", "value": "e40e83f568c54b10af15e7b8ce6a188b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227050, "uuid": "c381f4d3-be39-4828-b6ee-703d2dcb4f64", "value": "768:VCnKu0lsJoNAUXMTBlFhELOfTu+HTF+pYeuOIQ2KoeVrWD3x7/U8v+4kk11zqcf9:VRu0lWYAlwa/HTFevBoJnRv1dVe+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637227050, "uuid": "a61073f4-0682-4d4a-95aa-67a07547c2b6", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637227050, "uuid": "3032c38d-883a-4afc-ac02-57e0064102c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227050, "uuid": "674caec8-8e34-4257-9e39-209d2271742f", "value": "64fc3c4f59ee7e4a17981bc8e1e1b881", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcefc840-486c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637239294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239294, "uuid": "655430cb-66de-46fe-9771-04f1af25e30c", "comment": "Malware payload (Formbook)", "value": "5bb5c6d0b63818954497bb706cb7571c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239294, "uuid": "6c4828b4-b1cc-4e12-bb8d-31417c1aaabb", "comment": "Malware payload (Formbook)", "value": "d423efa269caa735e023f1046e157e9ae9e0abe43339cea4ef9311109db0cb6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239294, "uuid": "2164ffd7-f1f1-4b60-b94d-52ec3c038e60", "comment": "Malware payload (Formbook)", "value": "81d6dfa7b109c25eff3e9aee2cc9ef281c8897f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239294, "uuid": "7e91a29b-cdd3-40cc-bcf8-7c0ea7ec264a", "comment": "Malware payload (Formbook)", "value": "ab990453aebfa42a1eee3816184dc24da3f958aa2e132b61973350d0edd8102e5ba2dab948dae535b5339b5988fdb677", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239294, "uuid": "a7aec709-b117-4cc0-b876-4973633d65ea", "value": "T14E84BF10ABA0C035F1B716F449B992B8B93F79A17B7594CF62D51AEE5634AE0EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239294, "uuid": "046ef1ad-d2f4-48b1-8f11-672df4426041", "value": "323504891562b22c6999415c44b3f208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239294, "uuid": "1b2b671c-a139-405c-bd2b-94cd0a40e839", "value": "6144:Z4VFfd2q3XjdYo7XCzXaB9L58L6uB5w8sY/etC7iKxjoBMn:avdbTdYUeM9L5w6uB68syetyxjAMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637239294, "uuid": "4e64602d-e4e9-4bb0-8d49-e5f50c47b3bb", "value": 371712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637239294, "uuid": "46a2082b-308e-4963-9341-c67ec1f304b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239294, "uuid": "a35a1420-5070-47b0-88e6-c9489736a6e7", "value": "5bb5c6d0b63818954497bb706cb7571c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b13bc92-4883-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637248847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637248847, "uuid": "6b4fc5b6-46bc-49a8-8132-e6350f400d9d", "comment": "Malware payload (Dridex)", "value": "5845c2aa5c8798f7078bd96da06b1051", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637248847, "uuid": "e9db4f5e-6bc6-42a2-a72c-f3362e330022", "comment": "Malware payload (Dridex)", "value": "d45df1bb669ebf3995005dd8e0c4a6999a776501cbca500182024b763b71cc1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637248847, "uuid": "b0ffb9f7-893d-4965-853a-64be48f2d513", "comment": "Malware payload (Dridex)", "value": "f1b1a00fc8651458d7c7b58c2408f0886d04c9de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637248847, "uuid": "07f7fba4-4ad1-4820-bb2e-31233bf1600b", "comment": "Malware payload (Dridex)", "value": "ca7299bcd7edea8e42fb4bd95dd8338e5ec964410b1c93f78a9578ad7863ba91dc8259a4f0b3179a931e2c57b4e88172", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637248847, "uuid": "ec42877a-3e32-4e00-98ca-59ba5533ded8", "value": "T19AE48E0250D512FCFA898ABF155A67C1C6B310824ED1CB9E25CD07EADF64A03EE6D1B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637248847, "uuid": "03202164-f353-4b00-97e0-46d4e063461f", "value": "fe16443ce39f2fcea9c5accdb27a9eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637248847, "uuid": "c3a9bdcc-f1dd-4ca7-889b-b9cc46a34c23", "value": "12288:77TlJzJzJBJZn/JH3lJxJLJZJdPgA1VKBUA1rlldQJw:77JtpDv/lVbdT3IA1wBUA1rlldQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637248847, "uuid": "88659f2e-df9f-4bd8-8c6a-ca8786480cc7", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637248847, "uuid": "00378156-332d-485e-bc32-340e0e7fa720", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637248847, "uuid": "df0587cc-8c99-4b2d-8515-5ac71829f0fa", "value": "5845c2aa5c8798f7078bd96da06b1051", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3badf75e-48a2-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637262216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262216, "uuid": "1fe23762-a986-4e4b-a8f3-6f2bc52480bb", "comment": "Malware payload (Formbook)", "value": "9b2d9d96e9316fe2ff1f94de0d46f3f6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262216, "uuid": "6748b02c-01f1-4a12-bd2b-80b67814bae1", "comment": "Malware payload (Formbook)", "value": "d583cee0e3d4c5b8c859429c1fb1d2a83afd08048b0c2bf85575a6fc3db94075", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262216, "uuid": "6aad223d-f2ae-4755-bfd4-0a875451c338", "comment": "Malware payload (Formbook)", "value": "883a75cda3d36a298f845a5a4a6c2d39d57bc134", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262216, "uuid": "b2b786e6-1d7e-40f8-9081-38cd0bd279c3", "comment": "Malware payload (Formbook)", "value": "5a0ef69295e72bce79c3bb72c8df4368ca35c25e36e5e1e7aff51693749f9092844ef117f6dbb768cc59a434e6907414", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262216, "uuid": "96772cb6-4de4-4bce-a4c2-b1280c7f4579", "value": "T1836423EB33E48F2BE08B2ABE03115627AA4ADD1C8EE52DB7F054B07047727175519B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262216, "uuid": "e02523cf-63de-4efa-99ac-3d365898dd0c", "value": "6144:hAZ9wxJbcmxL0E8wI3msJqhzV5HYrbz34hsiIW6hdKxkH6Pyk:GZ9W163RJrbz4hsiodKxY+yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637262216, "uuid": "4149e5e0-cacb-4807-b13a-e89a078707fc", "value": 328280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637262216, "uuid": "7f0b0800-70eb-4802-9f51-baa625a6ba27", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262216, "uuid": "53818cf1-5871-4c5d-b4b0-76dff56e835e", "value": "RFQ 67356563.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e298a62b-48c1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637275810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275810, "uuid": "2d4a3b56-fb8c-406d-b24c-e69fd05c23aa", "comment": "Malware payload", "value": "3e4de0eeefd2e1c024b41a4222285f74", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275810, "uuid": "193a86db-3f61-4290-8770-aa88192886e1", "comment": "Malware payload", "value": "d599d7814adbab0f1442f5a10074e00f3a776ce183ea924abcd6154f0d068bb4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275810, "uuid": "c12dc0bf-6d84-4dbd-ae5f-3b6db9d46825", "comment": "Malware payload", "value": "000830573ff24345d88ef7916f9745aff5ee813d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275810, "uuid": "6ba7c1c8-cd8d-4d9e-a6a5-0876846f1ab2", "comment": "Malware payload", "value": "f6eb4b89f0e75f08fd6789003ce3cd9e8e4f0096bb80d70246437a9cd83646d7ae87866fd30c7961987c3c9a406798ff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275810, "uuid": "e9a42666-8f26-4967-a337-d0af81ae7b83", "value": "T125A5A7339368F48DE087C074A7CA87F1D61074791976226F7B65DB232EB1DD8A6A8703", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275810, "uuid": "09d8bc70-f7ec-476d-b166-db6f5e35e308", "value": "24576:MwFVmcTJAQ81LGqIvawVSIHXJbchgLbmYnGVxhKfSWjxsvkEFkpiTe82EcnL8+7A://T6Iv9VuCGV+qC1EFTe8mHzU3HqBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637275810, "uuid": "04f18048-f9ad-42e2-a47e-273d96be41d5", "value": 2068908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637275810, "uuid": "1f922d69-3749-42f5-ab4b-c6048a9a89cf", "value": "application/x-mach-binary", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275810, "uuid": "cde2a6a3-ad1d-4aa8-a7e2-93d4a760f5eb", "value": "d599d7814adbab0f1442f5a10074e00f3a776ce183ea924abcd6154f0d068bb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62551283-489e-11ec-843c-42010a9c0014", "comment": "Malware payload (IcedID)", "timestamp": 1637260563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637260563, "uuid": "6cdc1a50-8bde-4400-8015-1bf281576b8d", "comment": "Malware payload (IcedID)", "value": "4e28e9e6d6444d1ac41dd7ef7da32196", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637260563, "uuid": "48a86545-2413-468d-9959-48f46832786c", "comment": "Malware payload (IcedID)", "value": "d5a4fcb0e552cad22b1a907e874295b08e83d58bd83f9b4788c90aaad263cd87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637260563, "uuid": "883b0016-e1e6-46f1-887b-f7bef39de5b0", "comment": "Malware payload (IcedID)", "value": "0b4eab4641ac9058babf8924610f8c58fcb5b6e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637260563, "uuid": "bdd2888a-9c82-4a9d-93be-264875c39a0b", "comment": "Malware payload (IcedID)", "value": "7b72834ecff4f865beabf0618824bf44e19a5b2619fafc1e14f9b43fa9a9a9b0ebb106b712a62ab9d803f5f41db289a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637260563, "uuid": "dd66613d-f937-42c4-a96f-165f98ea4fc8", "value": "T10E84E8AB9532065BEED64C74DC88A3B6CA936D3C4F37DAF75C64D0707828161BA27243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637260563, "uuid": "1028f9d4-1219-422c-9e8a-4e81eec1e325", "value": "3072:rKrbi9VwBh42cEzhMltVpIP0T7ORLzlj5CyAQpqYTY8qr9QLYFXkMAop85qUaqik:+W9iBXrhMl3pIP/N5pBMGLYF0MANa8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637260563, "uuid": "4c1bdf6e-82c4-4993-9ff6-c6cc3aee0bcb", "value": 384512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637260563, "uuid": "42992fce-4a4b-41d9-87c2-687810e1432d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637260563, "uuid": "9fcb2c3e-633a-46a0-bde1-05d9049e2f5b", "value": "ofc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3c8f3c-4823-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637207671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207671, "uuid": "736220dd-8071-4792-a43b-5488cda87731", "comment": "Malware payload (Heodo)", "value": "493c45da8cc2032c8b873b66a6d747f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207671, "uuid": "a40a56fb-7ad4-44b6-a88c-659f39b1a3c5", "comment": "Malware payload (Heodo)", "value": "d5e9cdec2acc913b4b3bcf416c08eeaf94ef0039a7e7f1b63b5443ceca5aa846", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207671, "uuid": "6b14fde1-490e-4f9a-87f3-86abe97388a3", "comment": "Malware payload (Heodo)", "value": "d76c0f82659083a406a83fb6e53f01020a013766", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637207671, "uuid": "d31fd6e2-f050-4543-b8ed-1f8df199da25", "comment": "Malware payload (Heodo)", "value": "723d10d5cd7cd2011d52928d91fdf48bcd6a848a2f9148dca895904c15c3a1ed81d7ec4e9b2b05cb1f1495c3a6d1b899", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207671, "uuid": "166e3fb5-17df-4e58-9f15-1649b4ce473a", "value": "T1EE44BF10B1809032E9BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207671, "uuid": "e718edfe-b407-438e-9e86-be9145e9d9b7", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207671, "uuid": "e8c76fca-157b-4046-af0f-3eb2d21f53a8", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBa6asb:prf+WPVXNcwUKaWTHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637207671, "uuid": "fb6607e2-34fb-415c-a679-cbad339e3647", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637207671, "uuid": "1e3c713a-c966-4e31-8e9a-9b79559255f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637207671, "uuid": "2100f9c3-a861-40f6-8147-4bb275b3339f", "value": "493c45da8cc2032c8b873b66a6d747f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114b0a02-4892-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637255273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637255273, "uuid": "692c5fc0-5399-4be4-b757-7eed51a7e979", "comment": "Malware payload (Formbook)", "value": "d85219c8087bc72965678c44db99e3b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637255273, "uuid": "c7b2a8bf-17f7-44ca-a118-e472547868e1", "comment": "Malware payload (Formbook)", "value": "d633685875d97739f172c4868aae568213b9ec8a0c190fe2743e0c8e0e3f312c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637255273, "uuid": "4f8ae55a-fda9-489a-a845-b35af28064ee", "comment": "Malware payload (Formbook)", "value": "557e48b2b27090ba8cc50ba0308f653bbf02d905", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637255273, "uuid": "1ffc4a02-0ca2-487a-b2d3-a4e1c625f706", "comment": "Malware payload (Formbook)", "value": "95167fdfc8ebd3376f8afdd193aa8aec6a17627fba01c231f1bff3f75d48668225183d25f3511a2c017e56e0feae40cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637255273, "uuid": "cdbbf945-7879-4422-aec2-ee220c795026", "value": "T1A8A40169A768873FC1A917F49965F73943B26EE1B825D708BDC078EB3E727410820793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637255273, "uuid": "129d223d-8cb4-49d0-801b-4cd4b4f07229", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637255273, "uuid": "60a2bce5-dbbf-43a9-9986-73418dce2d59", "value": "12288:bl89ZNWP9SbUvXJdnyor9nKhdfQ4mw0ems:589ZU95jnyorg/fQMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637255273, "uuid": "dcccff48-5051-4547-bcbe-5b4fd061ae05", "value": 487936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637255273, "uuid": "084808ff-0a36-4902-883b-57b5d173a58f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637255273, "uuid": "3c66171d-6a3d-4458-9c06-cb9f7e72c2b9", "value": "SecuriteInfo.com.MSIL.Packed.19.16974.17701", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17cdd663-4844-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637221783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221783, "uuid": "83e11899-361a-4385-a523-4893835a7c10", "comment": "Malware payload", "value": "2dfbadc4c4784dd9b857e18754416a45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221783, "uuid": "fcf130ff-8a81-47e9-8c93-a16e75e09daf", "comment": "Malware payload", "value": "d68542d0b188b2f26c83086dd3f604520020a8251a9d938ae67fb08dcb67b97c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221783, "uuid": "83bce8cc-fc2e-4ece-87ba-7154385ac2b2", "comment": "Malware payload", "value": "4d2b5ac94b178404bbcb93de1871f124d2b77e2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221783, "uuid": "7bce1301-d346-47a1-bd0a-5c5754855ebc", "comment": "Malware payload", "value": "dcaa32654afe704016127e96e18c89536f563a0878c46347084a312ca1eca238547ece06937fd5610748a50194214dee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221783, "uuid": "aad50efb-6cd5-4dc4-819b-65cd4f46c88e", "value": "T12A16335059C013CAF698DD1E17DC3B35523FEECF28B4AEE3955283F1040EE89DA62696", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221783, "uuid": "a26fae94-691c-486b-95dd-2ebad0024e9d", "value": "98304:G1wwAjzIQOMK2GNKslgus10Y1/UJ7BdlRbTBAlYVy:G1wwAYBr21uQsJ7vTBAlYVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637221783, "uuid": "f2577234-7c06-4320-8086-dc66af34c254", "value": 4050944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637221783, "uuid": "5de2ffe5-2c1e-43d3-bed1-8a924dda5d15", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221783, "uuid": "b2d26a9c-0d05-4d09-8ac5-22ee3278d3bc", "value": "d68542d0b188b2f26c83086dd3f604520020a8251a9d938ae67fb08dcb67b97c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19989ab3-48a2-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637262159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262159, "uuid": "e241b30d-0f8a-4d0f-8b61-01b1ed905b80", "comment": "Malware payload (Loki)", "value": "1de4ceff8b715d7b4a0593bcb331ce8c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262159, "uuid": "ed17201c-4544-41b1-a9bd-d5b901f555fc", "comment": "Malware payload (Loki)", "value": "d6c088db3038fcd98abbe876e2feb4170d57daa23e93ec65159af87b132d9da0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262159, "uuid": "0e720f5b-5a44-413b-9ce0-724daf2f979d", "comment": "Malware payload (Loki)", "value": "23f7a1c3a6eb49ce2df27a92da3db828dea677fc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262159, "uuid": "c0d1fce0-4269-44c6-903c-046bdb1f355c", "comment": "Malware payload (Loki)", "value": "d4dd5249b473d7869ee4c0baece281b9fa21d52105ff71199865eafa1254445e92d1d564e4cf2f91274740668bb0299e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262159, "uuid": "741567f0-e61c-4102-96c2-506aac706e54", "value": "T18B5246ACC09746588F866BB82B1B9F40018D7A2EF784A5337238977527E6D3B501387D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262159, "uuid": "2193ea75-1ac4-48da-9529-1484e9845d07", "value": "384:o+rdWwqgbfgbmn5kyTc+ZoEWaBm+ob0jcfJeTY4:ooddqgbfg0kT+ZdV0+ob0jcfJez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637262159, "uuid": "3b1d6fb2-c921-491b-b84d-d781722e5823", "value": 13968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637262159, "uuid": "c443d97d-8478-4ff3-ac6c-4218c4fca0c4", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262159, "uuid": "ff1e82e1-d67c-4496-890d-125e534be06c", "value": "items.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b0e063-48ae-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637267487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267487, "uuid": "4a5df74d-9be1-43b8-9c76-1fd46041b820", "comment": "Malware payload (Mirai)", "value": "7afde9e41dd3eb3bba9d2e13639c17cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267487, "uuid": "5c34ab5f-4955-4fa0-9881-01a6da4fbf62", "comment": "Malware payload (Mirai)", "value": "d6f5dd9bd6afb983d6f922e25f523b7a97c98a076e8ebda7a20e1ea35b867822", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267487, "uuid": "f2086629-4d2c-47af-89a9-7b5fadd90985", "comment": "Malware payload (Mirai)", "value": "1962bfbe78dd27f3c7cb1ffd2abac70d73e0c55b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267487, "uuid": "6f1f10fe-7169-45da-89fb-d9525ea06979", "comment": "Malware payload (Mirai)", "value": "763748a6046dd30b65a3ed1561d07eaea08a11f31aa8fc0cfb222bd183324c1be08cb9f1cc117263848091a4e6f616f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267487, "uuid": "39c5ce9d-68a7-44a2-90ba-77a2cdc75211", "value": "T184333ADAB902AD7CF98BEABE80160E0AB23123541053073777EBFDD37E321549956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267487, "uuid": "54939ae5-4364-4eaf-b5a6-a7711825f4dd", "value": "768:mLGOe2kf9e9X9nbenMIvvch9QnAs5gFHviPuzWeHXpi2UJTpDnH638gK:mL/4f8F1e50wYFvimzpZi2UJJnHY8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637267487, "uuid": "b7bff8a3-3cdb-4437-9257-9439ebaa0ecf", "value": 53056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637267487, "uuid": "01eceeaf-3375-4331-bb95-7829007474d2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267487, "uuid": "44e53eaf-278b-4bd6-80f2-3bf017058940", "value": "7afde9e41dd3eb3bba9d2e13639c17cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc0cc34-4872-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637241822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637241822, "uuid": "6b0f32bf-004d-4c95-ab25-c4c506ddabe0", "comment": "Malware payload", "value": "6415be25e090305e57cc0777d65effab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637241822, "uuid": "c02a7715-bdb9-4cd0-9c96-107d5251148e", "comment": "Malware payload", "value": "d96859f7d7a9a41ffc8f221ac3ec81b0097495f5cd8728d4b7bd4fdcdc1db9b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637241822, "uuid": "d9f8ab1b-da72-45b7-a318-902d0fd24ef5", "comment": "Malware payload", "value": "40075bbb03a0e37683c3f80aa8ba3a9d8819307b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637241822, "uuid": "b60af88e-15d2-429d-a7e5-b9dab3dbee42", "comment": "Malware payload", "value": "1ce56c33ff03e85e15ac5842d793a928d5e652cdf00c1219200526dd0b92ed9501d00f6ee891f5891e6cb010a5dfe5ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637241822, "uuid": "2ca436cb-e59b-4885-bc11-bcaa670d472b", "value": "T15954E141A3F588B2F98F0A7B46B5D6BC4A3BF4706B6640CB8DD23E4E8C5E6C15D30925", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637241822, "uuid": "3aaa159d-2daa-4dbc-9e30-552744e09b73", "value": "63a806c199e422807de783c1c09b5907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637241822, "uuid": "cc665632-b25f-4f75-a6c2-12fbdb85778e", "value": "3072:xN1jfAAWW0NZvvJCmw134a6XtXarF/pstBaDqwONnct437Bl3N2UL8:xN5YLHJCt134ao8F/p/uwONct43j92U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637241822, "uuid": "f7546a95-a5f4-47f5-906f-9d10d5a96b71", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637241822, "uuid": "740a1770-f854-4c10-87b4-f31a610ad615", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637241822, "uuid": "fa7cad49-ff1d-448d-ba87-158468fb1a1c", "value": "supremecode.ttfgh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719a00ac-4894-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637256293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637256293, "uuid": "fda76163-a800-4a72-a373-8cd558e3cab0", "comment": "Malware payload (RedLineStealer)", "value": "53011695d27b9656a98cec0dd36f956d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637256293, "uuid": "244b85d8-c753-42da-a463-1904815f6d11", "comment": "Malware payload (RedLineStealer)", "value": "da135029389539d12242cda1c0aeea705cf93614246cbaca64b3544728c62752", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637256293, "uuid": "7a3e76d1-ae4e-42a1-8d50-638480c10216", "comment": "Malware payload (RedLineStealer)", "value": "46530626cfb988a550d546d40738b623f3756bef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637256293, "uuid": "f68e6cb6-8037-4d3b-91ab-b1576762ed11", "comment": "Malware payload (RedLineStealer)", "value": "4ea10ee07dd5dcdabc0fc06e194f4763d8ce618f6bdeed4c9615acc3544a940945f9ff478744bf5f6d426b31ea06e7ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637256293, "uuid": "0b8f6243-1159-4cd1-bc27-5f407a11adcc", "value": "T1ABD53341656C3EEFF2AE0332660BBC8D74FFB9BB46D191EA0538D7A50364EE78522015", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637256293, "uuid": "49fad4c4-f6b4-47de-9abd-ab292f1b970c", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637256293, "uuid": "7c63ad6c-b9f6-40b8-9e76-5de9899ef704", "value": "49152:bLMozUbOvNBhlzsD7J2koZLTNgRfC5x7BTjyihpy8u8dGaf72:X7UuNNsf8LZU8x7xe00z8dGaf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637256293, "uuid": "f798efb6-bd5a-43cb-a232-7f34eaa7d788", "value": 2870016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637256293, "uuid": "f8a3cd13-614e-4943-ba2c-189f703937c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637256293, "uuid": "fd4437df-f679-4c99-8f59-8830ab9ec227", "value": "53011695d27b9656a98cec0dd36f956d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6bff4f-4826-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1637209017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637209017, "uuid": "28fb075c-3ebf-4c44-bd63-1557f0b04c75", "comment": "Malware payload (AsyncRAT)", "value": "1b07fe1263ba5f1b86b09c9b27c1f4de", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637209017, "uuid": "6e7b3e04-fafa-41ee-83fd-7792e9e32b9b", "comment": "Malware payload (AsyncRAT)", "value": "daf842129f0a574f2f5cf1147d40ab8e4596b88b9ef228a4516cef5326f8f1ad", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637209017, "uuid": "add35c44-af6b-4695-a5de-0e3ad7d2342d", "comment": "Malware payload (AsyncRAT)", "value": "9d18786ec6506ff4f85e6c7a055828898fd59a27", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637209017, "uuid": "807345cc-a899-4317-82a4-4cb31747142a", "comment": "Malware payload (AsyncRAT)", "value": "cf5ed39b701bc009e90ff1410d7aeb86880a827be3bd34650e9d3c3ce310d6fab08375168320bf932ca80890fd8ec2e4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637209017, "uuid": "6f814358-ddc3-461d-a2c3-b2b77bd4a595", "value": "T19664D0353F98DA4AD635463ECCEED86003FCB8166962C71E7FCC23AE2D12751186169E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637209017, "uuid": "6fabef94-9540-4393-8497-bea917b6da5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637209017, "uuid": "dda699a4-b068-450c-8738-3eb34e6cd16d", "value": "6144:oj5yRQVJSMtrDn0OH80gRguSaMkOKOt4n:oyRQrSMtD008VRguZHOXt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637209017, "uuid": "4fd58053-8b7c-4b40-a443-193ef532e849", "value": 323584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637209017, "uuid": "9df001c1-3b19-41ac-a535-4630c98e2c9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637209017, "uuid": "465ebddd-ead7-4a96-b4de-765b1e518217", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4d797d-4868-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637237607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637237607, "uuid": "f79295a3-0300-4f75-ba7e-4bf59317eae2", "comment": "Malware payload (AgentTesla)", "value": "7b5acb7ccbf4001ab92104941d9c3d20", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637237607, "uuid": "2953764c-78dc-4581-878b-9828403c2fa5", "comment": "Malware payload (AgentTesla)", "value": "dbba7dd4355342a19336aba7d468ecbdfb0d730287e8f8f28ed88ba445bab2fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637237607, "uuid": "b7442d21-d1d6-49be-aa50-bd8464dabfcc", "comment": "Malware payload (AgentTesla)", "value": "69aca0adc727ab35be243a20e14449135dc49a8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637237607, "uuid": "e0761aba-8a59-4fa5-b592-213c7f72b00e", "comment": "Malware payload (AgentTesla)", "value": "b226e68c67778694f747fbdab318dd5bf94402c4bc36100441e599cfd9f786df29c57cd6b90a6cdff63d6afe99ee04ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637237607, "uuid": "c4461158-b52f-4e9c-b726-85ddbc151a9b", "value": "T1C0A47FBC7A414A72FD1ED170AD510AC8BB670B036280BA9657FB15CA874F0F76E45CCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637237607, "uuid": "90eb26e2-8717-4de1-be96-71cd2ef75e33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637237607, "uuid": "5e330b05-dde9-44af-93ae-ee23476186a8", "value": "12288:hcUEeLhhAdIXlI555o0KjZ5VDZEJzun/K:txA55ZKjZ9EQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637237607, "uuid": "ac1966f0-afb9-41d9-8de4-520bee101b18", "value": 483840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637237607, "uuid": "9d57c95e-e28c-413c-b955-592b12bc959c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637237607, "uuid": "6f82ba1f-f898-4b36-8c61-06f90cbe112c", "value": "LINE-MR-CI-A-006_Analyzer System.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a951d80-4870-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637240712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240712, "uuid": "05008204-ddef-4363-bce2-cb9adb01deca", "comment": "Malware payload (Smoke Loader)", "value": "a535cb4f8d7e32c778a9ba56f18615bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240712, "uuid": "9c23d096-06a4-4b98-bc26-94182075ecc4", "comment": "Malware payload (Smoke Loader)", "value": "dc329e46471d9d96a8a600c89189635e053f966e1ee73b4136c686b2bb9c4be9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240712, "uuid": "348d57ea-54c8-4d87-9237-3a1dc9624aed", "comment": "Malware payload (Smoke Loader)", "value": "6a7154d8773aaac49e201b4b48a80ca289aa7717", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637240712, "uuid": "a93bc3ec-476e-45ac-8500-7bc3a80a583e", "comment": "Malware payload (Smoke Loader)", "value": "3025b4324bf0109aead8943805232aa2f424bfbe4c148a152f707b21ee156cef00e2b23e87970672941938cec29f13dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240712, "uuid": "17fcb1ea-4657-4649-9d20-931a2fe13ac1", "value": "T1CB548E10B7A0C035F1B712F849B99378B93F79B1AB2494CB62D516EE4639AE0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240712, "uuid": "b989bd58-35e4-489c-9ca0-a6675c31efc5", "value": "323504891562b22c6999415c44b3f208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240712, "uuid": "f11902b1-50b7-4e5e-859f-0d98b1db1338", "value": "6144:rORkMnnyZ8+u7ZOIB3beOgBj0Jjo4zwBg:yqMnG8vOIB3bejSjo4zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637240712, "uuid": "06ce7f42-4808-498a-9d7f-286f2875d4d1", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637240712, "uuid": "97feac2a-395e-4654-a777-01d724317444", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637240712, "uuid": "debda921-06ec-4de5-b91a-8a290472d13d", "value": "SecuriteInfo.com.Variant.Babar.29261.28155.8318", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e868707e-485d-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637232870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232870, "uuid": "32938807-c8f1-4e8a-9d5a-1d5aac4a90e4", "comment": "Malware payload (Heodo)", "value": "a14a871536ddef5619cfa1a5cae7cf56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232870, "uuid": "a434e5b0-7b92-4143-8458-865daf31528d", "comment": "Malware payload (Heodo)", "value": "dc71db356eae4c5cc01f1d753790e6803326da5c0b633901b9aa69debabef9a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232870, "uuid": "efbc77a4-a0c3-4fba-931d-4b19c53ece4c", "comment": "Malware payload (Heodo)", "value": "ca70825d2c11c978f1281fe887ef8f6e85989c31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232870, "uuid": "194facbf-6e5c-49e3-a295-6900a9231eaf", "comment": "Malware payload (Heodo)", "value": "8c1fecf0fbb5d78fd0d8cdb233fffa9ee845b4ef1488bb0f50a72c563c09b94a071da9e390561fecccc7358bc707fe20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232870, "uuid": "551b0e87-a39f-4140-84aa-6c6cb5547448", "value": "T1A044BF10B1809032E8BE593645FAC56A4A7D7A600B94DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232870, "uuid": "a1732be5-e47d-481d-9d2a-38fda24aafcb", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232870, "uuid": "11f7ccd4-629e-4df3-b84c-a0b560d7f0f7", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTB26asb:prf+WPVXNcwUKaWTXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637232870, "uuid": "f5647b44-e3bd-41bc-a0f9-0af482bfa1a1", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637232870, "uuid": "acc99a56-846a-4de8-a95d-cecbe60ca7d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232870, "uuid": "9b91029f-6e98-4a80-8aca-7184ec41e8dc", "value": "a14a871536ddef5619cfa1a5cae7cf56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6724f2f-48a1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637261992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261992, "uuid": "a2efd0a0-0eae-455f-916a-e88c89661dfe", "comment": "Malware payload", "value": "99990c9ce70adce0c69d9bbc1d9f5429", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261992, "uuid": "6dcf5239-ed9c-44bf-bbcc-5e1ae320a829", "comment": "Malware payload", "value": "dc7cb47e88c04283fc251bec4cc4d250089bcd02cd601528598311dd9cf5ca73", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261992, "uuid": "2c2a99a5-8e11-43bc-ae51-b1c8e96c6c2e", "comment": "Malware payload", "value": "964eb5900a79eea8bef1d99d9837bba4cf1faeae", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261992, "uuid": "76f42edb-82aa-4545-89bb-f99ec49bd772", "comment": "Malware payload", "value": "a60453727c4770ce34b1aad590315956d0c63906b45b13278e6292f073501f8ad6cba635cbdf4448444fda911b572bdd", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261992, "uuid": "df778640-ad16-4374-8703-2c006f4dbc53", "value": "T16D25AD23F2E14537D0733A358D5FA365AD3ABE106E3868472BD92D4CAF3568079262D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261992, "uuid": "e8f46333-09bf-4872-b4aa-116f768a8e53", "value": "24576:oAOSjF2p2CW5AZxRsth0nYCL/aU1tfeTU+P4e5GY5ASA:oAOIYethMYZTPPDGY53A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637261992, "uuid": "7698bf3a-9d47-4f9f-97e3-3e46ab179fc6", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637261992, "uuid": "7c84dc5a-bc64-4212-98cc-35f0d6b0220c", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261992, "uuid": "9c88e01a-fcca-4ebe-8d8f-4590a2eb83cd", "value": "ArchivoFacturaFecha17-11.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a97d091-485b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637231854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231854, "uuid": "7cb9a622-02a9-4841-8442-475d15aedf28", "comment": "Malware payload (AgentTesla)", "value": "22afce4b9fbc107e3ba7b7458e6623c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231854, "uuid": "30528c00-8c5f-4c8e-acb4-5f0332eaa841", "comment": "Malware payload (AgentTesla)", "value": "dd2e67109ca177d54b1727b5e364c9af99c2c461e0ee27dc31dafa045da963cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231854, "uuid": "ce47214c-92ee-4a81-b3d8-c61101b5a8ae", "comment": "Malware payload (AgentTesla)", "value": "4c5c273225cfaceccb316dd4913651e2f8b732d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231854, "uuid": "99999edc-c81a-4072-bc4d-29d882cfb37c", "comment": "Malware payload (AgentTesla)", "value": "5525c240f1e56b8aa31f77c9cdb936709e77b1e997d3ee7a65867a30a55f5c272700ebc29dee33e6821cf95689287eec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231854, "uuid": "68b63dd5-7dec-44fd-bc74-968cbbaa0573", "value": "T185D459F5AE830F1DF92C3A7106E7CB5C02E69CE5E631B0AEAF50B99912B25F50241D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231854, "uuid": "e01c801d-5770-4f87-8a5d-65849f24f078", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231854, "uuid": "c1a97b0a-f67f-4e95-92aa-780960f49f60", "value": "6144:D9xKU3rtsD1/O4JsJ04hQoAYHLu/YP98WyOFo/0cD3E/HPExvBhCdhHFTbv+qsTd:Rgmht/rFyfO+/bofsHhShHtIuLQe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637231854, "uuid": "3768b279-b779-480d-83ae-2d213be70683", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637231854, "uuid": "004a1b1b-dbfe-4a66-9d08-eb41bfed527f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231854, "uuid": "7614a243-de1d-4d23-b44f-6160e64bba89", "value": "22afce4b9fbc107e3ba7b7458e6623c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f136557a-482e-11ec-843c-42010a9c0014", "comment": "Malware payload (MassLogger)", "timestamp": 1637212699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637212699, "uuid": "52bad44d-b36c-44e7-b03d-d3dc8aa9e5ec", "comment": "Malware payload (MassLogger)", "value": "613df2745797bf08615fea4f31cebf65", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637212699, "uuid": "6347ca8c-d8c9-450b-a026-70ce0bb607fa", "comment": "Malware payload (MassLogger)", "value": "dd65ffa832c30dea6dd2ffe55526095958124c71bafbdeaeeb15e73515c12425", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637212699, "uuid": "e149138e-397c-4aa1-b619-47509de531b3", "comment": "Malware payload (MassLogger)", "value": "9e62a197cce1c8bbc993dd31cb46a954de0899f6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637212699, "uuid": "0360c301-16b6-4144-b2ff-6ce841212483", "comment": "Malware payload (MassLogger)", "value": "e770f67c55f67dcd1de9112e6a3d6064371d81cfbcf7c28c87286f192b9917e0c52d7a3a065013ef3a61c285c2f8b4c9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637212699, "uuid": "5ffee9bf-93f4-4aed-a21c-e81fe99f3425", "value": "T1B6641B267AA48A11C28D5A35C1DB6514C3E3C9D66237F70A398C13D61D433EEED8E6CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637212699, "uuid": "e1d02586-a316-4600-b45a-63e184030c90", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637212699, "uuid": "0254d940-4682-40b3-80d0-f7199af35c30", "value": "6144:uiK/3jCY1218pYVKYRtpCyDxNnkeXZ61cDmOmZz:NKPjCYI8pYVR7pDLnkXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637212699, "uuid": "0337ca93-eeec-4d34-901c-dbee6eebff97", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637212699, "uuid": "e0393bb9-8abd-4531-81e9-67ca285edcb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637212699, "uuid": "7e3d4236-4e99-4e69-b8c4-4c6a5b6920dd", "value": "download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c822a83-4883-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637248876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637248876, "uuid": "dcd7bd62-2912-4f06-b49d-2ce3182bf388", "comment": "Malware payload (Dridex)", "value": "93ca9efb27196dfe6a0c57b46533edcf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637248876, "uuid": "44fbaebf-ef83-4094-95c1-a804dc50630d", "comment": "Malware payload (Dridex)", "value": "dd8ac82effcb27eda36f0792d7ff5d50c66bca2c20386c5dd25565970f8234c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637248876, "uuid": "2f44be1d-825c-48f1-9a64-8b1917c24a57", "comment": "Malware payload (Dridex)", "value": "a01daf49a9bf3f3fbf32ffb71034a1c8a1280ea6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637248876, "uuid": "d22d1773-4cdd-4e21-93d2-9956fd5fc698", "comment": "Malware payload (Dridex)", "value": "e1776c9252a78f6364a7df96b818d9ef2dd125f48c5cc662e10c93169feed81429d9583e284104be9940d3925ffa8cb6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637248876, "uuid": "1c0f29b1-4ff5-4b8d-b027-4169a0c34310", "value": "T1E7E48E0250D512FCFA898ABF155A67C1C6B310824ED1CB9E25CD07EADF64A03EE6D1B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637248876, "uuid": "42889b06-175b-4e6d-bcdd-7d7c77a7edab", "value": "fe16443ce39f2fcea9c5accdb27a9eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637248876, "uuid": "0bc47b66-1484-401d-8814-8d9432bd1f74", "value": "12288:WZTlJzJzJBJZn/JH3lJxJLJZJdPgA1VKBUA1rlldXJw:WZJtpDv/lVbdT3IA1wBUA1rlldXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637248876, "uuid": "626a99a4-eef4-46d1-860c-c3907af215c0", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637248876, "uuid": "735827a1-e932-471d-88bb-c08dc83be4a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637248876, "uuid": "01df3126-91e4-4d68-a1ce-1aa15eb0a8fe", "value": "93ca9efb27196dfe6a0c57b46533edcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8bef86-487f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637247428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247428, "uuid": "e20d83a1-6298-475c-8b7b-c44c0055f764", "comment": "Malware payload", "value": "3f11850012bc3c2878ae21d1ee673c36", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247428, "uuid": "af6d72f2-d908-4100-af5b-023043f70731", "comment": "Malware payload", "value": "dd9209350b4ae58e46c0d1eb88524603cbdb0abbf4812f4bb6250ee4606824d1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247428, "uuid": "ebccdd78-4690-4404-9c34-ed813e80ca2c", "comment": "Malware payload", "value": "e0b35b661c02feaa415136b79ab0b66477c26229", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637247428, "uuid": "4b8ee753-64ba-4fe6-90e8-60a57bbc1f8e", "comment": "Malware payload", "value": "07176b58dabd97c2016242bb00d4dfa90b09b9734c3a0af8b2fb4403222e96fc6bf579e63af055eb45b299f0193708db", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247428, "uuid": "c7fada54-ed42-4388-a1c5-de1592b2c692", "value": "T15A81FD3F19F0F9248B68DA63DAA96E5CBC815F1FD21D60DF7989540E0B1D2C088D1AD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247428, "uuid": "e370a1b5-3b18-45ae-83e7-c03d1fcc22c8", "value": "96:JoFaxBFpTh+w2ZOHQyiMSo9Ry8fzayasvpqKve:JoFuh+w2ZOwNzMRVzaYRvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637247428, "uuid": "d15a6df0-6032-456d-a1ad-eda8b47e62f2", "value": 4185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637247428, "uuid": "fa65ad99-ab63-4cb2-bb08-56332dba8d74", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637247428, "uuid": "95c40f1b-27a1-45dd-8b0d-6c6b2c0c4495", "value": "0x0006000000012182-58.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c153196c-4819-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637203599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637203599, "uuid": "c5450d00-5f75-40c2-91a6-8a3f8d3b9fba", "comment": "Malware payload (Heodo)", "value": "38b4e51544b4466ac0d530d97ef24dfa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637203599, "uuid": "e77db92e-e78b-4b4a-9ba5-cf2ca9bef20e", "comment": "Malware payload (Heodo)", "value": "df25a12a306b10f74c3f34357a2d32785188c4809f595be59bae26ef95791b65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637203599, "uuid": "d46472c4-6287-402c-87d2-94fe9633a6a9", "comment": "Malware payload (Heodo)", "value": "a65258ae0f95cbe1860e7787068270e0a738ef58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637203599, "uuid": "e240917c-3669-40d7-ac25-eb84ce32646a", "comment": "Malware payload (Heodo)", "value": "d304a4db77a12948003ffe61bd038525720a928e2b065d69f89a10499d4322ce1e9f6f8bd0771fd0e93f7d8d914e1027", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637203599, "uuid": "f42658df-e129-4717-9daf-ad65fd6eb1aa", "value": "T1D944BF10B1809032E9BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637203599, "uuid": "bdfe0458-2e11-4a69-9038-593ff61a6e93", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637203599, "uuid": "7e8ee04a-177e-40f1-b455-d6fb3d49cc51", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBK6asb:prf+WPVXNcwUKaWTLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637203599, "uuid": "48485b16-6ce6-4d55-84b8-11f477440728", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637203599, "uuid": "fe1dc42b-30f6-4f9c-9093-855530d6d8e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637203599, "uuid": "534ccf5e-084c-45a1-9341-15a9afb896c8", "value": "38b4e51544b4466ac0d530d97ef24dfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf106f07-480b-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637197582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197582, "uuid": "87eb8dde-aacd-41d0-8a41-d8585aa3629c", "comment": "Malware payload (Heodo)", "value": "cc552e91b7ddc05ca07fb1a8ec10e573", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197582, "uuid": "d46e4101-e139-43b0-b52c-6557f22fd429", "comment": "Malware payload (Heodo)", "value": "dfb11bcf19316d133ea9621683fc6a1d0f686da4bd2b39a5a28604d1c08d4321", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197582, "uuid": "613c3a29-4b3f-4f24-b675-0d103a4af47b", "comment": "Malware payload (Heodo)", "value": "d752c2e2830aa320b61966ff8087020c33d97cd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637197582, "uuid": "d089bfbd-9eaa-4e20-9f6a-cbc505423423", "comment": "Malware payload (Heodo)", "value": "041aaa89c8a11a6c8089a7eb65ac543eb3a08a016708841d41529b51466970ad44e1c84e41cc6e79bcc221089037a9fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197582, "uuid": "bf9ce32c-2a15-4c94-8289-b8d9c7ef846e", "value": "T1A144CF01B280A072D9FF193A85F5C66A4A6C7A500F90D9CF53D80DBE5B765C2B6309EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197582, "uuid": "c8e3592c-a4d2-4af8-a250-eb1406cb2adc", "value": "822ae775303d14fd9c529b33f0deaf77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197582, "uuid": "b723d9d0-2f5f-4ab0-8a7c-937a47242ed9", "value": "6144:ndH09uYgR7OJSuwuZc2HEaYTy7beWTBdom:dHJtlec2HEaYTXWT/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637197582, "uuid": "f96a9166-fc1a-481f-9ac5-fb4cd44ab259", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637197582, "uuid": "1e5c660f-4415-42d4-b745-91c98bcc2399", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637197582, "uuid": "e835153e-2f7d-458a-863f-cd7f4c6d786d", "value": "cc552e91b7ddc05ca07fb1a8ec10e573", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114a22f6-4803-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637193855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193855, "uuid": "f99e5823-1886-4409-88e6-eb0bf4ed071a", "comment": "Malware payload (Heodo)", "value": "047cd4c84b7db570263b9271ac8ee389", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193855, "uuid": "068e4089-f8bc-4fc0-89a6-b9bd29a99a7c", "comment": "Malware payload (Heodo)", "value": "dfd06a70944944bd404b0c2fa663c09763f3e297201f5fd51dfc49e97711da9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193855, "uuid": "1c8a9b48-93a0-4766-bc17-621a7f0a9799", "comment": "Malware payload (Heodo)", "value": "c8bfa361c6e4ee34035e3c8b351e65d9beb50b05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193855, "uuid": "1238e584-5c5a-4be1-bf69-b18c7568d58a", "comment": "Malware payload (Heodo)", "value": "a03de45fecdff0873c6d3b05d01fd572fc835a90f6aa6e8b3ad2d2bced00c644cd3f9e3423325ad3b44780abe28dde0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193855, "uuid": "c15636a2-ea59-48c7-a28a-366282b78962", "value": "T1B844CF01B280A072D9FF193A85F5C66A4A6C7A500F90D9CF53D80DBE5B765C2B6309EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193855, "uuid": "40c6a290-bd75-417b-be25-1fe14910bbd2", "value": "822ae775303d14fd9c529b33f0deaf77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193855, "uuid": "c8ffb19c-59db-4b95-8936-7e5d84f0a0b2", "value": "6144:ndH09uYgR7OJSuwuZc2HEaYTy7beWTBdcm:dHJtlec2HEaYTXWT/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193855, "uuid": "5929dbf6-4fec-44b7-a50e-e4d85c95fe95", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193855, "uuid": "14e01baf-c16c-4d3c-be23-d1b4b0d2a64b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193855, "uuid": "12a1389e-5b10-4f63-b34e-70722bcca032", "value": "047cd4c84b7db570263b9271ac8ee389", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7976015e-4838-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637216793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637216793, "uuid": "eca39ff8-4c8a-4160-9e03-3ea59f3f6143", "comment": "Malware payload (Loki)", "value": "0f462bc5f2e2275414d793a3631859e0", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637216793, "uuid": "62965547-6601-41d7-aad1-cab1be09c234", "comment": "Malware payload (Loki)", "value": "e12cc1a29d720326a77abb84fbd271ddcaa7d1d34c33b987cbb9b6c177969b12", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637216793, "uuid": "5a5bb13a-3389-4364-87e9-da8737187828", "comment": "Malware payload (Loki)", "value": "1333f3d3bf2b57443a18296f752ae41b0c9e3661", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637216793, "uuid": "38e136be-49c1-44f4-8b4c-00117bd23240", "comment": "Malware payload (Loki)", "value": "c2e76d4a3bc9a9bd783dce729487f9cd7912c20ba69f4feb0cd83b436b4717af18fd4da2347a05b8f95f8da7309f15e6", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637216793, "uuid": "74ab59ec-675b-48a5-a98a-940a0f4e4608", "value": "T1793402D9F8BB915FF1F0033AAF0E40271678EF8590A1643659D53B2B1BFE660A11C369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637216793, "uuid": "88cf3101-1905-4b09-9a68-a69fe71257af", "value": "3072:yiwpj3dJn433mO2u3vlQHJnuolkKUs6Ifr2EI/DFhOZE//xLZbN8WZfcfItUF7cR:7wpj3dF23R2u3I9rJs2ZwZR8g2gQvp3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637216793, "uuid": "bc1e9748-2adc-47af-8703-5b1582d17b17", "value": 234456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637216793, "uuid": "868dbfcd-7cb7-435b-bd33-e09590273db5", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637216793, "uuid": "2044b94f-685d-4b03-951e-20ffc8641b68", "value": "DraftXshippingXdocsX08798.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57990592-4897-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637257538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637257538, "uuid": "0128c891-4e3f-4afb-9844-26511d659364", "comment": "Malware payload (AgentTesla)", "value": "74199fc3591c3e7c7a8cd494b50b2cd4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637257538, "uuid": "c4671f5c-9cf8-49b5-83d1-283bfecdb4b3", "comment": "Malware payload (AgentTesla)", "value": "e1431da8d32f695c0e2cc9b5dfc0d4176c271fd6255f8241b7076205c72cf3a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637257538, "uuid": "32b3b2d2-6641-4321-9950-8b24e3a55fdd", "comment": "Malware payload (AgentTesla)", "value": "c5c69315540b3686219f95a80729db034acd85f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637257538, "uuid": "e7d45588-23e7-441d-b03f-46d94e2cd98b", "comment": "Malware payload (AgentTesla)", "value": "4f8f13fc20275ba45845e1ec0788a050dcc13b2cf4a42c4fb3c66caff86601bfdff891863e7c5e7c7d2f23facfadd346", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637257538, "uuid": "2489e0b7-f7a6-43d8-ad59-5f13ee660b39", "value": "T172B4012653A8CA3BC2BE17F89675FB3807365DA06C65E214ADC178DF3EB17810861793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637257538, "uuid": "52bec130-9c6e-45d1-9c69-2f5737567067", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637257538, "uuid": "5936ba11-0bdb-4eda-a4b9-6de180e455f2", "value": "12288:OA9Z1WnzfF+9Eai5C9LYW1c+wXsm9uN3B6MWa:/9Zozo9EVgLsB6RQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637257538, "uuid": "1e4f5382-4abf-4545-ba2f-bcb2f6c724fb", "value": 541184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637257538, "uuid": "35e0a3c1-a44b-4b71-941d-1aa1951f9b04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637257538, "uuid": "e8b22341-ec37-4ce8-b0dd-fec1ebf87891", "value": "Nueva orden de compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec2346c-486e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637239995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239995, "uuid": "259a8e3c-a43f-4fae-9257-cc50eeb8ec35", "comment": "Malware payload (Formbook)", "value": "6ae1bea4f4c5b2c492d1783df7712a8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239995, "uuid": "d9014feb-ff23-4e0a-895c-fa9c4d8cac7c", "comment": "Malware payload (Formbook)", "value": "e194070816893a21e24161a8d2d86179ee9d126cf33274883e0a43e834d6a328", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239995, "uuid": "36c7aac4-2ace-4c02-afda-fd281d04a8c7", "comment": "Malware payload (Formbook)", "value": "df3c0ecb8758ec86ff061c084f84239561c16db0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637239995, "uuid": "6dcd6cf3-990a-44d8-a3f8-4d87a52d7e42", "comment": "Malware payload (Formbook)", "value": "e8171dfdf011d7f03b59b9e15b52463e9f5e226eefee8c3c83ede3c2daaef2ef2a86623d4bba80399d3e0563785c3943", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239995, "uuid": "7c35a4cb-fec0-48ba-93d7-a7726dbbbd0a", "value": "T1CE541246E4C5CFB7D56B1930632BC3B987BC87A506ABA9460F903DAE2E17017321D1A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239995, "uuid": "04b84f26-7555-48ed-8499-a2e8a6a43dcb", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239995, "uuid": "f8a454e1-d771-4636-bbdb-3b4886e495d3", "value": "6144:rGiOVk2VEaDowK/5C4r8ALZznfK2pN4Krq9fNmr1o5:yVZMw8co8+nfK2pXu9fNmZo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637239995, "uuid": "0be4176a-c0f9-4165-ac55-4057a35050db", "value": 298793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637239995, "uuid": "13b63d50-9cff-4f19-93b1-01bf4cd5e56b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637239995, "uuid": "0739c288-862a-4db5-ae73-ab68c3a73ae4", "value": "Order Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f9aaf7-48b4-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637270145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637270145, "uuid": "ad849d64-e6ac-43dd-b11d-bd63ad88b92f", "comment": "Malware payload (Heodo)", "value": "b175682158ee023a48d49fd08bfc915e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637270145, "uuid": "e2b08613-acea-406e-9160-65c2a3ecad2c", "comment": "Malware payload (Heodo)", "value": "e2af43bcd3de5a6e98519a5e3e026b790fd4ff1c70abf006ed45594708da7eb3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637270145, "uuid": "4b070c3b-9294-434c-823b-22ba320c9bed", "comment": "Malware payload (Heodo)", "value": "a1357675067b82e282d0f5e38c75aa2fe21d55a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637270145, "uuid": "a575f1c0-3165-468e-be13-6269ad208074", "comment": "Malware payload (Heodo)", "value": "6bd4e5e9df25106e84511d19c4b32fb6dcd629cbe2b6e6f78db402e2120138d2c61575eb1faa88dae008fc696c4f9fe2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637270145, "uuid": "8b5a9ef9-da99-4e2b-9bf5-b28dc31b54d4", "value": "T12FA4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637270145, "uuid": "fe535aaf-cebd-4aa6-9837-9bbade38fcf1", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637270145, "uuid": "2cdfa86e-cb7f-4033-933e-b2ad18a5b82a", "value": "12288:bdv8jkvzqZvv2wLBQmTi12yD88kYwZ1h1:b2Zvv2c7Ti1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637270145, "uuid": "67aacc25-6978-4554-8a9f-fa5891193623", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637270145, "uuid": "1ac71131-269b-4b4a-ae9f-b9763deccbe9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637270145, "uuid": "20125541-d33f-4ab0-a6d2-c58767bc8b3d", "value": "b175682158ee023a48d49fd08bfc915e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f464bed7-4868-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637237615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637237615, "uuid": "568b886b-361d-47a0-a1f5-a872089b292e", "comment": "Malware payload (AgentTesla)", "value": "bc027b8a77831be88cd5337a5b6f7b02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637237615, "uuid": "b7f518f2-d2c8-4a18-a3fa-187cbcdfb8de", "comment": "Malware payload (AgentTesla)", "value": "e31e440c5c9ead32744cc40730f22d0470b36416b428a4a14fa7d6f9c7af5499", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637237615, "uuid": "03f054bd-e1d1-4f12-8706-4d0c54c19701", "comment": "Malware payload (AgentTesla)", "value": "54f82a484dad62ef2d18cd3e926ad63b20a64fbc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637237615, "uuid": "4f49f0dc-8cce-4c2f-be8f-ccce603a1b91", "comment": "Malware payload (AgentTesla)", "value": "53344c733907d460ee57722d09073171917b1f32cb23d3ae7be72d3d0003905a7cf2c43df87ea5b668fa0faa420369a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637237615, "uuid": "f1b02b81-1f85-4816-850a-d4450f883e3f", "value": "T17DD4E0A036B8D417E36080B6C6B0D3BE4FB1B16D1ED1C6427DAE6ADF7659760BC18312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637237615, "uuid": "59e0b519-47bc-4dcc-977f-77dd4d30b89b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637237615, "uuid": "a3bcd0e9-f59d-4f18-96c0-279ebcaa4c11", "value": "12288:xBm31gW7ZbVwdtWKHrEnAcXs7L7ei+JXA9/GX2Gg/JoPYHu:Dm3KWQtWuAnAFzeFpuJQYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637237615, "uuid": "82905861-24b3-4394-a7ac-46ff8e88184e", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637237615, "uuid": "e67657ba-938e-491e-9092-6ae3293c5919", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637237615, "uuid": "f415fb48-be59-4a4b-8ca4-0804db9a402e", "value": "17869 [Order].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad9be82-489d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637260013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637260013, "uuid": "5f06a9b9-1a02-4b6f-8dbe-71c6d302abd2", "comment": "Malware payload (RedLineStealer)", "value": "e06d45e85ecd10438afef366af60e565", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637260013, "uuid": "b2d15cc2-2df7-4062-be58-ca6c18a200b4", "comment": "Malware payload (RedLineStealer)", "value": "e34fc70bee3b2e9051e1115f1053aec2bbd3555a8d71600e90890662ea718ff1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637260013, "uuid": "15b21cc7-5873-470e-8cae-519ea3920c12", "comment": "Malware payload (RedLineStealer)", "value": "67c9c65cdeb6c13822626c0328e9ee5f277ef3fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637260013, "uuid": "b808dde5-2613-4d84-9c46-5d594aea4fbe", "comment": "Malware payload (RedLineStealer)", "value": "8ba8453dba2a23cabb64cbb1ac21b2069f6f0db08e37993f4c873f1c438fc66b2c23bc76392e8bd24056c5f4e544d5e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637260013, "uuid": "8b05240a-5d50-43d5-ac7c-ac4db8533ea8", "value": "T1B5646B17B1A0C0B2E5728138D96266B5BA767C34C7209A9F57943E253F333E09E3DB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637260013, "uuid": "fe0c1774-31b4-4a79-b231-c5238810cb4f", "value": "7540558fa72fa016d4698897060e1c52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637260013, "uuid": "d42f7fee-dc79-4325-b99f-3cd5ff7cee31", "value": "6144:FOxA/38dLEea0RWY52Vu/fWIJsuNG4e3Z4htvIUzqOadXtx7pWToo:FV/38doea8WY52VRuNG4EZ4nZ25XtmTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637260013, "uuid": "e672d0e2-aa7a-47e5-80e4-775ccf17db79", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637260013, "uuid": "edfb770a-e4ec-4888-b0f9-dc61a696c272", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637260013, "uuid": "b7f8d442-088f-490f-b54a-092bf6ec6a7e", "value": "e06d45e85ecd10438afef366af60e565.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba4b72f-489d-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637259988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259988, "uuid": "7abdec39-8b4b-418e-91b3-c4b691bc711a", "comment": "Malware payload (SnakeKeylogger)", "value": "d5a4d17565423ca32ac76d80b935a2c8", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259988, "uuid": "3de14cf9-1631-4ee1-b96a-7dead70d511c", "comment": "Malware payload (SnakeKeylogger)", "value": "e3e08bfeccd15e15f039e47375873f986315a1e5d37a429b44e9cfca2226bd6e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259988, "uuid": "8c1e0c89-58b9-4c01-9f24-b26f69890ea1", "comment": "Malware payload (SnakeKeylogger)", "value": "163691eb27ff29cf438b8a3d9342591e7a8bb352", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259988, "uuid": "10b35d5e-e955-4043-9e67-104ed7436c87", "comment": "Malware payload (SnakeKeylogger)", "value": "71864a284d4342de951c0044a40553a794291227036c462863c9be6a255ab66a53615211f576eb7418fb0a35ec834940", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259988, "uuid": "23634295-3cdd-49bd-937a-0be4c2902ccc", "value": "T1D5C4D0903AB8C413E73085B6D6B0D2BA8EB0B16D1DD6C6427CDE2ADF7A5D7607C58312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259988, "uuid": "9c51df1a-48fa-4b45-a4e3-40fad615080a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259988, "uuid": "f0effe8e-c130-49d0-9592-b1da44776f32", "value": "12288:R/Om31gW7/LkFz9g8iteQQMi5n4pEaM4CGR:R/Om3KW7YFzWFzwRaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637259988, "uuid": "ecb02a7c-0107-49e3-a6d6-48bdb14afd1d", "value": 561664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637259988, "uuid": "773e8d69-7fd9-411f-8f37-726483c0be94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259988, "uuid": "f2287495-84de-46c6-854e-c5131c337d79", "value": "DHL DOC 74653898.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5895d739-487d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637246373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246373, "uuid": "0ac1e906-dfb8-4bd5-88ba-bd974d08eb20", "comment": "Malware payload (Formbook)", "value": "7c1fff6db2335c940779f43ea98e0b2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246373, "uuid": "e476d822-0791-4c5d-af13-409c54f96126", "comment": "Malware payload (Formbook)", "value": "e47c7c021bbe48b0a8dc692e51a1c4e3de809cf1ccdd9fc88e43bf73b29407ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246373, "uuid": "0eb6c41b-03e6-40bb-ba99-250016b3171e", "comment": "Malware payload (Formbook)", "value": "fa2bda80da6e003061c38794af6453afc4be5fb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637246373, "uuid": "87faa380-ff5e-4773-beb0-66089a21304a", "comment": "Malware payload (Formbook)", "value": "8a6aea21150e2b323c7566fb3c9f26605e02fef948537c70d20bd1f865eb0716af63df402919c0361d929057669263c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246373, "uuid": "3f1bed17-09d1-40cd-993c-2822cdb39056", "value": "T1AFD4D0E036B8C423E770857ADAB0D2BA4A70B12C1DD5C6427CEE6ADF76583747C99312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246373, "uuid": "b07c6caf-ac6f-4a4c-afe1-028710e56b27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246373, "uuid": "8ccf75b3-4ea9-4f8e-bf55-de66a4a300e1", "value": "12288:cBlCm31gW7IkcKX20nnyd2e3MziLjKp2e/YJQiV/goMBkfwT:KlCm3KWcgXy93iifKp2bJD/goP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637246373, "uuid": "238db5dd-84c3-4ae5-a08b-0f9bbe964beb", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637246373, "uuid": "b158235b-2836-4670-9828-374d0d1cb6d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637246373, "uuid": "d991f6db-5363-41cc-b6af-a04f9ea0f173", "value": "Payment Swift Copy Of 62271.03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf4daba-48ba-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637272821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637272821, "uuid": "9c19e30f-960b-495d-9230-ecea3519e695", "comment": "Malware payload (AgentTesla)", "value": "75403fea3a8307889497c7e6f18bc46f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637272821, "uuid": "3bfa1b80-343e-4520-af10-74db142852ef", "comment": "Malware payload (AgentTesla)", "value": "e4a7fcd47e0700884293a3fb54371e288463e190e063e3ee89ff7743d4af22ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637272821, "uuid": "1e30a223-63ab-42e8-949a-460c523eda57", "comment": "Malware payload (AgentTesla)", "value": "6baaff3cdfc983513e84912f0e2af26fb14ee92c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637272821, "uuid": "6dcd6e71-cb55-4b38-b242-6788bf713f22", "comment": "Malware payload (AgentTesla)", "value": "7b9e5fbf90a155c999b27441c5c2f99697f42f36454caf90025bcb5dd9f13e24dc162bb85615d5beb2c8681f6d1603d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637272821, "uuid": "c016a806-d206-4ba8-b4f8-b59dac0a4a27", "value": "T16205014437AC6F92EA3597F19A35D06243B5393F5632E28D1EC661CF2A31F001AA4F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637272821, "uuid": "3a94bac0-e9e3-42d6-9435-11c1d8626040", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637272821, "uuid": "f37a3d58-5c0b-4c1d-b176-eefb373d202d", "value": "12288:AXUtukQ8RN/NJEhKav9dILvKRZ0baCm3WGwUFw2/HwMKVUtD00:iUtZ/1K9d2fm3WAFw0BDC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637272821, "uuid": "9874270c-324c-4378-8ab1-d4558ff02456", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637272821, "uuid": "ac9d505e-555f-4875-bf8d-76feeb0a78e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637272821, "uuid": "30fcc748-c9df-497a-a008-8ea717ba50ca", "value": "payment receipt.pdf_______________________________________.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1740caee-48a8-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637264732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264732, "uuid": "fc3e563a-9d08-4bf5-960e-f655ebe42d80", "comment": "Malware payload (Heodo)", "value": "ebe8161c261594283b2323ede259e81f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264732, "uuid": "b06712d1-123f-4b45-a919-25220d03bf6f", "comment": "Malware payload (Heodo)", "value": "e4d167eb6303b5257dd526186a5f55ba29258ccae037f18e90edca762f80f872", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264732, "uuid": "4882ff36-9743-48f8-a5c0-67413fe82def", "comment": "Malware payload (Heodo)", "value": "865e9cda42723c514660b6b555b7a41cde47905b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264732, "uuid": "c3dc6349-b48e-4c0b-a83d-65065bc99f4a", "comment": "Malware payload (Heodo)", "value": "7d85cca17fb527b93e2e1d2c994f97654d5eba7e618ebcbc232b71386c8f3a2615c9cfd39cf21b528c2c35d05768e2f8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264732, "uuid": "c74c4af1-205b-4746-87d7-09c0c18a3060", "value": "T10AD4D0112843606FEC9C153C049977BD8FED6B55C2F4E8A7CF80E9F4AAC58C185B6A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264732, "uuid": "26804552-dac1-45fa-9674-84cad808ce76", "value": "9147e5ab6cd2dcc785393175990a85b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264732, "uuid": "d276b65d-82b5-4a2a-a0cc-d1a8a0a6b7af", "value": "12288:uOyVoxITHISr3VYRJ0QvcaqNqMWMeWXm6QrXmZ5YWsp4:ZkVYPZ9169Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637264732, "uuid": "ed0b0ac1-2cb6-49b9-97f3-bcabcf0f4fd4", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637264732, "uuid": "7ebe289f-f065-46a9-a2dd-2430549a9b47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264732, "uuid": "156c7fc6-0ea8-465e-a094-efbb78d92092", "value": "ebe8161c261594283b2323ede259e81f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9579be6d-48ae-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637267521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267521, "uuid": "9062223c-d424-4db5-8430-01c7dd73ff2a", "comment": "Malware payload (Mirai)", "value": "e3efce088b2b72ad1d6777e6ecdffad2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267521, "uuid": "b09fdb58-1ff2-4bc7-9f81-349cc8fb933f", "comment": "Malware payload (Mirai)", "value": "e5cd38b00abed8f06095a4b84507b55bab95f56ed90ce7d147218d7fdc823b42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267521, "uuid": "48dd93e4-682c-4f1e-84ff-2ed888eecc63", "comment": "Malware payload (Mirai)", "value": "63de5e6be8487c725ba6984e15c7b8e10233c991", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267521, "uuid": "b64cbd3a-0243-437f-a26e-b07728d3b0d4", "comment": "Malware payload (Mirai)", "value": "4f9c26cd6d87177a3fbc28acf515a1ab9e9bdfbb7f5d8937a4151125c24cb31f583dc9bc968800c57df10c73cad348e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267521, "uuid": "689e2676-2898-4a00-83cf-0a1d1c88f22d", "value": "T1C063A50ABF214FF7DC5FEC3745A91B06259C640A21A97B397E34D828F64A24F19E3871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267521, "uuid": "e79f5459-ee37-49ac-9036-da82881f7d76", "value": "768:pxNCJ0EYlDYhHuh5qsFSqwLX3U6OEAN6PNoUyO05jheleWTeKrmoNDpkdJLXirM2:pxNCJBYlrkqwwcAwP8O0fEfT9rmXLZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637267521, "uuid": "08bedcdf-50cb-4f85-9981-707fdabd42c6", "value": 71528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637267521, "uuid": "83c93457-4670-45ae-ba74-15c35ab683ad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267521, "uuid": "18ad2d67-a396-4c19-8def-91a3a178fd69", "value": "e3efce088b2b72ad1d6777e6ecdffad2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ec5109-4824-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637208122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637208122, "uuid": "f856dc55-f07b-44c4-a197-8dd91c426fb9", "comment": "Malware payload", "value": "a84745600f604b324276de1c01a1009a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637208122, "uuid": "c454418d-0fcc-43cf-a960-164574374970", "comment": "Malware payload", "value": "e5d282ae1dcd5c6abe00d605ecbc62477e842b6768cc9a539ed396e8ce342767", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637208122, "uuid": "d6155963-17df-4481-91ce-9b3afba69b1c", "comment": "Malware payload", "value": "abac38b788379a3eefb901cad7d6b17b5d97acfb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637208122, "uuid": "194f74a1-8d92-4a20-af80-0b5fbe7347eb", "comment": "Malware payload", "value": "1b4fa498fc934043e6918931c1fe51c40568baa9b9d62514889b4c963635fcd802a6c0b7eed3b1bb2e8a009263047677", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637208122, "uuid": "6f387125-3c58-42a4-ad44-f03bbcb991d7", "value": "T1AF636C1133D58079E6BF163148758BA2477EBE264FF48C9B2F88150E6EB11D0AA35F72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637208122, "uuid": "23a0b960-83d2-49ef-b5f8-24112316a808", "value": "92ce795446ad0ead80a0fdb7fe4ba4f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637208122, "uuid": "1dee90b7-8184-43f2-9d79-799a46c44363", "value": "1536:taLrwC0e5Ft/wdFHqY5gvRbUfsfuC73H:YLrIe5rC457h3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637208122, "uuid": "9d0060ca-0fc9-4a8d-9538-32a38f9c0e86", "value": 68096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637208122, "uuid": "50543a84-169a-4e90-8e37-3c0ed5ec3636", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637208122, "uuid": "dd5b7833-838a-42c3-b45c-e4ddc98ca074", "value": "SecuriteInfo.com.W32.Injector.AQB.genEldorado.3628.738", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fcbae2-48a3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637262935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262935, "uuid": "14f7664f-d44a-4d20-99fb-828500b18391", "comment": "Malware payload (Formbook)", "value": "7d90a950a4da8890cb3b329982820082", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262935, "uuid": "10ea9a63-e864-43c8-897f-b6b2817ba295", "comment": "Malware payload (Formbook)", "value": "e6cfd1dc57d3c37699dc607a0ef551d14e6c96438e46a02482f59d0eafd7b04e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262935, "uuid": "2fa271c8-85a3-4150-a772-af0596a10ac8", "comment": "Malware payload (Formbook)", "value": "62b08ce70dc5abc05d63d17370c38f328616428a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637262935, "uuid": "6ca60e5a-527e-4d85-a532-af5479b67c24", "comment": "Malware payload (Formbook)", "value": "9c21d4c0c2b14827c98bbba5d56c530aef6067bc085e400c01a339fc2345c0817b3df93aa8a4c678c676f236ce571791", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262935, "uuid": "580dcb25-fdaf-4ef3-914b-2d89f783c6e0", "value": "T1D1D4E0A03AB8C417E370857AD5B0D3BA4AB0B15C1EE6C6067CEE2ADF76597607C58313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262935, "uuid": "468b193a-53aa-4b1d-8a85-8a66c62121af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262935, "uuid": "f3253b3b-84e3-41f7-bdb2-8bf67f3ab5c8", "value": "12288:SI9Egm31gW75satRt7iPEUcsjIT94bixzvGZpDrY:l9Egm3KW1t/OMV54u1vk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637262935, "uuid": "ec14416d-0f15-4d27-8fac-4de751ed140c", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637262935, "uuid": "2fba2fee-b7e9-42da-b66c-f8675147e6e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637262935, "uuid": "8cac4878-11ac-4c73-bd1c-841420cbc153", "value": "DHL_AWB_NO#907853880911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ea626b-488d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637253271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637253271, "uuid": "ae1b3c03-2fa1-43c4-82ee-09bd73cc7dbe", "comment": "Malware payload", "value": "11422b8118db41e8b742912354cba427", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637253271, "uuid": "61b72d4c-759b-4208-afa7-36532468d8e1", "comment": "Malware payload", "value": "e7b24950fcd9f57630cd1d779ce59f58c8b39d598332b66a64894de0aaf88daa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637253271, "uuid": "418d371c-0c8c-4702-bba9-5574ef75ebba", "comment": "Malware payload", "value": "10927bacd9cc639218bd64156f89c248103a5af6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637253271, "uuid": "a4823b24-bbae-4e92-9c72-9dc80a43d239", "comment": "Malware payload", "value": "a6c1fb93546e48b1ceef4041d3ea1e6523e4fac02f1321839e750201fdbf15bc35c354771eef3c9da3dcb20912cac6a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637253271, "uuid": "561aeb98-0b79-4e53-8e69-e2c52433bae4", "value": "T1967423511CF92212D23416FA0AB99777C9B681BB4BA8EACFB0CF53405F12706E9134F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637253271, "uuid": "5478ed01-7c1a-4259-868c-a4986983a1b4", "value": "e06839d5b5e1a25841573638fdb89639", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637253271, "uuid": "3c5c471d-be02-4ba2-bd18-aeddc328cf37", "value": "6144:uqjc6BNsTZl5mhQy6agD3eM81VNYuKU+FhS3vJ8lXGKTzTvb8:Hj4lAhQ8g7v8DpK1w3vOBTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637253271, "uuid": "dcd53926-b0f3-4bf1-a480-5f2629cfac38", "value": 345104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637253271, "uuid": "5cbeeaa5-abb9-4253-b81a-7b56c23b58db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637253271, "uuid": "8085706c-3792-48f9-8cd1-1dcd459a8e1f", "value": "11422b8118db41e8b742912354cba427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc616f5-480d-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637198147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637198147, "uuid": "98ed1e59-367b-4231-8d8e-b1b556191c3c", "comment": "Malware payload (Heodo)", "value": "232cf68c34192ede8148e665aac7006e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637198147, "uuid": "f4bf2ca7-7ef3-48c4-9def-1a23e8e52538", "comment": "Malware payload (Heodo)", "value": "e7f0aeff808f0fda0043b82bf0ed3c52308e1bb058ac3e5129398048aa82c60f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637198147, "uuid": "2d6063a3-1263-4d9f-be50-3ca1e450feb6", "comment": "Malware payload (Heodo)", "value": "4c9a691de39a44a05fd8eba372a54d7375a5713c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637198147, "uuid": "c0fb4061-2cf8-4fbf-9f84-11003db05217", "comment": "Malware payload (Heodo)", "value": "326d488894f9aeaccbc0a3015202a4b7ccdef5138bc84fc2d7e43035239ffc55a9f639c33f0e90afd0028957a5c75905", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637198147, "uuid": "df81d339-0421-43c5-8151-6ba52432be6d", "value": "T19344BF10B1809032E9BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637198147, "uuid": "61b7cbef-f200-4fba-8e9e-684a99b788e1", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637198147, "uuid": "ad1fa84f-8046-4078-9b7d-11c169c025f8", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBe6asb:prf+WPVXNcwUKaWT3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637198147, "uuid": "93238ff9-ee80-4b8c-8b93-3f0df5b578e5", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637198147, "uuid": "9c4f4e64-b49b-4907-abad-587fb660f471", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637198147, "uuid": "e13a18dc-d548-42ce-8183-65e79ebba7e5", "value": "232cf68c34192ede8148e665aac7006e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e58ab43-4844-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637221794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221794, "uuid": "e89e3b1c-fb93-4dfb-86fe-81e0b9632fb1", "comment": "Malware payload", "value": "0bf5a824a8679eda2505442ed3a179c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221794, "uuid": "f6ad0913-477f-4a32-8f2f-286f6d0af3f2", "comment": "Malware payload", "value": "e8ab1502b29f41aa9119e44a1bc295934b3f1105b6be03839d504b643a04d3e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221794, "uuid": "16388b11-4d4f-46da-8c6b-46c73566a14d", "comment": "Malware payload", "value": "89b4115207dfcfc4dd16bd6d3754b9c4ab02b7fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221794, "uuid": "5a3b42d0-0369-4500-95ef-567218139f1f", "comment": "Malware payload", "value": "2db3898dbc24bbcd2bde2e0c75c2e0457b6f4bc4ac687316ed66f7a0eaf098842d12c17d21525819de052c7fb3565305", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221794, "uuid": "31453205-5536-411d-aaaa-b6c2d6099b90", "value": "T1C716335059C023CAF698EE1E17EC3A35523FEECF2878BDE3955283F1040EE89D962655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221794, "uuid": "77c8301f-a1f6-4949-a1c6-cdee6f28e665", "value": "98304:G1wwAjzIQOMK2GNKslgus10Y1/UJ7BdlRbTBAlYVA:G1wwAYBr21uQsJ7vTBAlYVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637221794, "uuid": "b9af2f23-9765-471b-93fe-0e31a4129b08", "value": 4100096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637221794, "uuid": "3a159820-f54e-4cc8-9b62-d55af1f6aeb7", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221794, "uuid": "e193a3d5-6db0-4b3d-ae5c-8428877521b8", "value": "e8ab1502b29f41aa9119e44a1bc295934b3f1105b6be03839d504b643a04d3e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf0e0c8-48ac-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637266724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266724, "uuid": "0ae63421-152a-424c-bfb4-f18da42e70b1", "comment": "Malware payload (Mirai)", "value": "3339ac3c192a8f79ba98e549422e55ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266724, "uuid": "f5a7ea89-4d09-4982-bfa6-8de0fa809d80", "comment": "Malware payload (Mirai)", "value": "e8ff35b7bb8e21436d20884a80da56621bb5dccf48a456fe1d094b3c81812aad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266724, "uuid": "29ff0d33-335a-4d9b-87ff-b0a0956db5f9", "comment": "Malware payload (Mirai)", "value": "cfda8bb4e29e7700c71bc3c6280a057f93d32783", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266724, "uuid": "a278baa4-77fb-4433-a4f4-241aefc5ce66", "comment": "Malware payload (Mirai)", "value": "5c4c854823b629e8cbed5378cd50701cb5ead7dea0a38f4fe375544e04b9d3db684f8f43ed3255809fd9924113326b66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266724, "uuid": "d574d4f4-973f-422f-b0f6-a94695e13715", "value": "T1A7337DB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266724, "uuid": "3431c20b-f67c-4af5-9425-b1874efe3060", "value": "768:jaixFwtLSYAagMo0ebfELbv0X3pyWfs3I9ICJUU/qMCqKomQRCvl:jaQFwtOGrv0XJfs3kICJt/qMF/RCvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637266724, "uuid": "4b389305-8109-434f-9819-42e346bbcab5", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637266724, "uuid": "78c62d00-cbea-45fb-8afd-d33c6827f059", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266724, "uuid": "28eda66e-3e21-404d-bd3e-7982c06a2a7d", "value": "3339ac3c192a8f79ba98e549422e55ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6e6ee1-484e-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1637226111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226111, "uuid": "d31f4992-cbfb-4525-ac5a-b1103212bf7c", "comment": "Malware payload (GuLoader)", "value": "62f5318a5b38948e62294e2dd045ae9f", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226111, "uuid": "e25d2f7e-b501-4e91-8d03-d91ea5e921d9", "comment": "Malware payload (GuLoader)", "value": "e920ede7ceed93bef3cf96e006e89a4b9f40158e14d33dbff55c1d6a07a28266", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226111, "uuid": "cb4ae617-f4a0-4100-8c8e-db16bb95edd9", "comment": "Malware payload (GuLoader)", "value": "a10ac124dca5245d7578969c326929537ab63c08", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226111, "uuid": "71f6cd1c-d465-4d0d-b05d-2097d95847fa", "comment": "Malware payload (GuLoader)", "value": "4907504e1bb3c8437b9d512b1f036b9979e61ef01d8b6c52dfb1db3e38b5723b6e911322a846f062cfc6b005499f54c2", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226111, "uuid": "a3b0bcd6-f7f5-4584-9fc1-ffbbbea8d652", "value": "T1ED3412707271A101F65B7BFD8C2E2521599FDC956A08084CBCA0BB4DDAB0CDF2A45AF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226111, "uuid": "53c361b2-1115-4c50-b77c-acce6f8232bd", "value": "6144:ClZ9ZOLUHt1+Zzs6akieaUGvCcFajpMQu+of:Cz9Z+UN1+5sii9U4o5of", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226111, "uuid": "d1adb399-8b3f-4898-a3ee-606414c306c7", "value": 234312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226111, "uuid": "f2cacbb1-cfbe-40f3-97f3-d9a578cd8f9f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226111, "uuid": "ccfa55bb-7510-48a5-a517-2646649b3743", "value": "Swift \u00a362,271.03.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407ff11a-481f-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637205960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637205960, "uuid": "ada87c76-a96a-478c-84b8-ef3aacf32ff6", "comment": "Malware payload (RedLineStealer)", "value": "9a4cb2ad18d5bdd8bf774497d54ce9cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637205960, "uuid": "780e957f-535b-4e0c-b06c-4c9ee081ebf6", "comment": "Malware payload (RedLineStealer)", "value": "e97937913851eaf475c1fdb696876c182364ad84fec84a7cf09e6f265ff2233d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637205960, "uuid": "d0a0b016-68fa-48f9-a962-2f6307c2b984", "comment": "Malware payload (RedLineStealer)", "value": "7da24ffad393d921df90ee6e59c3580fc8fad591", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637205960, "uuid": "2a7a975e-ab9e-43dd-aff2-b89c2d4c9483", "comment": "Malware payload (RedLineStealer)", "value": "0b88b8f5fbf64d7670bc540d0b53da2518b4c4ebb54694e34b8b63a26362d8ae8dd290cc86a6690cc267893ee8c1eb95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637205960, "uuid": "0bc8ad6b-84bc-4c72-b0ad-324322a8dd04", "value": "T123C39BC5D292024DCD174F3CE2E25720F6726E97CB268BCDF29949A6B070C858E93877", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637205960, "uuid": "d48f906b-8ae8-487a-8b9b-bcf15261d086", "value": "2d7064e1c71df275c7c717fc7015e20d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637205960, "uuid": "fae72590-d387-4c9f-a835-5abb4fbaea25", "value": "1536:f8H7IoWLDIWSjiqLK/7AR7hJIaOzlOVA6HT+GfgiVpMw5E1O61kInt2YgCG:04I/bLK/7AbNCWA0T4iVzy3k22YgCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637205960, "uuid": "9ec554c3-8e82-4b42-be68-4421c50ed533", "value": 123392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637205960, "uuid": "0d37db0d-1706-4b50-8bdf-0c2e41830732", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637205960, "uuid": "91df70ac-a612-47ea-a421-d19cc2e3da7e", "value": "9a4cb2ad18d5bdd8bf774497d54ce9cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e14cbcd-4802-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637193635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193635, "uuid": "db71d759-cc81-4481-a0e4-ce366d9e59eb", "comment": "Malware payload (Dridex)", "value": "28f4a41b1853f7c471a9e6f1a02e584a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193635, "uuid": "2c27c40d-d5f2-40c4-ae62-683f208230c3", "comment": "Malware payload (Dridex)", "value": "e98088458287ae8b9dde8e19695a3b1abce06ab21c0de10ed87e29a54ddf760b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193635, "uuid": "18274758-806d-4193-8ca9-03affb7db3f4", "comment": "Malware payload (Dridex)", "value": "176a175502d6f09a3e129bf1778ac4c3ed2b53ca", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193635, "uuid": "fd4306c2-8f77-494a-9584-39168ff1b883", "comment": "Malware payload (Dridex)", "value": "7e3cdf766ab0fc575c6a9cd51ee5d2477caa74b8c278124748e011d5ab06ea4c57776575db9d76ed3bb624b53ea8424e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193635, "uuid": "1a2a54cc-19a4-4d20-8041-03a68704cfa2", "value": "T118E49E067CF9989CD511ABBD421E86FB8BB089B784D0CAC1C1199F3A5C07BDBE54C66C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193635, "uuid": "b5531f98-76f6-4079-9f45-bcb9465558ea", "value": "43b460ede91c0828a2b4acde6b98d16d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193635, "uuid": "a3ee484f-d01e-42e5-b2ad-26d4ecaad367", "value": "12288:89we+YtfLwxfZYnfh0xnf2xfH6xfpaEdk9qcK05GDdiO2cGoOUwgZF:89we+YtfufkfonsfYfpuN5GxiO2cGoOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193635, "uuid": "530f4cfe-10b0-4e41-94fe-929a51485d0d", "value": 668520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193635, "uuid": "5cae9c46-4151-4e7d-b380-40c6041da261", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193635, "uuid": "8e9523de-14df-4908-9627-0304c98bc491", "value": "SecuriteInfo.com.Trojan.Dridex.777.21803.9656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4970bd5-488f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637254232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637254232, "uuid": "a8f66c42-c004-4035-99e0-76c8040ca6eb", "comment": "Malware payload (Formbook)", "value": "5c74ddab550cb3ff1335612128643fc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637254232, "uuid": "faa72b1c-8330-45b1-8e3c-57b3ff4dc6fe", "comment": "Malware payload (Formbook)", "value": "ea074d89ce669e6d00d54a7fce58a5394a075611740346df298cb55926ac9a55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637254232, "uuid": "72ccfd1d-d438-4fbf-8bec-d1eed5ff573f", "comment": "Malware payload (Formbook)", "value": "d0259bd7461968db513ef56545b118791be180a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637254232, "uuid": "420e23db-7dba-40f9-b52e-c330c57c8759", "comment": "Malware payload (Formbook)", "value": "3d880efbe4f5a22ee02df6d03d32b9b93e5197d97749ec1e45fce76b882ae7a7b69a60b8364fe59419ca755d4a5aa1d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637254232, "uuid": "74a99ec7-ffad-44dd-b117-7fdf24699bab", "value": "T14FD4E0E03AB8C817E7708576D6B0D3BA8AB0B15D1DE1C6023CEE2ADF76597647C58312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637254232, "uuid": "1ed53990-1766-41ea-85f8-763c34937d5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637254232, "uuid": "21cda073-db28-4ae6-81da-4ab4fe090a79", "value": "12288:BtGr5m31gW7gNkaTkF13f99z/esfh2L78iFAHpeBI4W+p:BMr5m3KWfkM3H/V278ieJqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637254232, "uuid": "fa25c4b5-ac52-4d6b-99ac-6addd4e2667f", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637254232, "uuid": "3e3256d7-7ef5-4687-a85d-2a2085130ce5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637254232, "uuid": "18eb2f72-febb-4a3a-9635-20e6739f5bfb", "value": "callyzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af464fa-4802-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637193603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193603, "uuid": "806edd2d-cf89-4744-a30b-1f088c796478", "comment": "Malware payload (Dridex)", "value": "a81cf9c91b5fbd133a9695e9eb0ec219", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193603, "uuid": "0feb1608-cea2-4c38-a6ef-5d81208dfb9f", "comment": "Malware payload (Dridex)", "value": "eaad21aef7fe38729c1c7fafe375e2c9e8f12102d75e7eee7a0b1725b68939f4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193603, "uuid": "096521f5-04e3-4f6b-84d8-64682be43678", "comment": "Malware payload (Dridex)", "value": "c058aae1168ee2af5ea7a903d3fa01982a467be5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193603, "uuid": "25af8d61-f08d-4e0b-a534-78ee240060ce", "comment": "Malware payload (Dridex)", "value": "39a98b74c9d59c424fde87bf4b72ccbebf50b3f69bcf992f1af3755d4153f0689e4498cf20ba3aebb3007df15290cd48", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193603, "uuid": "77bb8e36-daa0-4b84-8899-b3aead649dcc", "value": "T100E49D067CF9989CD511ABBD421E86FB8BB089B784D0CAC1C1199F3A5C17BDBE54C62C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193603, "uuid": "dd4d1368-fd16-43f6-b587-9b51e8939312", "value": "43b460ede91c0828a2b4acde6b98d16d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193603, "uuid": "cd662810-d113-4014-ada3-fa31ff23d756", "value": "12288:D9we+YtfLwxfZYnfh0xnf2xfH6xfpaEdk9qcK05GDdiO2cGoOUwg9Z:D9we+YtfufkfonsfYfpuN5GxiO2cGoOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193603, "uuid": "3ef591c4-46ad-407c-964b-2c850d539105", "value": 668520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193603, "uuid": "88cb849e-4843-49f0-a357-5b5a2b567fd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193603, "uuid": "a2c71dde-6dcc-4bd2-aad2-84de7b217187", "value": "SecuriteInfo.com.Trojan.Dridex.777.28766.21785", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99f018f-484c-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637225517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225517, "uuid": "8b39b552-d61b-4bab-8831-514b4d9a5f5d", "comment": "Malware payload (SnakeKeylogger)", "value": "8b805613cd3c18fa93ea82dc4ce44ed4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225517, "uuid": "b4de74f1-ec6a-448b-9a98-d54c7f1fe9eb", "comment": "Malware payload (SnakeKeylogger)", "value": "ead300a07127a8d18e23a62fa409488c7c3b7133b2e022cc9eb3be204b52cba8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225517, "uuid": "d5c42ef6-36ad-4ab3-86de-59b133045d9d", "comment": "Malware payload (SnakeKeylogger)", "value": "36ba6582e564aeeb6992f49e78a71e581213b496", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225517, "uuid": "535eaa5f-318c-44e5-b6d2-67c57c149677", "comment": "Malware payload (SnakeKeylogger)", "value": "f1f4320dce1e6ac69d75cf7d80987a89da983000736bf44daea04340a6d53ebf2ebafb0bb7049ae4344dca022dba3a87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225517, "uuid": "23ac574c-9b3c-487d-9e45-04ef14097e06", "value": "T1DAC4DFA036B8C413E7308676C9B0D2BA8E70B16D1DD6C6427CEE6ADF76597607C68313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225517, "uuid": "e81bbcd2-62cd-463a-8ce5-96c0994d0e5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225517, "uuid": "f2f9f53a-1cb3-4d34-9b41-109de298f09c", "value": "6144:io+j+yUa3HXkh22hlECn/KqS15VIFI7M5IBOyVZsPl+3Hm7JpAdKAWiZLWuHKhX0:8aVm31gW7O4ZLz40ZBsZDX/IKCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637225517, "uuid": "f8d60774-45ac-447e-9a33-0c74b97831a2", "value": 560128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637225517, "uuid": "879a8bed-b726-4094-940b-dd62822f525d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225517, "uuid": "24c711fb-69cf-41d7-9902-43c4308f16bf", "value": "PI-00458342,iso.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37467e5-48a1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637261987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261987, "uuid": "7c78c18f-3dd4-4062-b404-bb0b236cf046", "comment": "Malware payload", "value": "54cdf9b741070693e4af35bbc009c1dc", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261987, "uuid": "7301360e-ade0-469f-8984-06f112879df8", "comment": "Malware payload", "value": "ec9282ede3ddbcace5b12ffe4458da211f3eed7aec9ba0b6aec475d61f636b9a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261987, "uuid": "1bdb1bee-65ef-4598-a646-aa801600740c", "comment": "Malware payload", "value": "73b73a438f6b05833de98b1703eb5eb8eeabf13b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637261987, "uuid": "01ee3a4e-229d-4ce8-8fba-6d10c9a472a5", "comment": "Malware payload", "value": "1c640dfec1e6b9d8a694d3f16a762358a1a97958d5b8049e62c5c5442cd5c6d9b5b53f3a4ac59cd979eb5f076c586a54", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261987, "uuid": "c0b3e2c1-24d9-40c7-aab3-de2ff8ed74c8", "value": "T1DF45AE23F2D14437D4B32A398D5BA365A835BE142D385C4B2FE82D4C6F3968139762E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261987, "uuid": "1e543dfd-7380-47a3-93d4-a50e3a1a4202", "value": "24576:Q2Re5GYFAjFCFUYevtW5AscRb6HbwkvHV0ELkaePggynGTU+KT6A:Q2kGYFYFacOzvHV0YgdTPKOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637261987, "uuid": "f9ff2c1c-7a51-40e7-a3f7-53af87edc7d7", "value": 1270272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637261987, "uuid": "129c6153-89f0-45a1-92f5-6c8148e0ce3c", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637261987, "uuid": "b6744a6a-ae61-44ed-bb5b-39124417e8b8", "value": "ArchivoFacturaFecha18-11.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce1a350-484c-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637225523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225523, "uuid": "057d4465-b9a4-4e99-9a5d-7ef494341305", "comment": "Malware payload (SnakeKeylogger)", "value": "badb275c1bccaa911393bb362bb8f76a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225523, "uuid": "f2f80060-5ea7-4c0c-b785-713630cc93ef", "comment": "Malware payload (SnakeKeylogger)", "value": "ecb446bcf4b7c55ebefe6dd61f7c01300df2df1257001c8440957ff9f211b086", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225523, "uuid": "1e343c47-7d19-4fdc-a2ea-c74c5a56c73b", "comment": "Malware payload (SnakeKeylogger)", "value": "fa3b6fa4b6098783d23fdd39b348832da835a2a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225523, "uuid": "95d92123-7ac1-4579-b87f-ec26e694c6a3", "comment": "Malware payload (SnakeKeylogger)", "value": "f10f51ea3bb12393e1a1c9cfacb8556fdaf9506d60a97d89e4c4f3a3a19ea8a135486ff5758041518278389676e21cab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225523, "uuid": "5c060c36-7313-4bca-a83d-d2267d6d4974", "value": "T1E0B4CFA036B8C417E7B080BAC6B0D7BE4F70B16D1DE1C6427CDE6A9F7659760BC58212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225523, "uuid": "5d150189-f756-4c3e-bede-34b11c4b9eb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225523, "uuid": "ea204687-98ed-485d-baf2-841f8b520894", "value": "6144:1x9GDDUa3HXkh22hlECn/KqS15VIFI7M5IBOyVZsPl+3VlA4WlXZ/KIYTnP48SbV:1xLm31gW7PeJQQ8SbMfjva/F3Ta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637225523, "uuid": "6cfaab4e-24f4-40bb-a50d-dcb5cc287502", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637225523, "uuid": "a6f6835b-c054-4c1d-b9b6-308cc31e8632", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225523, "uuid": "5ea6eb71-528e-4a3a-987e-bfd5cd3ae344", "value": "swift confirmation 4957.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a0d284-485b-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637231868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231868, "uuid": "c73c5323-764a-4200-adb1-3f8230318b8a", "comment": "Malware payload (Heodo)", "value": "ac2949e562fde5776598f4875c9725ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231868, "uuid": "f41acb5c-7069-4a67-bcfc-ce27c62518e4", "comment": "Malware payload (Heodo)", "value": "edc8060a568211e4e2cb69c04e969e0425aa8820cb30c4eb06e888d1a6fdca7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231868, "uuid": "ec4e3450-3df8-4480-847a-a1ca19dd60ef", "comment": "Malware payload (Heodo)", "value": "be9cecc813cee4738135c3fbc72b43cdd733af05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637231868, "uuid": "c784feb7-b5cd-4a9e-898d-51e287b4ce96", "comment": "Malware payload (Heodo)", "value": "691708f69cfab93f7dd58940c21926d65e60ad484f06955391721f7e6e99ce7f1baf4367484e729eba43816da856aeca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231868, "uuid": "e1f3a073-90c8-4210-a136-e5123741849b", "value": "T17144BF10B1809032E9BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231868, "uuid": "8f364a4c-cdf9-46a8-bb97-6d22b5254ed3", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231868, "uuid": "a75c7a66-3e21-42bf-bc4a-e193ae3e100b", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBN6asb:prf+WPVXNcwUKaWTsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637231868, "uuid": "3718d27d-a289-46cd-9dc1-bc3a8f150b8f", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637231868, "uuid": "12a00700-e7b7-4d62-9b67-8fd30e28f81e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637231868, "uuid": "04bb8acd-dea5-4847-a554-cb8782c8abe4", "value": "ac2949e562fde5776598f4875c9725ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6341a04-4861-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637234504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234504, "uuid": "04b00db8-29e7-4d95-ad9e-3aa6fd9ebf00", "comment": "Malware payload (Loki)", "value": "b18699acccd907af4a34507631ac9674", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234504, "uuid": "ae04c4b5-da7f-4709-b02b-d5aadf95e43e", "comment": "Malware payload (Loki)", "value": "ee4910d6bcfbd3cdf6b1ff7761266621e9540683bd7066150c5d184022d1e23c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234504, "uuid": "9f172e1f-62c9-4a89-90ea-acac7c1bb2da", "comment": "Malware payload (Loki)", "value": "f5a5eb36ed2135ae17d59088fc6c72b2c5a385a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637234504, "uuid": "be8f0ddd-8bd8-4433-8739-8bba18de2479", "comment": "Malware payload (Loki)", "value": "7755ffd3976cc64950d2b14956ae96a91fc83a0eefcf6d5e2959b408787cb5a461d8414856276ffeb04b55bb8761f230", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234504, "uuid": "acb8dff0-291b-4424-bd8e-4586cbcafd00", "value": "T17FB4BEA036B8C427E77081BAD5B4C3BA4BB0B16D0DE5C6427CDE5ADF7659760BC28312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234504, "uuid": "db64c6bf-0008-492b-863f-2045c8ccceb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234504, "uuid": "cecbfde2-71d2-42a4-89aa-98d4453999e1", "value": "12288:Wnm31gW7BCbk/gSN7cCHw/oHB0AVnZnjL:4m3KWtjN71QcbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637234504, "uuid": "87fe6ee9-aaad-4cbb-9177-bc8631fab8c7", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637234504, "uuid": "f52e1fd2-40e7-4b98-989e-1f65bfb57e3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637234504, "uuid": "63b1c0c5-5526-4919-9db5-ad08183442bb", "value": "Olij Breeding Ethiopia Revised Proforma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d659d4b8-484c-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637225539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225539, "uuid": "bddf62a2-eacb-4575-9061-bdf180a59f5c", "comment": "Malware payload (SnakeKeylogger)", "value": "c5341b77d62001c7fd0f59d0bccf4e2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225539, "uuid": "36f8d2fb-3c5f-451e-926d-ad9cc3edd620", "comment": "Malware payload (SnakeKeylogger)", "value": "eeea364cee2514b00669edb093c68da2618ece6658653a958ff42f6b0996c9bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225539, "uuid": "e7dd0fb4-be03-46d0-a5e8-e8f3095bd618", "comment": "Malware payload (SnakeKeylogger)", "value": "5e8590c3d6b4c0d764fcdf1870a443cdf60dd386", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225539, "uuid": "61e8a22f-fb82-4acf-baea-550e05e05bdf", "comment": "Malware payload (SnakeKeylogger)", "value": "bb52ea707db2aeeb4e7d0ad24cf1ec47c19a10d8293d211c7885417ec08aafb602da6362b6a36c380eced691c3619bbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225539, "uuid": "1b859853-e810-4984-aeb3-21e2124eddcb", "value": "T109F4E0853B686B42DD24C7FD832A592013773E396BB0E24E9DC174E71BB2B481917E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225539, "uuid": "8b82631e-649b-4434-9393-014a0f994bf0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225539, "uuid": "e96a68f9-62c5-4865-88ed-73f07684bb91", "value": "12288:Y7mdtI+Wt1642EvAvfakHA2k2fx0lvL6ukF1pNwFYmtD007NmeeK:NdM1p2e0f42k2Zej6u8NwOmC0Yee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637225539, "uuid": "8b1323cf-6e82-4202-bac8-0655b819fe03", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637225539, "uuid": "615b4b97-49b9-43e7-b770-e061b6a30347", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225539, "uuid": "87873be2-e1dd-4249-ab52-eecef41e2158", "value": "payment details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f04f98-48ae-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637267500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267500, "uuid": "ba97e931-a6ab-42d3-b519-b07c0a343316", "comment": "Malware payload", "value": "b585b4d72893707f229f2a413b59c65a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267500, "uuid": "7c134fab-e00e-4b08-b62a-5721437cd911", "comment": "Malware payload", "value": "ef520569d3d41e7518fc904545214a6c48ae4344faab6183889403c1a38c77f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267500, "uuid": "6a7b8291-9c38-4f10-a983-89b7cca70dc4", "comment": "Malware payload", "value": "30d4411ee95b1e05bb79d08eaf8ea901f645871e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637267500, "uuid": "8a6bb463-5a78-46d8-acac-df087b62ce1a", "comment": "Malware payload", "value": "5442f399243b231408029e56685a9c0822dcfc6d0345a795f2eb6415a419483b06e367fde0552fd660626486b71b3a7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267500, "uuid": "4747eb3c-667f-404a-bb98-caae781cc8b2", "value": "T15AA4F16167688B27C67817F88065F73D0BB59EB1B826D78C6DC0B8DB3E31B421814B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267500, "uuid": "9c3bdd80-9f23-4e1b-8207-987d4b8249b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267500, "uuid": "0fb4a5b1-7ea5-40f2-9fca-8e619ad55772", "value": "12288:xh9ZDWXoODI+0ozDWrNmX2hQwI0X4xgnDgyKAeXJi:T9ZXsIsDWxiRgDgyKvJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637267500, "uuid": "c21cc896-a38d-41d6-adac-629d11985147", "value": 461824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637267500, "uuid": "ab8c1369-6bfa-4951-8ca5-709ec6b6d279", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637267500, "uuid": "c1770231-83ac-427c-81f7-c993d5ccea2a", "value": "b585b4d72893707f229f2a413b59c65a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8146fdd2-4802-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637193613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193613, "uuid": "ad08b95d-d40c-4c0c-9ae5-a5ee2a79051d", "comment": "Malware payload (Dridex)", "value": "8b924ba641c450c305bc0deaa0ba2557", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193613, "uuid": "e2b8dba6-8341-4145-8da1-7a54ca63be1a", "comment": "Malware payload (Dridex)", "value": "f0515a37906e1659cb29e217a9a9eaae5ebb5f79c9575c18c8388c8eb202fdf2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193613, "uuid": "7456172f-036a-423d-8926-8374e358eb3d", "comment": "Malware payload (Dridex)", "value": "8ec061e4e4a75c88dca268d29b5943cbfc936739", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193613, "uuid": "d9ba5b53-6150-4a6b-8f34-62eff0a29fef", "comment": "Malware payload (Dridex)", "value": "80c5ca6c5afaac773d624ed003fe5993e9f9b2a0e4a5a2e063cce02b1bf72896ad1aef37d0416a4d37f6f0a7e37aad00", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193613, "uuid": "37a716f1-9ff6-40c8-b443-0b4dd61ed470", "value": "T10AE49D067CF9989CD511ABBD421E86FB8BB089B784D0CAC1C1199F3A5C17BDBE54C62C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193613, "uuid": "bd0c57eb-f45e-4c7b-82ed-b9fe038a2193", "value": "43b460ede91c0828a2b4acde6b98d16d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193613, "uuid": "ad5e9874-5d9c-43a1-967b-839065c3b2b4", "value": "12288:v9we+YtfLwxfZYnfh0xnf2xfH6xfpaEdk9qcK05GDdiO2cGoOUwgJe:v9we+YtfufkfonsfYfpuN5GxiO2cGoOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193613, "uuid": "5fa942b5-24c7-47ec-a9bd-99af3d5d0427", "value": 668520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193613, "uuid": "661b1247-0579-4624-99af-1f22f4280f9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193613, "uuid": "54f0f29a-95c8-4d2f-aa9f-36bb2e3be517", "value": "SecuriteInfo.com.Trojan.Dridex.777.17637.7693", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ba56a9-486b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637238725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637238725, "uuid": "f8a6f3e9-7ca7-474f-bae5-a4b9b407a9dd", "comment": "Malware payload (AgentTesla)", "value": "57b2164d09e31f6e0db62fd643c2f241", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637238725, "uuid": "46a8d861-c414-49c6-80b0-e9f178c0c3f2", "comment": "Malware payload (AgentTesla)", "value": "f09c5cc304c1116a638de6e8980019652f6a3fa0896f7b9b60ab5a073d6aae44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637238725, "uuid": "dacfe1b2-4190-4350-9cff-07a9172b620d", "comment": "Malware payload (AgentTesla)", "value": "62ab250d52112fa6124ad7ca2e648d9989c479e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637238725, "uuid": "db27ba48-d997-4fd4-93bf-efe9357f3634", "comment": "Malware payload (AgentTesla)", "value": "4856e28f2256b0ac76733dceca0e6f7f432cab51c3c90bfbf5e160f29cfa6e968462198392b05602fc6ef9a2209d5fb5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637238725, "uuid": "36b9e6a5-87b3-48fa-9b62-1241a358894d", "value": "T11905124037EC6F52E93D47F54A72B02083B6793A5A32D29D8EC260DF2275F0156A6F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637238725, "uuid": "7806e803-70fc-46dc-8a39-d3797986e6e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637238725, "uuid": "41ccbea6-4382-4683-b75a-36760e3d0999", "value": "24576:gCqj0JA8A1OTwJq9V4zxmVFuUuqrX+C0:XqwHaCGYV4iFuqj+C0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637238725, "uuid": "2f21cca8-a661-4eaa-9379-4b3f27c247c7", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637238725, "uuid": "7900983b-0408-4d1d-b6ba-220ed3a9c95e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637238725, "uuid": "1e112479-b64d-4d16-a770-c1c85d3db58d", "value": "N012021000001724.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df554b0c-48c1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637275805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275805, "uuid": "de24f1d8-792b-48b3-ba9b-6b3f91055683", "comment": "Malware payload", "value": "6714d89089c62045dbdbd75e74dd64ec", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275805, "uuid": "c1254002-6276-43ad-8250-853ca2801a55", "comment": "Malware payload", "value": "f0b12413c9d291e3b9edd1ed1496af7712184a63c066e1d5b2bb528376d66ebc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275805, "uuid": "f0130cc7-d92c-472f-ad8d-2e4c5ad31b24", "comment": "Malware payload", "value": "941e8f52f49aa387a315a0238cff8e043e2a7222", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275805, "uuid": "b4aa9299-43f1-40ea-a563-948733a0ff55", "comment": "Malware payload", "value": "e4d875b8ac5f90a204d2e663d6a03b17b54fb2f0ada38590cbb0b985e56cd864710ecd3fdc4f49618031a995734bd0e3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275805, "uuid": "f81b63f3-e3a8-4e16-9195-a2e360732301", "value": "T1114522B8E79648B3B8D9252432324A170C585E373526CE6EE2CBB01F1787F362D74C66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275805, "uuid": "f01bcaad-e862-45cb-bd80-60add606baaf", "value": "24576:2oSsoKVA0KOXsIZ8Eu1qYprZHjlpLYqN1MP7LctiyQ:2o00KOXmq0jpLYqN+DLctiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637275805, "uuid": "4cd9450b-1420-4f6d-ae08-cd17a086424a", "value": 1194193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637275805, "uuid": "ae69f436-7efb-4c0e-a295-ffa0fb014e66", "value": "application/zlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275805, "uuid": "08a944a8-256f-489c-98be-29c4beb78395", "value": "f0b12413c9d291e3b9edd1ed1496af7712184a63c066e1d5b2bb528376d66ebc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f330e784-483d-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637219145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637219145, "uuid": "8c51f547-e126-468e-8223-664d9e30f984", "comment": "Malware payload (SnakeKeylogger)", "value": "49af250a802162285011eb047ee80788", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637219145, "uuid": "1b023b55-c948-4990-a46a-ac3271e5eb09", "comment": "Malware payload (SnakeKeylogger)", "value": "f1020cf2037e185458fdc38bc8d2b5c9215047b3e2e7e99e9e13ca74fce8e202", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637219145, "uuid": "34251a4b-a93a-42b3-a944-a62d11aec465", "comment": "Malware payload (SnakeKeylogger)", "value": "51d7b005eda1a452b7c42d82bb763ec2162b7558", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637219145, "uuid": "54ae8689-1e99-4e2f-ae6a-09867b150ee1", "comment": "Malware payload (SnakeKeylogger)", "value": "ac78ab78f0143c30d84797e73a6e1ffff292dfc0c97bfb685198c1eb458b7951f15d71e5a9e3181ba37001fc27bfdcff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637219145, "uuid": "f27bcab4-12c0-426e-8232-9b45517aae10", "value": "T141F4015032AC6B4BE53983F58A72A06043B53E6A1272E3DD5EC274CF2175F041AE5FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637219145, "uuid": "9c4e88f2-20d4-4eed-9c38-75c2ee29fe1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637219145, "uuid": "17868eb0-8ec9-40ea-bd75-27570d53528d", "value": "12288:WOBGTzK4k0IrA7wEXXgIDTD7dz80Zl6am1DaM1Tp3y3RjYazIStD00:jBGTO4k0IrAzTD7l8FaM11Tp3iYuISC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637219145, "uuid": "65a049e9-dda7-4d2c-a569-489aa2356dc0", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637219145, "uuid": "ba24016e-3d11-4e68-a714-072513ed9951", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637219145, "uuid": "0dc0ba38-753e-41c5-ba1f-ed12493b105b", "value": "doc2021171100303001010.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bfebfb0-4884-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637249251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637249251, "uuid": "55167df9-9ffb-4075-984d-cdea2e985aef", "comment": "Malware payload (Dridex)", "value": "e3f9210a7ba3403b0e386f0c5c25e623", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637249251, "uuid": "657c182d-91f6-4f6c-971c-9a3fa91f7c8e", "comment": "Malware payload (Dridex)", "value": "f1668c85b555e2c76538cbdd30418ccb6b29dc070456eee6bbfb14c55ba2244c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637249251, "uuid": "72ccb6a6-2a69-4e5e-b789-f1a5f2bdb493", "comment": "Malware payload (Dridex)", "value": "8f89b9c2be39f8a3cc95fbafdfbd3f8e777625bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637249251, "uuid": "231a0b6e-1672-48e1-95c6-bf0c88b17a56", "comment": "Malware payload (Dridex)", "value": "9f7560874667160fdc1b880f168c8ef9d22f92e553464302ff3d3554167f94810f7e4c8cf192e4cabf6fcf1690409784", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637249251, "uuid": "ad9e5b77-b558-463b-9ea7-6586899510f2", "value": "T1F9E48E0250D512FCFA898ABF155A67C1C6B310824ED1CB9E25CD07EADF64A03EE6D1B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637249251, "uuid": "f26f6502-bc7a-451c-9fc6-06745c422b1e", "value": "fe16443ce39f2fcea9c5accdb27a9eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637249251, "uuid": "ad6c32a4-1c6f-4110-bb56-0c206ef1e145", "value": "12288:xLTlJzJzJBJZn/JH3lJxJLJZJdPgA1VKBUA1rlldXJw:xLJtpDv/lVbdT3IA1wBUA1rlldXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637249251, "uuid": "c53f5921-b010-40cd-9b46-081058431f15", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637249251, "uuid": "87d16492-a7e6-460e-9e3a-57eef5595631", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637249251, "uuid": "9af4ad80-86ae-4228-bff4-6aced48dd3f4", "value": "e3f9210a7ba3403b0e386f0c5c25e623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad0f29b-48a8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637264872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264872, "uuid": "bdf92699-7a78-4e28-a784-adac23123b39", "comment": "Malware payload", "value": "fead400b99c449fec88e22453aacef6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264872, "uuid": "f84842fe-8095-4670-b5c5-e8a80b73619e", "comment": "Malware payload", "value": "f1fb6f4482571a4429e7ef7c75595303ac6c8367023d725dd3021db1015c3221", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264872, "uuid": "0869d624-63a2-47f4-8df8-41670ca5f9eb", "comment": "Malware payload", "value": "2b5813652bbbd68e9eb7bbd1235d952d9b127ba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264872, "uuid": "3f319b03-0f8e-43bf-a163-698ddcc446db", "comment": "Malware payload", "value": "5e80d442cbc192375ae81ec51a8498a7808929d64d27a8ed3707d69e20c645bf35efcce2701f835331244446c80bc417", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264872, "uuid": "e942b339-5974-406e-8f95-c767abff4edc", "value": "T154A5E00367EABCE6D075023067B78BD1872DED108694C99F66C454708AFD6837E2AFD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264872, "uuid": "7b756c07-e299-4e04-bc5c-8937089fffec", "value": "b9005a59919df3b1340483e40896aaf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264872, "uuid": "b5971fb9-73ac-4a33-adf0-c76c2e96c87e", "value": "24576:qA864/5Nhq4nm2/u0I8tquax5IoFlGP/TRRr6Si210iOBauD5HgpAFqb1chW5M7:qDLwObI8s2C3GI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637264872, "uuid": "76f92357-5fa6-4689-9148-0da4e3436651", "value": 2108928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637264872, "uuid": "33e69cd5-d9c4-4332-9c9e-e209e0765425", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264872, "uuid": "c226a43f-7d9b-4e15-b760-3ca36517097c", "value": "fead400b99c449fec88e22453aacef6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740ad888-48ac-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637266606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266606, "uuid": "cdd3a00e-8c18-4162-aa3f-36fe972fb4c8", "comment": "Malware payload (RedLineStealer)", "value": "e25438b6c7892bb93c9ce20a606d3b60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266606, "uuid": "391cbc9f-22f3-41a8-87b3-0ef6014742df", "comment": "Malware payload (RedLineStealer)", "value": "f2433dfba69148a0c3a5a5951d360b6c3c045090de06f11e273f13ccd01c42f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266606, "uuid": "c865f1f8-aad4-4755-aa09-3b941ea57413", "comment": "Malware payload (RedLineStealer)", "value": "924cc9ed33a64aaa2ee72f5ade42b03bcf40c7de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637266606, "uuid": "37e3b373-ea12-401e-98c6-68350e6a8ce0", "comment": "Malware payload (RedLineStealer)", "value": "446d0d9f539c47c3178733092802940aff05808bca8919683ca8e2ec15530e6fc67f3d7d40c3384ffbebabc966b15d74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266606, "uuid": "8f9e33fc-0c14-4106-a068-662d3ffcbce4", "value": "T1D4163311A9CCD862DE45253B0C67D507FBBCE9A80B2D92DA572086FE124CB13998FFC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266606, "uuid": "8e8db7bc-27c4-4724-81bf-3fa443ec6d96", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266606, "uuid": "f9e5d752-93ec-4e69-afda-10bf31ade0a0", "value": "98304:JYzkO+nC6W+R5DLYw43oJNla4vFaDlpRs0uS6D0JCSOYsJOYT:J7nW+/DMYJzaGsW0uSohOs/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637266606, "uuid": "d37b374e-5d6e-4c7f-89c2-0e606f75deff", "value": 4398418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637266606, "uuid": "8e580e41-0691-4261-9eb6-cb496db16eec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637266606, "uuid": "1b80f326-8068-4252-b73e-e56511b0b225", "value": "F2433DFBA69148A0C3A5A5951D360B6C3C045090DE06F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404b7caa-483d-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1637218845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218845, "uuid": "e4555b65-c1d8-439c-a842-2375525d2bb6", "comment": "Malware payload (AsyncRAT)", "value": "1d36b83cde4dfef847002e2df2bc5ffd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218845, "uuid": "12e99b3d-f069-45c8-886b-fc38e4e76e33", "comment": "Malware payload (AsyncRAT)", "value": "f27befc2a68445ed017caa24f7601a3d1e2ed4bf12a8b78bc0856bbfd94fdb3e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218845, "uuid": "70d07451-1289-4114-b230-48394abf81b0", "comment": "Malware payload (AsyncRAT)", "value": "af31b81092f2d1bdb42ba84e8cc7fa44920096eb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637218845, "uuid": "7c822956-300a-483c-8349-a778e745bcd6", "comment": "Malware payload (AsyncRAT)", "value": "ee088ae089f5da2d75c45e8c6e75d75ad9b90d7acace58ead90cdbab1dfa49196d6411565cc054d4dc8cd9118c48215d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218845, "uuid": "c83441d8-74b9-474e-8a3d-0bc0d999aabc", "value": "T16FC4D0A036B8C413E37480BAC6B0D7BA4F70716D0DD5C7827CAE6A9FB6597647C68312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218845, "uuid": "088931c8-346c-4765-98e4-7711a0f7dfc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218845, "uuid": "fd02adc5-7c6a-4030-86ff-8024dc9f2b00", "value": "12288:xQ3m31gW7ijLQP8zOD0V6bmrJ0icoHcL:xCm3KWmjU8yDpijW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637218845, "uuid": "c6f0f797-7afa-44ea-950c-1f5e25265da4", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637218845, "uuid": "acff571f-8d54-4e68-a856-c6e88d8ddd4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637218845, "uuid": "ecb2b833-faff-4ce3-826c-2c4b783fc472", "value": "AW00489899439.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2e326c-48c1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637275803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275803, "uuid": "1a8f4dec-2167-4920-8d35-e637bb7fe94c", "comment": "Malware payload", "value": "d15740e3612a56844208218c4e76e7bb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275803, "uuid": "4a0eaf6e-040d-4ec9-9e2f-266a9243ad17", "comment": "Malware payload", "value": "f31e42c04f0cb27fddb968a59088c4f1f099ca499baf3b1f045d7639f72a8b62", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275803, "uuid": "478551e3-e6c2-4f33-900b-3894d360fd99", "comment": "Malware payload", "value": "f7549ff73f9ce9f83f8181255de7c3f24ffb2237", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637275803, "uuid": "3658e39e-5021-4aa6-9697-38f245777c01", "comment": "Malware payload", "value": "9caf9e6d87c6d5c34b1c1b2b1c2c50fe9e9c40ca418ec84d1a21f502339646d832792c6d444809ac5e8861e1b12fac3d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275803, "uuid": "3fdec498-2fa5-4a64-adf5-208e291de8e0", "value": "T1FCD05E44620398CE6443582CFC8C5567285079A3FB452E00B4B56C28B472788B75A966", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275803, "uuid": "22b24b22-8011-496a-9b43-eca5ab9fd9f0", "value": "6:uSS/G3iRGGMx5bMXqiiM7Q1Wx5vxGMXwyRuXhRVDVMGMXwyRuXhH:u7hh627QcT1buPObuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637275803, "uuid": "0639a613-a61e-4448-b6bf-f2796e61b3d9", "value": 253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637275803, "uuid": "367e7b38-5e44-4bc9-86a8-693619d79aeb", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637275803, "uuid": "f0ff0cc1-6676-4175-b3e8-8af8d239a6a2", "value": "f31e42c04f0cb27fddb968a59088c4f1f099ca499baf3b1f045d7639f72a8b62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd058f65-484e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637226463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226463, "uuid": "dfa4fdb5-105c-42ea-8db9-2a42129a1d55", "comment": "Malware payload (AgentTesla)", "value": "ab1a55ff5c9773dd4bab9978e7d3cfb3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226463, "uuid": "bd18cf99-815c-4272-bbb5-1cb8034aba86", "comment": "Malware payload (AgentTesla)", "value": "f47db1f1bf519df46ef7fde7e480d662ab6f3fc5f6f7c74d0a8805070b7de930", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226463, "uuid": "fbf8078c-a250-4569-9e3e-d94acbceaaa8", "comment": "Malware payload (AgentTesla)", "value": "a40efea5eb61ba1711f5a57e2fc5d7ece21775fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226463, "uuid": "382c3ee5-8db2-447a-9434-cfa128a735d1", "comment": "Malware payload (AgentTesla)", "value": "acdf78f68e3b2cdc0524eb16c52cfa7114b44c771318b59375e521c0442a84668d9a5c84b6b4ad396da16f57f5d2c167", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226463, "uuid": "1220dc27-4d2e-45c9-b820-5f1478e04752", "value": "T10531ED1D0B50E1D153D217677A3AA89AE2878CFDA85C5553C648F4887C0C03DE7E9AB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226463, "uuid": "e4635bd7-b076-4a76-a1b6-5a5e125d0509", "value": "48:oHK/q4l8YbmlCEoo/iAoSiVuVn9OlMdj8EGe1RcULiA7GL:oq/Xl8Y6l8oUSD9yAj8EGycuiAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226463, "uuid": "116de8d7-ce42-4ea4-8f16-3ef5656a379d", "value": 1874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226463, "uuid": "0d9c4e9d-0ff2-4569-94c1-49ec0ec00a63", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226463, "uuid": "37e3bc91-6eab-4c8f-b063-e87e61ff4995", "value": "\u03a4\u0399\u039c\u039f\u039b\u039f\u0393\u0399\u039f \u03a6\u03a0\u0391___________________________________________________________pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2455c62a-4803-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637193887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193887, "uuid": "1df8513d-7ac5-4a27-bf05-f7ac88104486", "comment": "Malware payload (Heodo)", "value": "7feed097712e80bbbe882f2da74fb240", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193887, "uuid": "2d9a431a-ade5-4eb3-8dd5-dd34ccfc2771", "comment": "Malware payload (Heodo)", "value": "f504a1b86a4d5f7ea63564ebd4371a39bb8f370aa6cf1825f287d845274f237a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193887, "uuid": "e221223e-43a4-4e72-833d-415d61e78a7b", "comment": "Malware payload (Heodo)", "value": "51255e076c19169dbf6180ff7cdab967d4b459c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193887, "uuid": "861b0372-4530-4233-b0ab-84483b9b5e86", "comment": "Malware payload (Heodo)", "value": "edeadae4a6ecb9c98e0cedf3c1a84c97c7a8b19be24869e9c16c60a0698af1ea9b3d780f5bc8e1c8d29dcde54303b2e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193887, "uuid": "2cf75421-3a0d-419c-889b-7781946f23b5", "value": "T17344BF10B1809032E8BE593645FAC56A4A7D7A600B94DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193887, "uuid": "11cc0f67-f710-48a6-aaca-fed353728256", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193887, "uuid": "c0781d3e-1e90-4a44-8b89-8418053faaf7", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBf6asb:prf+WPVXNcwUKaWTqb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193887, "uuid": "986636e2-6a01-4383-a7c7-0fe739807c58", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193887, "uuid": "287411f1-2246-4405-aa2f-54d641053fd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193887, "uuid": "5680b0be-6379-4789-8508-2ea5d4c034f3", "value": "7feed097712e80bbbe882f2da74fb240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc770d2-48c9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637278973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637278973, "uuid": "e9dea919-e09d-4f9a-9a51-0bd57823efbc", "comment": "Malware payload", "value": "e2e3786ea739e6e42c6c0e05f16bf346", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637278973, "uuid": "b70f6272-518c-43a6-bb83-52d77ba88b8d", "comment": "Malware payload", "value": "f59493ae6a82fd6b2bf7e7d17ab3d9ce1fe643a33dc13e24b74e9c1103535a07", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637278973, "uuid": "bec8cf73-ed3b-42e8-82e5-7f26d3d0fdfc", "comment": "Malware payload", "value": "eb3b0d118c77150e78afbdeae76ab2a51e3f0e78", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637278973, "uuid": "c824b25e-bbb6-4162-94e3-26ac8007d45e", "comment": "Malware payload", "value": "71ad8b0e9db0827e7e430741c6bd7b90662cd8552836f104e51b52a72550e3d95d701addee6ba26314852fe9e039189b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637278973, "uuid": "a8cc32b7-212a-47d5-a0da-2c26a9617ecb", "value": "T1E5A44293876027ADF1940EDE80DA712371F1E46B7C2F2259BBF3AAD7A83B9454430725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637278973, "uuid": "34d261e9-c4fb-4ab2-a503-3911e366b797", "value": "1536:4LK8RsbkdAiZPtiOnxj+nmRdrkun4lG+BJnHFn9wkkYKQlD+gv8t5qohMepaW6HQ:KhvZt3+V12pqQNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637278973, "uuid": "87345751-bc8b-4f1c-af29-3155d74412b1", "value": 469909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637278973, "uuid": "e4b0cf05-b558-4f77-84c7-1203bd1f860a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637278973, "uuid": "5a1e0239-8e8a-446d-a960-2830877773f0", "value": "ReadMe[2021.11.16_10-19].vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313cf597-48a7-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637264346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264346, "uuid": "d0ee7119-882f-41b4-a9b5-fcecf3248c85", "comment": "Malware payload (Loki)", "value": "0f3136e10afca292ec03a5a672724220", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264346, "uuid": "79f81ec2-7e1e-482d-a3d8-47a8162f8858", "comment": "Malware payload (Loki)", "value": "f6abd5c921b3194d507b71a74100ec437beda9a33627b254d0ed81e88d209bbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264346, "uuid": "aff08205-85cd-42db-92fe-a1f49462cc36", "comment": "Malware payload (Loki)", "value": "43e48db1fa8182f57b240573d0c655b16c3a9d73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264346, "uuid": "9e0ca060-98a5-4afd-801f-50beb608da6d", "comment": "Malware payload (Loki)", "value": "8f567005dc6cce5587e37ccb154cd14add0bd59d413503ffc59ac72d1bd63ded22405adaeda1cd4f3faac1bdec12bd70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264346, "uuid": "7ba3b147-4ecb-4f68-961d-42f53849d29e", "value": "T1D77412D2FAF4C873C47009B88C36EBB4A57A7A225955262377B4BF5DFDB0381480D25A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264346, "uuid": "6e666ae0-9303-4f5c-a8a8-1b3db28ed41f", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264346, "uuid": "ef509f00-d460-4680-9d79-8c7ec68da1dc", "value": "6144:k989vpnR5zUH3Qs7MmBELSKAf2tToJjyW+YBhVu2yLhDJtkGiq/:t9vp7zUXB7MmBELSets5+YxsLxJt9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637264346, "uuid": "8f5123bc-e2cb-4e93-b5c2-a2cc5dca65bf", "value": 338831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637264346, "uuid": "ff314f37-15ef-41d4-9fca-b3f7f2246cbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264346, "uuid": "5a843e44-eb50-4293-bc21-54ada114de65", "value": "0f3136e10afca292ec03a5a672724220.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ace545-484f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637226558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226558, "uuid": "5ae20675-7006-463c-88d2-62eee5b85538", "comment": "Malware payload (Formbook)", "value": "a1857da24d0155962a0c63463dbefda8", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226558, "uuid": "4cb92ed5-12ea-46d7-9175-c9da8a3049a4", "comment": "Malware payload (Formbook)", "value": "f6b010b9ffdd73dcededbb0c24943d0dd5ccd18334f4dbe8cae4c098770253a5", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226558, "uuid": "ad582afe-b9b8-4cea-ad11-03d4416d04d0", "comment": "Malware payload (Formbook)", "value": "9268d79bb40c0da1e3759a7e1e5cf97e2f42e64f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226558, "uuid": "916eb877-cada-4aab-8d46-45a236a53ccd", "comment": "Malware payload (Formbook)", "value": "afc7d1b92216b5e8c701b9330c25fb90b0f45051b678091ecc4b41182a7e753fa76828b537f354c5d049e605e7ad0cc2", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226558, "uuid": "18c59f19-00ce-4596-bcf7-d0866a325dc8", "value": "T14FD4D0A036B8D427E77081BAC5B0C2BA4FB0B16D1DD1CB467CDE6AAF76587647C18312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226558, "uuid": "550bf313-cba2-4a6c-8dac-da8196c98505", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226558, "uuid": "f224c1c0-25d1-439c-a0d1-ea344aafec1a", "value": "12288:CCm31gW74aaGsi+EcD02pVneiCGg5Hk5yR6r1Ug:1m3KWkoFvcDvpVeDGgdkQR01Ug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226558, "uuid": "2d0f8a94-19ed-4f1f-9779-b1f702dcd08f", "value": 617984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226558, "uuid": "1d54d334-deb0-4f06-9cef-4f601eabd870", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226558, "uuid": "3c2b121d-84e0-477b-9117-3210c5fcab6f", "value": "DHL_AWB_NO#907853880911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227ecd47-4818-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637202903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637202903, "uuid": "a7104928-fc4f-4abe-aab4-1a6316ccc216", "comment": "Malware payload (Heodo)", "value": "bb08953deba6b3c0a6ea3a47e1815c10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637202903, "uuid": "8768d574-428f-4784-8360-13dd12ded5a4", "comment": "Malware payload (Heodo)", "value": "f720623fb31193a0f67a275fa8ebfe9c726abf205cb2eb42f47140c71457fd8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637202903, "uuid": "1bad6102-c88b-4dde-8bc2-dc63369b43cf", "comment": "Malware payload (Heodo)", "value": "5ebf6fb92b5b8fe467b6c0956af9c8fdbe753ce7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637202903, "uuid": "ed5fd153-05b9-49a3-aca3-282c73688bf8", "comment": "Malware payload (Heodo)", "value": "6004355fba568593c756b475fb5c18c42dc231a4d6192cc1b09c51fd7b38db8a3dc77cab762b2856c24e347a2148a932", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637202903, "uuid": "76983a84-eb22-4937-9399-3964c7f5b6e8", "value": "T18644BF10B1809032E9BE593645FAC56A4A7D7A600B90DDDFA3980D7E4F775C1FA308AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637202903, "uuid": "092ac735-28c5-4536-96fe-9048ca9a99dc", "value": "40466f17b358a99b820ea49437b26ce1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637202903, "uuid": "29247e70-6fae-41bc-8717-83e697c3793b", "value": "6144:pr/2KrKIHdSMRXQWh7XNcwUrmGOj7l9SWTBG6asb:prf+WPVXNcwUKaWTzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637202903, "uuid": "e65b3f34-1792-4382-8166-997ba557f4a6", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637202903, "uuid": "cdb16378-b966-4444-bce6-fbb7c4efd600", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637202903, "uuid": "d9ccc58d-976c-4fa6-acd5-854adf3884c1", "value": "bb08953deba6b3c0a6ea3a47e1815c10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd833cd0-4851-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637227645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227645, "uuid": "f1b53207-503b-4ba1-b5da-ee056d7f6d85", "comment": "Malware payload", "value": "ee58c3381673c363a4bd45ad6f100a61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227645, "uuid": "a7901bfd-9da7-4850-b280-a16219653258", "comment": "Malware payload", "value": "f743ea1d7801c0d52ae7c1ec1f5ff960e606855d37ef30e8a1dacdbfc8ab766e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227645, "uuid": "82570fab-cb9a-46de-9bc3-9a81ac9ca2f0", "comment": "Malware payload", "value": "85051817bc95d890446541b19aeeac676e9b456a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227645, "uuid": "50df48f9-0e46-4538-8aa2-c3b6239e85f7", "comment": "Malware payload", "value": "048f4270197d02c948ffb2c21f90972acae3221d07e0dc892a998533f1d25ec45d8f07de4a9198965a19b4e79810e4f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227645, "uuid": "d71c648f-b2ae-4835-a2cb-ed0652f4c183", "value": "T18DD4D010A7A0C038F1B752F89A799268B53E79D1673494CF63C516EE4A34AE1FC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227645, "uuid": "c2fe91d7-c4fb-4178-97af-66b2bb04ab01", "value": "b2e29795cf26e2405a95e142d139ea34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227645, "uuid": "7eb70e1f-1d3c-4ebc-931d-d384b8da6001", "value": "12288:33xR3inbtHi6PQbJNdCqNnxbo+t5zYwy0DmLH77fpos485Zp:33bSZH4tJzYH0SLvKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637227645, "uuid": "c2b3e2ed-2341-4ae9-9e17-fb304847cb72", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637227645, "uuid": "acc204e3-da8e-42e5-8e86-fbb940e2cece", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227645, "uuid": "c12d9005-a658-43fc-9a76-5f8e2790d417", "value": "ee58c3381673c363a4bd45ad6f100a61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a858d922-4850-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637227180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227180, "uuid": "1feaa0f3-61a7-4c68-81ce-0229eb7be159", "comment": "Malware payload (AgentTesla)", "value": "efef4998466f1adff35a4817ba5bffa6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227180, "uuid": "a6c9eaa8-b424-404e-a7f8-b33fc34f827c", "comment": "Malware payload (AgentTesla)", "value": "f77c38aa6e165d296f2da40f47122148c400223fde809e38a9980dfd4b21aa6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227180, "uuid": "b248e3b1-d72d-46a2-817f-5709f4376c68", "comment": "Malware payload (AgentTesla)", "value": "2d0510f53e78da9b9cef3119df1b2834f9c162b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637227180, "uuid": "aff7fbf8-a223-4f41-be22-9fc17f3a1198", "comment": "Malware payload (AgentTesla)", "value": "137f409b1da6a145d560582b58ceada88eff3d893155f51b719d9904281424595f4302668e4c15761bf010e466c732b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227180, "uuid": "2bc03f4d-f346-4d43-a577-50881291ac93", "value": "T189E4E0E03AB8C413F770817AD6B0D27A8AB0B26D1DD6C642BCDD6ADF76597607C58302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227180, "uuid": "ec9e6c72-5658-44fc-a64f-0bc031893e44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227180, "uuid": "f8ccfcdb-a9c9-4c3a-b3e5-902a32f48dc9", "value": "12288:3lApKm31gW700iFZUbrbJjU+iX217b4I5DDXxkEF6b51Ik7h:1ApKm3KWnPrbJjRsUhDhkG6bzIkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637227180, "uuid": "c542f702-0349-4fb2-8946-732ddd257867", "value": 673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637227180, "uuid": "9e6dde87-c2cc-4a17-8ba9-884d95e5e864", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637227180, "uuid": "e89a17fa-0d97-4a32-ac50-cf9e1cc73db4", "value": "Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd3cce5-4802-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637193633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193633, "uuid": "8e9f5a5d-9bfe-475d-a87f-16f0a8fce631", "comment": "Malware payload (Dridex)", "value": "fb53dc44417848c021be37ee544d491b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193633, "uuid": "96a17135-45ad-42e6-8c97-1a7ad6f1bd30", "comment": "Malware payload (Dridex)", "value": "f7b46e3c2f71ca5e0e93e90ed06f667b1f0b308f723a96d736f0f6d9534e2d7c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193633, "uuid": "90802ba5-a6e7-43de-9379-9869b13115d4", "comment": "Malware payload (Dridex)", "value": "9a519d682439c65a194b32141c39744b8350eec9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193633, "uuid": "e43cec1f-c39b-42e7-b2a5-854180fe78c7", "comment": "Malware payload (Dridex)", "value": "06cd747d87b3a490c211b2dcad4a66626106e0790a75c6be0c9c24908b717a00502a44122aa03a6bc00582e134b40637", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193633, "uuid": "cbd94642-518a-4130-9589-b15677425a0d", "value": "T127E49D067CF9989CD511ABBD421E86FB8BB089B784D0CAC1C1199F3A5C07BDBE54C66C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193633, "uuid": "e01fc9ef-76eb-4d26-b740-f8f7a014d9f9", "value": "43b460ede91c0828a2b4acde6b98d16d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193633, "uuid": "e29bc314-25cf-4840-bcd4-f01b6dde08b9", "value": "12288:H9we+YtfLwxfZYnfh0xnf2xfH6xfpaEdk9qcK05GDdiO2cGoOUwgtJ:H9we+YtfufkfonsfYfpuN5GxiO2cGoO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193633, "uuid": "2e338495-7a86-4f18-84c8-ab5db83fb88c", "value": 668520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193633, "uuid": "2572fb3f-dfda-4d9c-9280-7e28ea352bd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193633, "uuid": "c62ea20c-bf93-4b94-a9b4-c3ebdac8000d", "value": "SecuriteInfo.com.Trojan.Dridex.777.28537.3489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f873b6-48ca-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637279578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279578, "uuid": "d085752a-e8fc-4caf-b502-3f0790487f25", "comment": "Malware payload", "value": "1436a43cdd37d5e362b0699552b446ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279578, "uuid": "a8febcb9-91ef-4f2d-a856-8d85fafdd475", "comment": "Malware payload", "value": "f7c6e16173099ee6d999c37b5eeb327446cb836ff6c5455454cfb22775fb9624", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279578, "uuid": "6bba616c-97a2-41d2-a29e-d9324beb111f", "comment": "Malware payload", "value": "c3c2a766ecd7b01e4aec5810ed5dbeff6036c432", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637279578, "uuid": "dca48424-0ca6-4f1e-9a6a-4c12ed8e0825", "comment": "Malware payload", "value": "407dec187c04a1a748eab667d2d2fdc8bd83bb7a58f8a8762f4a9265beeb723468fc1240b3c0470f570c28e4c9a2480b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279578, "uuid": "1ff64a65-47e4-4182-8161-bef8f6d11346", "value": "T19DA4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279578, "uuid": "b0dc1d04-eeb7-4a6f-b8c7-4c5216d2d83c", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279578, "uuid": "efe87438-50a1-4805-bf0c-3f6b0139a03e", "value": "12288:bdv8jkvzqZvv2wLBqmTi12yD88kYwZ1h1:b2Zvv2cdTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637279578, "uuid": "e0b62ebc-4ea9-43e8-a5c3-be422f5e4479", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637279578, "uuid": "94d80c2d-0453-42e0-bd74-b4424a5380b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637279578, "uuid": "13535094-68df-4c7f-af89-5ba4012185ca", "value": "1436a43cdd37d5e362b0699552b446ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "156e4fbb-4803-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637193862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193862, "uuid": "2c3ac0ae-f9fa-4d9a-b835-94396673729a", "comment": "Malware payload (Dridex)", "value": "e74f752d5148ca154e92cd611c27da7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193862, "uuid": "6c8aafb5-3ae8-4b02-a3c6-075ce15a70f2", "comment": "Malware payload (Dridex)", "value": "f81dcc275ffa54a53ed99e79aac49e274b1ce833b5c0c2fcfcb80a33da6e0408", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193862, "uuid": "f2e96bd4-c648-4e1f-82ff-f6e8d0988998", "comment": "Malware payload (Dridex)", "value": "3635c34caa0a04d45832517fad2521e19be53890", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637193862, "uuid": "aa267047-9ca3-4d50-91ce-14320d48bbae", "comment": "Malware payload (Dridex)", "value": "7eb9d0448fc78ede99d167942f0201cf132d0bac07040740a446a4d2acef4c495c0b61ca476810ddd273c1393e01d313", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193862, "uuid": "a5036742-4d33-4c91-9170-51bd2e5794a9", "value": "T1FBE48E0250D512FCFA898ABF155A67C1C6B310824ED1CB9E25CD07EADF64A03EE6D1B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193862, "uuid": "d0949fc4-cc55-424b-b937-994b5b006629", "value": "fe16443ce39f2fcea9c5accdb27a9eac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193862, "uuid": "76c752dd-1934-403e-b945-c3c418507813", "value": "12288:7KTlJzJzJBJZn/JH3lJxJLJZJdPgA1VKBUA1rlld7Jw:7KJtpDv/lVbdT3IA1wBUA1rlld7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637193862, "uuid": "84629b16-d6f4-4f6d-a776-97a004e11fe8", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637193862, "uuid": "2ebd068a-53da-4e89-8fa1-1c0146d6ce29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637193862, "uuid": "f7ed4a8f-957d-472b-a6fc-56bc7b2bb792", "value": "e74f752d5148ca154e92cd611c27da7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2595858b-4844-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637221806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221806, "uuid": "563ef078-bc1d-486e-9392-98e454137928", "comment": "Malware payload", "value": "8960a6c5bf496655c60dc74b16af4cd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221806, "uuid": "1c466125-2f2d-41d7-b3a6-2fd8602d67ba", "comment": "Malware payload", "value": "f83283fdca4d68ce2a217ab7fe1882c9c01d33a9d5d1daeeb4ba7441c86ab796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221806, "uuid": "d193d769-c3d0-47e5-9818-11f697d32aa0", "comment": "Malware payload", "value": "d03e66322146bdc031d7dbc0e89868e34ffe7a1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637221806, "uuid": "89f8d065-381b-4631-b65c-a6a381f32297", "comment": "Malware payload", "value": "7c6619e6f3f8fcb8037ecbdc33b1918c736b11c5209d28d1e2c89a7fa1f53ecb63539265079d023657a475cefec38f55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221806, "uuid": "5837db1d-f4eb-4266-a22d-ad3a550ccf69", "value": "T1D916335059C012CAF694DD1E17DC3A35123FEECF78B8AEE3955283F1040EE89DA72696", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221806, "uuid": "9581dded-7550-42a0-a8bd-b4d6e47e8509", "value": "98304:G1wwAjzIQOMK2GNKslgus10Y1/UJ7BdlRbTBAlYVl:G1wwAYBr21uQsJ7vTBAlYVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637221806, "uuid": "87e28e9d-4f99-4374-92cd-acee64b519ed", "value": 4030464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637221806, "uuid": "8ca28ee5-a32d-4417-ace5-375f1e1458c0", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637221806, "uuid": "9730218a-e619-4fab-a99e-7cba00fc29d1", "value": "f83283fdca4d68ce2a217ab7fe1882c9c01d33a9d5d1daeeb4ba7441c86ab796", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350f092b-484e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637226127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226127, "uuid": "404ecce5-7d2c-4d50-b8d0-41c72649e1b5", "comment": "Malware payload (Formbook)", "value": "fd6ff9a3ba374a4290ed0a71f3e89791", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226127, "uuid": "46b6bb86-7985-4e37-8a37-b419f7c8c37c", "comment": "Malware payload (Formbook)", "value": "f8a2170214e5df38843bc6f19229cc0d136c3f34b4d856a21b3a8e8d6e4411d4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226127, "uuid": "4253839a-025c-434a-b93b-c029375a0657", "comment": "Malware payload (Formbook)", "value": "b56a72bf87cf0a93a4d3ae6023d03c1ebb3e123b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226127, "uuid": "63635010-66e7-4e5c-a687-4803ec9cc26d", "comment": "Malware payload (Formbook)", "value": "87bbdba34270bb4bd3e12b990b683a889d28871dabcbe79c67e45278f1949855427404b6f3e542d2d1b45964de9eac9a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226127, "uuid": "5918c95c-fc8d-4347-ac4a-8a4f2ec34e4d", "value": "T18134129E7AB6D694C4BADA7818415C1D01F9CC4F2AE89B873638BF3F857019E076503E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226127, "uuid": "306bbaf0-8339-4855-af35-9c3e0cd4e3d0", "value": "3072:Lq06lfJgNLaUkKKMOm4T/FA20O7gmVtU1YPDwkY3pX2+jNBvQYhJixzFUxYdpOeO:eff6N2Uk5VLcORtnDwXpXVU3GYrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226127, "uuid": "528db926-3982-4d6b-97ad-ad090e64cb74", "value": 234088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226127, "uuid": "2fcc5070-2666-48f8-b944-30c35bad4102", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226127, "uuid": "7d03401d-d5a7-42c4-a9e3-6707fdb3607a", "value": "MT103.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee382617-489c-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637259939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259939, "uuid": "4d5258f1-38d8-4c4c-b80c-1ece2088f96e", "comment": "Malware payload (RaccoonStealer)", "value": "cbe78f49928a2bbc6c46821916341ce9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259939, "uuid": "a567a107-0fe1-4e33-b6d6-ec15a6daaeb8", "comment": "Malware payload (RaccoonStealer)", "value": "f9538a62c81e984612d1d1ff8fbaf4dab807f02f89a119d798267d9c88974236", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259939, "uuid": "84b4a8df-bbde-4089-b7c7-8835ae9c7a37", "comment": "Malware payload (RaccoonStealer)", "value": "c1ac34af968e8b89370b7f9319ea53a05a924581", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637259939, "uuid": "661ba402-d5a8-46f5-b323-e25649cedae2", "comment": "Malware payload (RaccoonStealer)", "value": "bd47b4f7d5b083ff1dba49b448c58f80f574548e9119814684d84c25b463dae90a2095b9836eef2f0d59d56740f1f35a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259939, "uuid": "919c1ca9-c23a-41df-9ba8-12795842af6a", "value": "T1AD74BF10A7A0C034F5B716F84A7A93B8B93F79A06B7594CF62D517EA4634AE0EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259939, "uuid": "52e64da8-57ac-4566-aead-bcffaf2396af", "value": "9abf03d4e22c0a12cb29c8d67fb192e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259939, "uuid": "38181516-9d16-4a3e-8c48-02a276717ceb", "value": "6144:u9PmifDrUg7mju5zqWikOVt5gkRVmHiflhCCPpOGd6A7DHf6n6Mbf:KzrLmju5zqBkoRffCCBOGdzf66E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637259939, "uuid": "1949dac4-cd5a-4f6a-963f-5c63e846608c", "value": 363520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637259939, "uuid": "7518cbc5-1d83-47a9-9559-9adf56b14a93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637259939, "uuid": "20c238a9-d49c-49c3-bf75-067a9f59f86e", "value": "cbe78f49928a2bbc6c46821916341ce9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5d8ff8-484f-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637226592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226592, "uuid": "a750a62e-106e-4a12-9c57-3876a158d86f", "comment": "Malware payload (Loki)", "value": "ed007fcc4ec15ce29e329b471e2b6113", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226592, "uuid": "f2deba42-cb4f-48d7-a938-3953dc39e71c", "comment": "Malware payload (Loki)", "value": "f9c2b747839352721a0e7c4bdcc41e32c3682f0adf9e0f6d9253f4573280093f", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226592, "uuid": "bb4252a7-eb23-41a4-9102-b2d5eca935e5", "comment": "Malware payload (Loki)", "value": "803807caa59f8bdeeb1d9d74a59960eae3ee6ec2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637226592, "uuid": "2ae3af1c-78bf-47a2-8729-18c885295973", "comment": "Malware payload (Loki)", "value": "5c9898355908e17a8dd72a58437ae7bfcdd7e7e53782421b0218ecf12d8a7cd12c5997d419ad3f5b6de4dc8eec663305", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226592, "uuid": "6ecb4aaf-5180-40fa-a016-180ab38118b0", "value": "T16CB4BFE03AB8D427E37081B6C6B0C3BA4BB0716D1DE5C6427CEE5ADF76597647C28212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226592, "uuid": "08b4b879-46e0-4122-8fc9-b16533f393ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226592, "uuid": "dab2e2dd-74fc-4d2c-9da8-44fb979edb17", "value": "6144:FpX1flUa3HXkh22hlECn/KqS15VIFI7M5IBOyVZsPl+3L36k4YwWBkbLFXGpvg6E:n0m31gW7jqkJwW2F2pvjUVvBB9jdhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637226592, "uuid": "5f71d870-85e7-4064-9bd5-3111c45d60cb", "value": 515584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637226592, "uuid": "2f18c58a-75d5-442f-8273-3fa21652f819", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637226592, "uuid": "3feea08c-fa46-4500-8752-334848e40c45", "value": "DHL Delivery.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90c40ec-48b9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637272278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637272278, "uuid": "121ee9b9-2203-4d40-a929-c01d64abe527", "comment": "Malware payload", "value": "f0e359383a73f7d464540459a7f89312", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637272278, "uuid": "0f061009-a6b6-4934-8b0a-f8a7263391fd", "comment": "Malware payload", "value": "f9eb654cc9e4cc924698577af948463684ef800491f59b4fe6af70eb143fd8c5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637272278, "uuid": "d23025fd-87ad-4565-a338-a2f0ae4fa3ad", "comment": "Malware payload", "value": "f5dfb4b0470756891eee9fb5c5a730d8d5eea0c1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637272278, "uuid": "b1ecc747-1d16-445e-ab35-47a585ef9bf6", "comment": "Malware payload", "value": "e4fb081aac33c90ab333f7779b9c75287f56952a4dd1d2b7113fac3b91ce914fd9b5519c4fb84ed95e4e43a466db6ccb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637272278, "uuid": "0879cd07-be38-4b16-95b6-029b792eab90", "value": "T195A4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637272278, "uuid": "9dcb64a1-2dbe-4043-b3cf-7f7769310f2c", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637272278, "uuid": "3b56c012-f5e0-45f1-8db9-fb999eb9a07c", "value": "12288:bdv8jkvzqZvv2wLBpmTi12yD88kYwZ1h1:b2Zvv2cITi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637272278, "uuid": "f07b6078-6c79-4ec2-bbba-ebeaa2289899", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637272278, "uuid": "637a7443-55ab-46b6-87f6-8c4276d8d846", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637272278, "uuid": "04509a71-630f-48bf-8a1c-2443b50689c9", "value": "tTfk9asd6bvDy.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9360af-48a7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637264286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264286, "uuid": "d8480c4c-dc81-48b2-98d9-6e0bf19cb9a6", "comment": "Malware payload", "value": "a1dd68d7646eb95cdefe512549b2633f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264286, "uuid": "e878ae90-e3e3-47b2-ab75-e27af18fa9a5", "comment": "Malware payload", "value": "f9f88178e9c1a500efe531b078f76d216d7cb4bc8f22b1ca7f06c6d8aceee103", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264286, "uuid": "8dacc98f-a516-48e3-9066-2cddca45cf90", "comment": "Malware payload", "value": "7aa7fa1927ddcfe5f05828aed598932028aa366e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637264286, "uuid": "7e784a74-2e78-432f-93e8-5ec699b01076", "comment": "Malware payload", "value": "d81104328a717c08394fc04720700c3e27981a61f1696e477a3af9e3de5aa090c903221aaef120d95553b72541992624", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264286, "uuid": "f2c36918-ec29-459f-a28c-0ba6d1c25f6e", "value": "T175835A11A7F91028F3FB6F70A8B246855E3BBDD1BE76C14C4A09044E19B1E68CE79727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264286, "uuid": "39ba909f-730b-4f68-80cc-84357197703f", "value": "1536:dbrUZpmeSyLJefms2/auIXD7rqXU5yPLmpFHtlaanI4+F1wE1LRCJyB:d0Zpm7yL6ms2/aNXrq2y4FHtbnIJ1wEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637264286, "uuid": "f8a998d3-18f0-44ad-9efa-1ee8164b62ec", "value": 86565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637264286, "uuid": "b13f260e-8911-4ce6-b411-ff7b48f67482", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637264286, "uuid": "18da7545-0d0c-4c98-b8cc-e79e9a205c36", "value": "a1dd68d7646eb95cdefe512549b2633f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7353726b-488c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637252860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637252860, "uuid": "01d31a5e-c5bf-4df4-8d0a-5f30f13ec1c0", "comment": "Malware payload (Formbook)", "value": "5ae44030c55c06a01bf8b26f7da83812", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637252860, "uuid": "99096fb6-dc4f-4dfa-91dc-0a08614b35f7", "comment": "Malware payload (Formbook)", "value": "fb7b02dd76b957a77d08140c406d9c0150064190e5e3a2e4c5db77fb01d29ca2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637252860, "uuid": "436bb93e-5969-4285-948e-33bf6ceeb021", "comment": "Malware payload (Formbook)", "value": "54aa0f69ca54a2775b5b0fb31ec2a2580461aa43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637252860, "uuid": "19ba6de1-7c23-489c-a737-84e4779275bd", "comment": "Malware payload (Formbook)", "value": "556e448f03edfb4817f497703a16fe72a4e4945097e240276308358ca934d504d079499cf68ec50b333d213e8eadc7f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637252860, "uuid": "3b0641c2-f502-424b-8f16-a00edb3fafe9", "value": "T1BE44124832D5BA6FD8C301FF4D956DA44256BA0B838ED70FEC036091A71E778C8166A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637252860, "uuid": "e2342a05-3419-40ca-a13d-aa8bb50f889f", "value": "6144:OZ/gBJojtgqssFBHx0L47CIaKA3+ICsDZQP3tsys:OZ/u6Wq1r26aF3+yyuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637252860, "uuid": "14a9decf-fad0-4855-8492-0ca00cc6cb2b", "value": 263168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637252860, "uuid": "8e986535-1187-47e8-bc44-d61811a1bc09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637252860, "uuid": "796f9554-1161-452b-b5ea-dad52dc295b1", "value": "5ae44030c55c06a01bf8b26f7da83812", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a4222b4-488a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637251959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251959, "uuid": "817bb19a-effe-4933-b6bb-511369ae8d2e", "comment": "Malware payload (AgentTesla)", "value": "2fde51871263c2da2e195d2f6b463677", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251959, "uuid": "95e33b7d-799e-48a6-9c95-734435c6b56e", "comment": "Malware payload (AgentTesla)", "value": "fbd1f0a0dfab2ca6d3d2fae98b8909c999193fae84ba9f557933d2555613ebc9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251959, "uuid": "e6248686-693b-4124-9c3d-5c09e6188b47", "comment": "Malware payload (AgentTesla)", "value": "d71da64b79bcd7039d083c4d7cd4d914ad2c0fff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637251959, "uuid": "49da7b6f-be9d-49f0-8367-cadf0c9307f0", "comment": "Malware payload (AgentTesla)", "value": "26be1c23152a5aef19fa57ec690735c905a19a4a04243fabda158d01ef86d3d841629a787bec49dd12c2898ea6a8078d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251959, "uuid": "ac704bea-56bb-4f58-ad59-5033a08e6edf", "value": "T1FAE4AC27627CC6E6F9AC3EF45218A7250AB55E926435E207E98F7CCAF973303C4146D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251959, "uuid": "6601fc22-7d8f-48fd-aa74-c4ad9f0314a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251959, "uuid": "f1dd69aa-0bd0-40a6-8ef2-208119ae8dfa", "value": "6144:sJ9fBfq9qUtDXMtltXAFaoob0Gk97vgRHbscvmVlMFJJRoWQt5WKIhhIkqcJxv0B:sJ9ZfWmDpb0Zg5gcvIlgJEHHWP+ol8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637251959, "uuid": "e59a7134-5491-43e5-a669-cf5e4ef85a7f", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637251959, "uuid": "e90b9490-9b4d-4e0d-b8ac-0fe6ffb588ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637251959, "uuid": "9153004d-2d25-4684-8579-7781a826fba2", "value": "m5zSTVpuUlzkhc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72260e93-485d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637232672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232672, "uuid": "36ada7dc-0c5d-45a2-b7a0-69c26238ffdc", "comment": "Malware payload (RedLineStealer)", "value": "d0605c3d557111c14c52eb052f590fb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232672, "uuid": "7862a5ac-7542-43a0-a19a-dc1e5d306639", "comment": "Malware payload (RedLineStealer)", "value": "fc6f14a2439d46ea38a0a40a0b58735c6fa3ba00472f5a45247f19bf758e41d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232672, "uuid": "7545b802-c93a-4e89-bb7f-003ffd57948a", "comment": "Malware payload (RedLineStealer)", "value": "447d3d36c0cd1146cb4a9ef7ce67b1f5cfa0dba4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637232672, "uuid": "c21c5386-d320-4fa5-a4c7-d65503ce377a", "comment": "Malware payload (RedLineStealer)", "value": "2947204058ca9d672b21d6af933c6af81b7d4c85e75a9d9dafc896d1f168999559064ddb6dba43e2a143bba7d22177ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232672, "uuid": "472be49d-093c-4de9-9dcf-7010c27d1105", "value": "T17AC440B8ADDAC120FAA26976CBE7BD65BB3665D3173347C8930443CD5B03011BE42E69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232672, "uuid": "189f072c-c732-4638-9856-2378c03c7e0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232672, "uuid": "24f6201b-d1d7-4d2c-835c-90f778137bad", "value": "6144:3LeBvm7M/hDi57jb7PpqUb8EOevxqAMehSL0PqHoA51NerB9SC/y/R:CRU/EEvxlMehSL0PqHoAa9Kp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637232672, "uuid": "56fad845-d0c4-4c59-8225-c629de9b01f7", "value": 575384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637232672, "uuid": "cd1076f0-00be-4155-adee-4448203413c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637232672, "uuid": "a426176e-c2e0-433f-b208-611f6aee4fe9", "value": "d0605c3d557111c14c52eb052f590fb4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05441122-4869-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637237643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637237643, "uuid": "3522d4a9-1be5-41b4-8b89-ebdb4aba50f3", "comment": "Malware payload (Formbook)", "value": "f7ee657988a0055303705e709bb8387b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637237643, "uuid": "a361d22e-1deb-4b8c-aad0-a1a8a0d38756", "comment": "Malware payload (Formbook)", "value": "fcaf8625fb1fa5959b8739045ac7531e3b6368e2276d66cbd04eb608f3614abd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637237643, "uuid": "1ad8a20d-a918-4e3c-bde4-ae8843e7a62a", "comment": "Malware payload (Formbook)", "value": "c0d51068c051a71507d063caa90751e934e3839f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637237643, "uuid": "4777d706-d00a-4f43-a98e-2e913e151e73", "comment": "Malware payload (Formbook)", "value": "26a21f41438c7b7e425472835805456a6990a00217ce5b411cc8dbe57687c5b0096a20efd2408650d180562e61afad76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637237643, "uuid": "3a0766f5-1826-4f9d-8d71-a3efbcdf449e", "value": "T1ACF1D685FBE89737FDBB8731887352405231B705AC2ADB2E248831666D667808596F72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637237643, "uuid": "b7b2f7d2-7340-4fd9-8314-e7f456a72d85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637237643, "uuid": "1cba846f-a942-41a4-b75d-048572a2a97c", "value": "96:k4zAAOePkZzs+fldA0fcZ8Pu3eSFbnc33uvAbXAQgWfQrzNt:k4EZePsxtcZc5SFjc3evAUWot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637237643, "uuid": "0cc77497-b57e-4f9b-b016-c6150821dea2", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637237643, "uuid": "c5ca1b77-c4c7-41d1-be81-8e6f003674a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637237643, "uuid": "f6ff1693-497a-461d-98a6-924d822b1136", "value": "111821 New Order_xlxs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f467112-484d-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637225768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225768, "uuid": "e612c00a-663a-46bf-aff6-e793cddb12c1", "comment": "Malware payload (Loki)", "value": "76da1410d2f8ec333945671f991017ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225768, "uuid": "e8d1bb75-211c-4f91-be93-783168a521b1", "comment": "Malware payload (Loki)", "value": "fd181ea13be2e51f76618b1571288854ceb1317af0ca14f8dd8936687c16f9a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225768, "uuid": "17c0e35b-7030-4128-a79e-50bae599b1f4", "comment": "Malware payload (Loki)", "value": "08fe564734b26f05bb24787f9b2fb9c47e2dbc96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637225768, "uuid": "b6b64e4a-b1b0-45e3-8155-3dca0fc56ac0", "comment": "Malware payload (Loki)", "value": "2d71f0e602612b038e8cf5f0fe5602c4388ae91beab06caa102a6bf8921611e631c04de3d40ad609511b6cb1a1aed14e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225768, "uuid": "7b7a44a7-4861-48b2-9da9-9280cb8df62c", "value": "T1E5B4CFA03AB8C413F730857AD5B0D2BE8B70B16D0DD6C6067CEE2A9F76697647C58312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225768, "uuid": "debd247f-c9d8-46cc-b351-c436a757d6cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225768, "uuid": "b716c2ca-2315-4c38-9193-1efff3225c16", "value": "12288:wvLNMm31gW7F5Of8ypnJTtrQehIHaBlE+nVL:2NMm3KWWf9pJhQWHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637225768, "uuid": "400494dc-bc58-44b5-ab4e-95fe289c9620", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637225768, "uuid": "da93fd19-6280-4a9b-8f91-211b9571e9de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637225768, "uuid": "1d424cdb-646d-4fe3-931d-c76e80dcb3a7", "value": "76da1410d2f8ec333945671f991017ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ce2053-48bf-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637274771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637274771, "uuid": "2a1fa996-4803-46c1-af98-87a74ad387c2", "comment": "Malware payload", "value": "05c73523a9aeafb02f493d614bbdde78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637274771, "uuid": "530b06e0-00ad-46c6-a019-5c022a58a1f7", "comment": "Malware payload", "value": "fdcd2ff377ea23d1a593d8fa46f08879929bf7c7e5b7c1de31a41b022bc3a0d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637274771, "uuid": "73b9c009-595d-4647-818c-40076c20ac31", "comment": "Malware payload", "value": "132426a9b6bb1a7a73174b486bd5797dd93c556f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637274771, "uuid": "eed4befc-0a89-4ff1-ad4c-8d058073ca66", "comment": "Malware payload", "value": "3e68dadce62e3f07935cc2641277318c2e961a4f294d177e2ade7cc88d08ffa5d3dced69ec4b77a5ae158f16de44a4c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637274771, "uuid": "fd5ec08a-67f9-420a-90f5-4aec754ae563", "value": "T1AAA4BF11B6928072D5FF08302879DB9A0A6D7D714FA0C9DFBBE41A6E4D301C29B35A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637274771, "uuid": "d9190b4d-b9ad-43d9-8ff4-9da0492825e0", "value": "261bae8b02d2e7bf979e55d76b9dc786", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637274771, "uuid": "9b022cc0-d6d7-4cf3-b8a1-694e5b1e40a5", "value": "12288:bdv8jkvzqZvv2wLB6mTi12yD88kYwZ1h1:b2Zvv2cNTi1v0Z1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637274771, "uuid": "147174e2-6f26-4f90-880e-5ce4d0a2ea4b", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637274771, "uuid": "789084b8-838a-4f57-ad53-5fba6946e1fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637274771, "uuid": "344e8ecf-6ebc-4c4a-8c02-1cd106b22da4", "value": "05c73523a9aeafb02f493d614bbdde78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643578c2-4874-11ec-843c-42010a9c0014", "comment": "Malware payload (Hydra)", "timestamp": 1637242527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242527, "uuid": "6035ac33-73b2-4020-aaac-6b0c63dcc787", "comment": "Malware payload (Hydra)", "value": "4076db4387eb8ddf8f2010e3db8c8b07", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "torhydra", "colour": "#33F7B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242527, "uuid": "8286c3b7-9a40-4cb3-afcf-980e01f8e3d8", "comment": "Malware payload (Hydra)", "value": "fe9cfc5046c583a7b28fa506cd33e636d27310b14240247625c693444a27336f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "torhydra", "colour": "#33F7B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242527, "uuid": "3c6ecb86-ba8a-4e74-a3e8-bd5751917d28", "comment": "Malware payload (Hydra)", "value": "3555274dae63d29a66a68211ba6244b34ccab1c4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "torhydra", "colour": "#33F7B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637242527, "uuid": "ed14e045-59cd-493f-85dd-05ec5fca41a3", "comment": "Malware payload (Hydra)", "value": "6c389923e8c4b71de8e992182b5ac45f15ebb7e960fe0e7583c735f260466258400a0659f87f498121bcc1faa70029cb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "torhydra", "colour": "#33F7B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242527, "uuid": "6e718620-8dc5-40a3-874c-c0a20d377ce4", "value": "T1A19633BBFF2C9909DF676170DA0761C2246F1E29095AE61B3D47322D4B336E2571B8B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242527, "uuid": "c1b3a5ce-955f-49ba-9fa4-8b132a36277b", "value": "196608:kdlyQ4ap+OBepYoTxcInPkP1J9G52iLy/b5cCTIgvwtIbvxl3:kdkQ4aIhxcIPUBxRb5c3gMIVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637242527, "uuid": "c8d49754-a057-4547-b434-711b679c4ca6", "value": 9009525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637242527, "uuid": "9b777ec1-c9f7-436f-ad2e-63a953091e03", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637242527, "uuid": "77ceee5f-972f-4489-a3c9-1ef420932ab4", "value": "psk.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }